Qt's AT-SPI accessibility integration causes applications to crash

KDE's kcharselect application reproducibly crashes in Kubuntu 16.10.

The issue has been identified by KDE's developers to be due to a bug in Qt's accessibility support, with the recommendation to report it here.

The backtrace is as follows

Thread 1 (Thread 0x7ffff7e0bf00 (LWP 17960)):
#0 0x00007ffff6b05704 in QAbstractScrollArea::viewport (this=0x555556541d50)
at widgets/qabstractscrollarea.cpp:631
#1 0x00007ffff6b84745 in QAccessibleTableCell::rect (this=0x55555651ebd0) at
accessible/itemviews.cpp:1060
--Type <return> to continue, or q <return> to quit--
#2 0x00007ffff6b84c1a in QAccessibleTableCell::state (this=0x55555651ebd0) at
accessible/itemviews.cpp:1024
#3 0x00007fffeaa06426 in AtSpiAdaptor::notify (this=0x555555b30070,
event=<optimized out>) at linuxaccessibility/atspiadaptor.cpp:1060
#4 0x00007ffff6bd5b69 in QTableView::selectionChanged (this=0x5555558dc2a0,
selected=..., deselected=...)
at itemviews/qtableview.cpp:3343
#5 0x00007ffff6ba07f0 in QAbstractItemView::setSelectionModel
(this=this@entry=0x5555558dc2a0, selectionModel=selectionModel@entry=
0x555555c399e0) at itemviews/qabstractitemview.cpp:789
#6 0x00007ffff6bd4d0a in QTableView::setSelectionModel (this=0x5555558dc2a0,
selectionModel=0x555555c399e0)
at itemviews/qtableview.cpp:1187
#7 0x00007ffff7353f27 in KCharSelectTable::setContents (this=0x5555558dc2a0,
chars=...) at ./src/kcharselect.cpp:200
#8 0x00007ffff73557c0 in KCharSelect::KCharSelectPrivate::_k_search
(this=0x5555558161c0) at ./src/kcharselect.cpp:1006
#9 0x00007ffff7355a28 in KCharSelect::KCharSelectPrivate::_k_searchEditChanged
(this=0x5555558161c0) at ./src/kcharselect.cpp:984
#10 0x00007ffff7359191 in KCharSelect::qt_static_metacall (_o=0x555555814f30,
_c=<optimized out>, _id=<optimized out>, _a=<optimized out>)
at ./obj-x86_64-linux-gnu/src/moc_kcharselect.cpp:195
#11 0x00007ffff5d94b49 in QMetaObject::activate (sender=0x5555558137f0,
signalOffset=<optimized out>,
local_signal_index=local_signal_index@entry=0,
argv=argv@entry=0x7fffffffcf70) at kernel/qobject.cpp:3730
#12 0x00007ffff5d950f7 in QMetaObject::activate (sender=<optimized out>,
m=m@entry=0x7ffff6e3c8e0 <QLineEdit::staticMetaObject>,
local_signal_index=local_signal_index@entry=0,
argv=argv@entry=0x7fffffffcf70) at kernel/qobject.cpp:3595
#13 0x00007ffff6a8c4a2 in QLineEdit::textChanged (this=<optimized out>,
_t1=...) at .moc/moc_qlineedit.cpp:416
#14 0x00007ffff6a92a09 in QLineEdit::qt_static_metacall (_o=<optimized out>,
_c=<optimized out>, _id=<optimized out>, _a=<optimized out>)
at .moc/moc_qlineedit.cpp:237
#15 0x00007ffff5d94b49 in QMetaObject::activate
(sender=sender@entry=0x5555558174f0, signalOffset=<optimized out>,
local_signal_index=local_signal_index@entry=3,
argv=argv@entry=0x7fffffffd0c0) at kernel/qobject.cpp:3730
#16 0x00007ffff5d950f7 in QMetaObject::activate
(sender=sender@entry=0x5555558174f0,
m=m@entry=0x7ffff6e45260 <QWidgetLineControl::staticMetaObject>,
local_signal_index=local_signal_index@entry=3,
argv=argv@entry=0x7fffffffd0c0) at kernel/qobject.cpp:3595
#17 0x00007ffff6b1b285 in QWidgetLineControl::textChanged
(this=this@entry=0x5555558174f0, _t1=...)
at .moc/moc_qwidgetlinecontrol_p.cpp:261
#18 0x00007ffff6b1ead6 in QWidgetLineControl::finishChange
(this=this@entry=0x5555558174f0, validateFromState=8,
update=update@entry=false, edited=edited@entry=true) at
widgets/qwidgetlinecontrol.cpp:713
#19 0x00007ffff6b208f2 in QWidgetLineControl::backspace
(this=this@entry=0x5555558174f0) at widgets/qwidgetlinecontrol.cpp:228
#20 0x00007ffff6b21e3c in QWidgetLineControl::processKeyEvent
(this=0x5555558174f0, event=event@entry=0x7fffffffd790)
at widgets/qwidgetlinecontrol.cpp:1846
#21 0x00007ffff6a8c5fa in QLineEdit::keyPressEvent (this=0x5555558137f0,
event=0x7fffffffd790) at widgets/qlineedit.cpp:1693
#22 0x00007ffff697cb97 in QWidget::event (this=this@entry=0x5555558137f0,
event=event@entry=0x7fffffffd790) at kernel/qwidget.cpp:8781
#23 0x00007ffff6a92e19 in QLineEdit::event (this=0x5555558137f0,
e=0x7fffffffd790) at widgets/qlineedit.cpp:1456
#24 0x00007ffff69368ac in QApplicationPrivate::notify_helper (this=<optimized
out>, receiver=0x5555558137f0, e=0x7fffffffd790)
at kernel/qapplication.cpp:3804
#25 0x00007ffff693d76e in QApplication::notify (this=<optimized out>,
receiver=0x5555558137f0, e=0x7fffffffd790)
at kernel/qapplication.cpp:3181
--Type <return> to continue, or q <return> to quit--
#26 0x00007ffff5d673b0 in QCoreApplication::notifyInternal2
(receiver=0x5555558137f0, event=0x7fffffffd790)
at kernel/qcoreapplication.cpp:1015
#27 0x00007ffff69996eb in QWidgetWindow::event (this=0x5555558d8a90,
event=0x7fffffffd790) at kernel/qwidgetwindow.cpp:226
#28 0x00007ffff69368ac in QApplicationPrivate::notify_helper (this=<optimized
out>, receiver=0x5555558d8a90, e=0x7fffffffd790)
at kernel/qapplication.cpp:3804
#29 0x00007ffff693bd4f in QApplication::notify (this=0x7fffffffdbd0,
receiver=0x5555558d8a90, e=0x7fffffffd790)
at kernel/qapplication.cpp:3561
#30 0x00007ffff5d673b0 in QCoreApplication::notifyInternal2
(receiver=receiver@entry=0x5555558d8a90, event=event@entry=0x7fffffffd790)
at kernel/qcoreapplication.cpp:1015
#31 0x00007ffff634ac28 in QCoreApplication::sendSpontaneousEvent
(event=0x7fffffffd790, receiver=0x5555558d8a90)
at ../../include/QtCore/../../src/corelib/kernel/qcoreapplication.h:228
#32 QGuiApplicationPrivate::processKeyEvent (e=0x5555565364f0) at
kernel/qguiapplication.cpp:1984
#33 0x00007ffff634fde5 in QGuiApplicationPrivate::processWindowSystemEvent
(e=e@entry=0x5555565364f0) at kernel/qguiapplication.cpp:1662
#34 0x00007ffff632db2b in QWindowSystemInterface::sendWindowSystemEvents
(flags=...) at kernel/qwindowsysteminterface.cpp:648
#35 0x00007fffea9e9660 in userEventSourceDispatch (source=<optimized out>) at
eventdispatchers/qeventdispatcher_glib.cpp:70
#36 0x00007ffff339f7d7 in g_main_context_dispatch () from
/lib/x86_64-linux-gnu/libglib-2.0.so.0
#37 0x00007ffff339fa40 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#38 0x00007ffff339faec in g_main_context_iteration () from
/lib/x86_64-linux-gnu/libglib-2.0.so.0
#39 0x00007ffff5dbd48f in QEventDispatcherGlib::processEvents
(this=0x5555557c4ba0, flags=...) at kernel/qeventdispatcher_glib.cpp:417
#40 0x00007ffff5d650fa in QEventLoop::exec (this=this@entry=0x7fffffffda90,
flags=..., flags@entry=...) at kernel/qeventloop.cpp:204
#41 0x00007ffff5d6d90c in QCoreApplication::exec () at
kernel/qcoreapplication.cpp:1285
#42 0x000055555555a962 in main (argc=<optimized out>, argv=<optimized out>) at
./main.cc:74

Please also look at https://bugs.kde.org/show_bug.cgi?id=374933 and https://bugs.launchpad.net/bugs/1655774. Possibly https://bugs.kde.org/show_bug.cgi?id=362603 is also the same bug, seen on a slightly different environment.

To reproduce the issue, just open kcharselect and type something in the search field (e.g. "double"). If you type fast enough and/or use the backspace, the application crashes.