Bug 168897 - Crash when JAWS is running and template starting with table is opened
Summary: Crash when JAWS is running and template starting with table is opened
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
25.8.0.4 release
Hardware: All All
: medium normal
Assignee: Michael Stahl
URL:
Whiteboard: target:26.2.0 target:25.8.4
Keywords: accessibility
Depends on:
Blocks: a11y-Windows
  Show dependency tree / graph
 
Reported: 2025-10-16 13:37 UTC by Gabor Kelemen (Collabora)
Modified: 2025-11-28 16:52 UTC (History)
1 user (show)

See Also:
Crash report or crash signature: https://crashreport.libreoffice.org/stats/crash_details/fb3995b2-55ef-4629-92d3-cb7ca411594e

Attachments
Example file to crash Writer (9.16 KB, application/vnd.oasis.opendocument.text-template)
2025-10-16 13:37 UTC, Gabor Kelemen (Collabora) 		Details
Another template with just lorem text works (23.61 KB, application/vnd.oasis.opendocument.text-template)
2025-10-16 13:37 UTC, Gabor Kelemen (Collabora) 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Gabor Kelemen (Collabora) 2025-10-16 13:37:24 UTC 
Created attachment 203373 [details]
Example file to crash Writer

When JAWS is running, and I open the attached template from the Explorer, LO crashes.

1. Save attached document
2. Install JAWS demo from https://support.freedomscientific.com/Downloads/JAWS 
3. Double click on the attached document when in Explorer
-> Opens, all is fine
4. Start JAWS
5. Double click on the attached document when in Explorer
-> LO crashes

Happens in 24.2 and 

Version: 25.8.0.4 (X86_64)
Build ID: 48f00303701489684e67c38c28aff00cd5929e67
CPU threads: 14; OS: Windows 10 X86_64 (build 19045); UI render: Skia/Raster; VCL: win
Locale: de-AT (hu_HU); UI: de-DE
Calc: threaded

Supposedly in master too, I'm just unable to tell Windows to use the nightly as default association, somehow.

It seems like this does not happen, if I open the file from a running LO instance, and the document starting with a table also seems to be important.
Comment 1 Gabor Kelemen (Collabora) 2025-10-16 13:37:50 UTC 
Created attachment 203374 [details]
Another template with just lorem text works
Comment 2 Michael Stahl 2025-11-26 18:51:02 UTC 
this was very nonobvious, but it looks like the problem is that  CMAccessible::SmartQI() returns a pointer that was queried for IUnknown, and not for the interface that the caller requested
(actually i'm wondering how this doesn't crash all the time and with every Win a11y tool)


> Supposedly in master too, I'm just unable to tell Windows to use the nightly as default association, somehow.

try: msiexec /i ...msi WRITE_REGISTRY=1

> It seems like this does not happen, if I open the file from a running LO instance

this crashes for me too.
Comment 3 Commit Notification 2025-11-28 08:56:29 UTC 
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/b2c03ef9c7f6886196d6bfaa57e2b64bdfe248ab

tdf#168897 winaccessibility: fix JAWS crash with CAccTable

It will be available in 26.2.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 4 Michael Stahl 2025-11-28 09:01:54 UTC 
fixed (only tested with 24.2 based downstream branch)
Comment 5 Commit Notification 2025-11-28 11:37:54 UTC 
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-25-8":

https://git.libreoffice.org/core/commit/5cc5e0a2cc9ee5b7ccef19589b4c2e4bbd78586f

tdf#168897 winaccessibility: fix JAWS crash with CAccTable

It will be available in 25.8.4.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 6 Michael Weghorn 2025-11-28 16:45:17 UTC 
(In reply to Michael Stahl from comment #2)
> this was very nonobvious, but it looks like the problem is that 
> CMAccessible::SmartQI() returns a pointer that was queried for IUnknown, and
> not for the interface that the caller requested
> (actually i'm wondering how this doesn't crash all the time and with every
> Win a11y tool)

Oh...

Thanks a lot for analyzing and fixing that!

(In reply to Michael Stahl from comment #4)
> fixed (only tested with 24.2 based downstream branch)

Fix verified on master.

Version: 26.2.0.0.alpha1+ (X86_64) / LibreOffice Community
Build ID: cbf4d41f0607eb5b99328c4e9c172f92a4b6aea2
CPU threads: 12; OS: Windows 11 X86_64 (build 26200); UI render: Skia/Raster; VCL: win
Locale: en-GB (en_GB); UI: en-US
Calc: threaded