Details
-
Bug
-
Resolution: Fixed
-
P1: Critical
-
5.15.13
-
None
-
Fedora 40
-
-
d91d53c95 (dev), 10b480f1d (6.7), 20b5a25ea (6.6), 64348e717 (tqtc/lts-5.15)
Description
Steps to reproduce:
- Run the Simple Tree Model example in Qt Creator
- Launch the Accerciser accessibility explorer.
- Select/highlight the accessible the "tree" role child of the app
- In Accerciser's iPython console type the following, substituting various indices for n (see output below for example)
Atspi.Table.get_row_column_extents_at_index(acc, n)
Expected results: No crash.
Actual results: Reliable crash for some indices (e.g. 11 might work; 12 might crash)
iPython console output:
In [3]: Atspi.Table.get_row_column_extents_at_index(acc, 11) Out[3]: (True, row=5, col=1, row_extents=1, col_extents=1, is_selected=False) In [4]: Atspi.Table.get_row_column_extents_at_index(acc, 12) --------------------------------------------------------------------------- Error Traceback (most recent call last) Cell In[4], line 1 ----> 1 Atspi.Table.get_row_column_extents_at_index(acc, 12) Error: atspi_error: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken. (1)
Terminal output:
$ ./simpletreemodel
QAccessibleTree::indexFromLogical: invalid index: 6 0 for QTreeView(0x7ffca99b9790)
Requested invalid tree cell: 6 0
Associated stack trace:
Thread 1 "simpletreemodel" received signal SIGSEGV, Segmentation fault. AtSpiAdaptor::tableInterface (this=this@entry=0x562bdf6a5380, interface=interface@entry=0x7f30d4003448, function=..., message=..., connection=...) at atspiadaptor.cpp:2443 2443 QAccessibleTableCellInterface *cell = interface->tableInterface()->cellAt(row, col)->tableCellInterface(); (gdb) bt #0 AtSpiAdaptor::tableInterface (this=this@entry=0x562bdf6a5380, interface=interface@entry=0x7f30d4003448, function=..., message=..., connection=...) at atspiadaptor.cpp:2443 #1 0x00007f30e238cbb5 in AtSpiAdaptor::handleMessage (this=this@entry=0x562bdf6a5380, message=..., connection=...) at atspiadaptor.cpp:1315 #2 0x00007f30efa4f70a in QDBusConnectionPrivate::activateObject (this=0x7f30dc015980, node=..., msg=..., pathStartPos=27) at qdbusintegrator.cpp:1464 #3 0x00007f30efa51e64 in QDBusActivateObjectEvent::placeMetaCall (this=0x562bdf65ff30) at qdbusintegrator.cpp:1623 #4 0x00007f30f36df0cb in QObject::event (this=0x562bdf6a5380, e=0x562bdf65ff30) at kernel/qobject.cpp:1347 #5 0x00007f30f3baeb75 in QApplicationPrivate::notify_helper (this=<optimized out>, receiver=0x562bdf6a5380, e=0x562bdf65ff30) at kernel/qapplication.cpp:3640 #6 0x00007f30f36b4548 in QCoreApplication::notifyInternal2 (receiver=0x562bdf6a5380, event=0x562bdf65ff30) at kernel/qcoreapplication.cpp:1064 #7 0x00007f30f36b4762 in QCoreApplication::sendEvent (receiver=<optimized out>, event=<optimized out>) at kernel/qcoreapplication.cpp:1462 #8 0x00007f30f36b79f5 in QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x562bdf334b60) at kernel/qcoreapplication.cpp:1821 #9 0x00007f30f36b7cad in QCoreApplication::sendPostedEvents (receiver=<optimized out>, event_type=<optimized out>) at kernel/qcoreapplication.cpp:1680 #10 0x00007f30f3706f9f in postEventSourceDispatch (s=0x562bdf4739c0) at kernel/qeventdispatcher_glib.cpp:277 #11 0x00007f30f2112e5c in g_main_dispatch (context=0x7f30dc000ec0) at ../glib/gmain.c:3476 #12 g_main_context_dispatch_unlocked (context=0x7f30dc000ec0) at ../glib/gmain.c:4284 #13 0x00007f30f216ddd8 in g_main_context_iterate_unlocked.isra.0 (context=context@entry=0x7f30dc000ec0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:4349 #14 0x00007f30f2110ad3 in g_main_context_iteration (context=0x7f30dc000ec0, may_block=1) at ../glib/gmain.c:4414 #15 0x00007f30f3706a89 in QEventDispatcherGlib::processEvents (this=0x562bdf4750f0, flags=...) at kernel/qeventdispatcher_glib.cpp:423 #16 0x00007f30f36b2f0b in QEventLoop::exec (this=this@entry=0x7ffca99b96d0, flags=..., flags@entry=...) at ../../include/QtCore/../../src/corelib/global/qflags.h:69 #17 0x00007f30f36bb19b in QCoreApplication::exec () at ../../include/QtCore/../../src/corelib/global/qflags.h:121 #18 0x00007f30f2760edd in QGuiApplication::exec () at kernel/qguiapplication.cpp:1863 #19 0x00007f30f3baeae9 in QApplication::exec () at kernel/qapplication.cpp:2832 #20 0x0000562bdefe06a3 in main (argc=<optimized out>, argv=<optimized out>) at main.cpp:72
Impact: I (Orca maintainer) have added a temporary check to not do this call on objects with the "tree" role because of this bug. Without that check apps commonly used by Orca users (e.g. Mumble) will crash.
Attachments
Issue Links
- is duplicated by
-
QTBUG-125954 Segfault in QAccessibleTableInterface::cellAt
- Closed