Details
-
Bug
-
Resolution: Fixed
-
P1: Critical
-
5.11
-
None
-
Fedora 39
-
-
d91d53c95 (dev), 10b480f1d (6.7), 20b5a25ea (6.6)
Description
Steps to reproduce:
- Run the Simple Tree Model example in Qt Creator
- Launch the Accerciser accessibility explorer.
- Select/highlight the accessible the "tree" role child of the app
- In Accerciser's iPython console type the following, substituting various indices for n (see output below for example)
Atspi.Table.get_row_column_extents_at_index(acc, n)
Expected results: No crash.
Actual results: Reliable crash for some indices (e.g. 11 might work; 12 might crash)
iPython console output:
In [3]: Atspi.Table.get_row_column_extents_at_index(acc, 11) Out[3]: (True, row=5, col=1, row_extents=1, col_extents=1, is_selected=False) In [4]: Atspi.Table.get_row_column_extents_at_index(acc, 12) --------------------------------------------------------------------------- Error Traceback (most recent call last) Cell In[4], line 1 ----> 1 Atspi.Table.get_row_column_extents_at_index(acc, 12) Error: atspi_error: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken. (1)
Terminal output:
$ ./simpletreemodel
QAccessibleTree::indexFromLogical: invalid index: 6 0 for QTreeView(0x7ffca99b9790)
Requested invalid tree cell: 6 0
Associated stack trace:
Thread 1 "simpletreemodel" received signal SIGSEGV, Segmentation fault. AtSpiAdaptor::tableInterface (this=this@entry=0x562bdf6a5380, interface=interface@entry=0x7f30d4003448, function=..., message=..., connection=...) at atspiadaptor.cpp:2443 2443 QAccessibleTableCellInterface *cell = interface->tableInterface()->cellAt(row, col)->tableCellInterface(); (gdb) bt #0 AtSpiAdaptor::tableInterface (this=this@entry=0x562bdf6a5380, interface=interface@entry=0x7f30d4003448, function=..., message=..., connection=...) at atspiadaptor.cpp:2443 #1 0x00007f30e238cbb5 in AtSpiAdaptor::handleMessage (this=this@entry=0x562bdf6a5380, message=..., connection=...) at atspiadaptor.cpp:1315 #2 0x00007f30efa4f70a in QDBusConnectionPrivate::activateObject (this=0x7f30dc015980, node=..., msg=..., pathStartPos=27) at qdbusintegrator.cpp:1464 #3 0x00007f30efa51e64 in QDBusActivateObjectEvent::placeMetaCall (this=0x562bdf65ff30) at qdbusintegrator.cpp:1623 #4 0x00007f30f36df0cb in QObject::event (this=0x562bdf6a5380, e=0x562bdf65ff30) at kernel/qobject.cpp:1347 #5 0x00007f30f3baeb75 in QApplicationPrivate::notify_helper (this=<optimized out>, receiver=0x562bdf6a5380, e=0x562bdf65ff30) at kernel/qapplication.cpp:3640 #6 0x00007f30f36b4548 in QCoreApplication::notifyInternal2 (receiver=0x562bdf6a5380, event=0x562bdf65ff30) at kernel/qcoreapplication.cpp:1064 #7 0x00007f30f36b4762 in QCoreApplication::sendEvent (receiver=<optimized out>, event=<optimized out>) at kernel/qcoreapplication.cpp:1462 #8 0x00007f30f36b79f5 in QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x562bdf334b60) at kernel/qcoreapplication.cpp:1821 #9 0x00007f30f36b7cad in QCoreApplication::sendPostedEvents (receiver=<optimized out>, event_type=<optimized out>) at kernel/qcoreapplication.cpp:1680 #10 0x00007f30f3706f9f in postEventSourceDispatch (s=0x562bdf4739c0) at kernel/qeventdispatcher_glib.cpp:277 #11 0x00007f30f2112e5c in g_main_dispatch (context=0x7f30dc000ec0) at ../glib/gmain.c:3476 #12 g_main_context_dispatch_unlocked (context=0x7f30dc000ec0) at ../glib/gmain.c:4284 #13 0x00007f30f216ddd8 in g_main_context_iterate_unlocked.isra.0 (context=context@entry=0x7f30dc000ec0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:4349 #14 0x00007f30f2110ad3 in g_main_context_iteration (context=0x7f30dc000ec0, may_block=1) at ../glib/gmain.c:4414 #15 0x00007f30f3706a89 in QEventDispatcherGlib::processEvents (this=0x562bdf4750f0, flags=...) at kernel/qeventdispatcher_glib.cpp:423 #16 0x00007f30f36b2f0b in QEventLoop::exec (this=this@entry=0x7ffca99b96d0, flags=..., flags@entry=...) at ../../include/QtCore/../../src/corelib/global/qflags.h:69 #17 0x00007f30f36bb19b in QCoreApplication::exec () at ../../include/QtCore/../../src/corelib/global/qflags.h:121 #18 0x00007f30f2760edd in QGuiApplication::exec () at kernel/qguiapplication.cpp:1863 #19 0x00007f30f3baeae9 in QApplication::exec () at kernel/qapplication.cpp:2832 #20 0x0000562bdefe06a3 in main (argc=<optimized out>, argv=<optimized out>) at main.cpp:72
Impact: I (Orca maintainer) have added a temporary check to not do this call on objects with the "tree" role because of this bug. Without that check apps commonly used by Orca users (e.g. Mumble) will crash.