Bug 122200 - kde5: Crash when navigating tree in accerciser (Accessibility Explorer)
Summary: kde5: Crash when navigating tree in accerciser (Accessibility Explorer)
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: UI (show other bugs)
Version:
(earliest affected)
6.3.0.0.alpha0+
Hardware: All Linux (All)
: medium normal
Assignee: Michael Weghorn
URL:
Whiteboard: target:6.4.0 target:6.2.5 target:6.3.0.1
Keywords:
Depends on:
Blocks: KDE
  Show dependency treegraph
 
Reported: 2018-12-19 15:10 UTC by Michael Weghorn
Modified: 2019-06-03 16:17 UTC (History)
2 users (show)

See Also:
Crash report or crash signature:


Attachments
Video showing what to do in accerciser to make LibreOffice crash (2.05 MB, video/ogg)
2018-12-19 15:10 UTC, Michael Weghorn
Details
gdb backtrace at the problematic place (6.58 KB, text/plain)
2019-05-30 21:30 UTC, Michael Weghorn
Details
Screenshot of accerciser with gtk3 and problematic offset (83.46 KB, image/png)
2019-05-30 21:38 UTC, Michael Weghorn
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Weghorn 2018-12-19 15:10:53 UTC
Created attachment 147671 [details]
Video showing what to do in accerciser to make LibreOffice crash

Version: 6.3.0.0.alpha0+
Build ID: ef8de8d202deb92a57b52f4e48a4de77cf6d8b34
CPU threads: 1; OS: Linux 4.19; UI render: default; VCL: kde5; 
Locale: en-GB (en_GB.UTF-8); UI-Language: en-US
Calc: threaded

This is specific to the qt5/kde5 VCL plugin. It's not reproducible when using e.g. the gtk3 VCL plugin.

Steps to reproduce:

1) start LibreOffice Writer: 'soffice --writer'
2) start "accerciser" (Accessibility Explorer)
3) navigate the tree in accerciser as shown in attached video, e.g. do everything until including clicking the "label" item

Result:

LibreOffice crashes (exit value is 77).

When started from command line, the following output appears there:

    LibreOfficeDev 6.3 - Fatal Error:


Notes:

* some other items in the tree work just fine
* Testing was done in Debian unstable, Orca is at version 3.30.1-1.
* The crash does not appear when doing the same with the gtk3 VCL plugin instead, which shows similar items for navigation in the tree in accerciser.
Comment 1 Xisco Faulí 2019-01-21 18:37:13 UTC
Hi Michael Weghorn,
is this issue still reproducible in master ?
Comment 2 Michael Weghorn 2019-01-21 21:43:15 UTC
(In reply to Xisco Faulí from comment #1)
> Hi Michael Weghorn,
> is this issue still reproducible in master ?

Yes, still reproducible with

Version: 6.3.0.0.alpha0+
Build ID: fef58ec13c548fbd692adabafb0a84f50c273146
CPU threads: 2; OS: Linux 4.19; UI render: default; VCL: kde5; 
TinderBox: Linux-rpm_deb-x86_64@86-TDF, Branch:master, Time: 2019-01-21_04:32:52
Locale: en-US (en_DK.UTF-8); UI-Language: en-US
Calc: threaded
Comment 3 Xisco Faulí 2019-01-21 22:24:23 UTC
Thanks. Moving to NEW
Comment 4 Katarina Behrens (CIB) 2019-04-30 11:39:11 UTC
Tentative duplicate of bug 122056
Comment 5 Michael Weghorn 2019-05-30 21:30:41 UTC
Created attachment 151790 [details]
gdb backtrace at the problematic place
Comment 6 Michael Weghorn 2019-05-30 21:38:34 UTC
Created attachment 151791 [details]
Screenshot of accerciser with gtk3 and problematic offset

The problem is that 'Qt5AccessibleWidget::attributes' is called with 'offset' having the same value as the length of the text for the status bar entry and that causes and IndexOutOfBoundsException (maximum index allowed is length -1).

The problematic index can also be observed when e.g. using the gtk3 VCL plugin for LibreOffice and navigating to the entry in accerciser.
The attached screenshot shows accerciser with offset 11 used for a text of length 11 ("Page 1 of 1"). It can be seen that no text attributes are shown and "Start" and "End" are set to random (uninitialized) values, while all of those have reasonable values when using a lower value for the offset.

It'd need further investigation what exactly is allowed here.

I'll upload a patch that will make qt5 also ignore invalid offsets.
Comment 7 Michael Weghorn 2019-05-30 21:42:29 UTC
Change in Gerrit: https://gerrit.libreoffice.org/73225
Comment 8 Commit Notification 2019-06-03 08:00:20 UTC
Michael Weghorn committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/+/93c81657c6111b4bb97a2bb9ec155465f9a6f523%5E%21

tdf#122200 Qt5AccessibleWidget: Handle special offset values

It will be available in 6.4.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 9 Michael Weghorn 2019-06-03 08:26:54 UTC
Fixed in master now; pending backports for 6.2 and 6.3:

https://gerrit.libreoffice.org/#/c/73378/
https://gerrit.libreoffice.org/#/c/73379/
Comment 10 Commit Notification 2019-06-03 16:13:29 UTC
Michael Weghorn committed a patch related to this issue.
It has been pushed to "libreoffice-6-2":

https://git.libreoffice.org/core/+/0b904a8b3ceb648cf6466cb33f07310a3c70f793%5E%21

tdf#122200 Qt5AccessibleWidget: Handle special offset values

It will be available in 6.2.5.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 11 Commit Notification 2019-06-03 16:17:14 UTC
Michael Weghorn committed a patch related to this issue.
It has been pushed to "libreoffice-6-3":

https://git.libreoffice.org/core/+/5b54a62b086726f854a474623e1330b28b7984b7%5E%21

tdf#122200 Qt5AccessibleWidget: Handle special offset values

It will be available in 6.3.0.1.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.