After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 387960 - Calls to text.getAttributeRun cause gedit to crash when running with Orca
Calls to text.getAttributeRun cause gedit to crash when running with Orca
Status: RESOLVED FIXED
Product: atk
Classification: Platform
Component: gail
git master
Other All
: High normal
: ---
Assigned To: bill.haneman
Li Yuan
Depends on:
Blocks:
 
 
Reported: 2006-12-20 17:17 UTC by Rich Burridge
Modified: 2007-01-02 21:35 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
Standalone Python script that can be used to reproduce the problem. (15.40 KB, text/plain)
2006-12-20 17:20 UTC, Rich Burridge
  Details
New version of the standalone Python script. (14.72 KB, text/plain)
2006-12-28 21:52 UTC, Rich Burridge
  Details
Output from running the python script when line 386 is "if True or string == "Some text":" (1.08 KB, text/plain)
2006-12-28 21:53 UTC, Rich Burridge
  Details
Output from the script when line 386 is "if string == "Some text":" (69.20 KB, text/plain)
2006-12-28 21:54 UTC, Rich Burridge
  Details
patch to fix this bug (fix array index). (453 bytes, patch)
2007-01-02 20:27 UTC, bill.haneman
committed Details | Review

Description Rich Burridge 2006-12-20 17:17:17 UTC
The at-spi documentation states that text.getAttributeRun() should
now be used in preference to text.getAttributes(). Unfortunately
when we tried to use this with Orca it crashed the running application.

A typical stack trace for gedit looks like:

Distribution: Ubuntu 6.10 (edgy)
Gnome Release: 2.16.1 2006-10-02 (Ubuntu)
BugBuddy Version: 2.16.0

Memory status: size: 171798528 vsize: 171798528 resident: 27844608 share: 15953920 rss: 27844608 rss_rlim: -1
CPU usage: start_time: 1166634834 rtime: 102 utime: 90 stime: 12 cutime:0 cstime: 0 timeout: 0 it_real_value: 0 frequency: 100

Backtrace was generated from '/usr/bin/gedit'

(no debugging symbols found)
Using host libthread_db library "/lib/libthread_db.so.1".
(no debugging symbols found)
(no debugging symbols found)
[Thread debugging using libthread_db enabled]
[New Thread 47952112387536 (LWP 8570)]
(no debugging symbols found)
...
(no debugging symbols found)
0x00002b9cb302beb5 in waitpid () from /lib/libpthread.so.0

Thread 1 (Thread 47952112387536 (LWP 8570))

  • #0 waitpid
    from /lib/libpthread.so.0
  • #1 gnome_gtk_module_info_get
    from /usr/lib64/libgnomeui-2.so.0
  • #2 <signal handler called>
  • #3 spi_table_get_type
    from /usr/lib/libspi.so.0
  • #4 _ORBIT_skel_small_Accessibility_Text_getAttributeRun
    from /usr/lib/libspi.so.0
  • #5 ORBit_small_invoke_adaptor
    from /usr/lib/libORBit-2.so.0
  • #6 ORBit_recv_buffer_return_sys_exception
    from /usr/lib/libORBit-2.so.0
  • #7 ORBit_recv_buffer_return_sys_exception
    from /usr/lib/libORBit-2.so.0
  • #8 ORBit_skel_class_register
    from /usr/lib/libORBit-2.so.0
  • #9 ORBit_handle_request
    from /usr/lib/libORBit-2.so.0
  • #10 giop_connection_handle_input
    from /usr/lib/libORBit-2.so.0
  • #11 link_connection_state_changed
    from /usr/lib/libORBit-2.so.0
  • #12 g_main_context_dispatch
    from /usr/lib64/libglib-2.0.so.0
  • #13 g_main_context_check
    from /usr/lib64/libglib-2.0.so.0
  • #14 g_main_context_iteration
    from /usr/lib64/libglib-2.0.so.0
  • #15 giop_recv_buffer_get
    from /usr/lib/libORBit-2.so.0
  • #16 ORBit_small_invoke_stub
    from /usr/lib/libORBit-2.so.0
  • #17 Accessibility_DeviceEventController_notifyListenersSync
    from /usr/lib/libspi.so.0
  • #18 gnome_accessibility_module_shutdown
    from /usr/lib/gtk-2.0/modules/libatk-bridge.so
  • #19 gail_tree_view_new
    from /usr/lib/gtk-2.0/modules/libgail.so
  • #20 g_hash_table_lookup_extended
    from /usr/lib64/libglib-2.0.so.0
  • #21 gail_util_get_type
    from /usr/lib/gtk-2.0/modules/libgail.so
  • #22 gtk_main_do_event
    from /usr/lib64/libgtk-x11-2.0.so.0
  • #23 _gdk_events_init
    from /usr/lib64/libgdk-x11-2.0.so.0
  • #24 g_main_context_dispatch
    from /usr/lib64/libglib-2.0.so.0
  • #25 g_main_context_check
    from /usr/lib64/libglib-2.0.so.0
  • #26 g_main_loop_run
    from /usr/lib64/libglib-2.0.so.0
  • #27 gtk_main
    from /usr/lib64/libgtk-x11-2.0.so.0
  • #28 main
  • #0 waitpid
    from /lib/libpthread.so.0

I will attach a simple standalone Python script that can be used to reproduce the problem.
Comment 1 Rich Burridge 2006-12-20 17:20:38 UTC
Created attachment 78701 [details]
Standalone Python script that can be used to reproduce the problem.

Bug reproducer for bug #387960.  This standalone module talks
directly with the AT-SPI Registry via its IDL interfaces.  No Orca
logic or code is stuck in the middle.

To run this module, merely type 'python bug_387960.py' in an xterm.

Steps to Reproduce:
1. Run the attached standalone python application in an xterm
2. Run gedit
3. Type in "Some text" (without the double quotes).
4. Press F11.
5. Press F12 to terminate the python application.

Results:
In the xterm window, you will see all a lot of information about all the
text in the gedit application.

As it currently stands, gedit will crash if you run the steps above and
press F11.

If you edit the script, and adjust line 401 from:

            if True or string == "Some text":

to

            if string == "Some text":

and rerun with the steps above, then the text.getAttributeRun() call
is successful.
Comment 2 Li Yuan 2006-12-21 06:27:52 UTC
I tried the script. When I ran it, it just print out some application information running on my desktop, and when I started gedit, input "Some text" and press F11, nothing happened. No more output from the script. Did I do something wrong?
Comment 3 Joanmarie Diggs (IRC: joanie) 2006-12-21 14:22:43 UTC
When I try to run it, I get an immediate COMM FAILURE and the script exits.

Script started on Thu 21 Dec 2006 09:18:49 AM EST
]0;jd@pokey: ~jd@pokey:~$ python bug_387960.py 

Press F12 to Exit.

There are 1 desktops

  Desktop 0 (name=main) has 12 apps

    App 0: name=gnome-settings-daemon role=application

    App 1: name=gnome-session role=application

    App 2: name=metacity role=application

    App 3: name=gnome-panel role=application

      Child 0: name=Bottom Expanded Edge Panel role=frame state=(ENABLED RESIZABLE SENSITIVE SHOWING VISIBLE)

      Child 1: name=Top Expanded Edge Panel role=frame state=(ENABLED RESIZABLE SENSITIVE SHOWING VISIBLE)

    App 4: name=gnome-volume-manager role=application

    App 5: name=nautilus role=application

      Child 0: name=Desktop role=frame state=(ENABLED SENSITIVE SHOWING VISIBLE)

      Child 1: name= role=window state=(ENABLED RESIZABLE SENSITIVE SHOWING VISIBLE)

      Child 2: name= role=window state=(ENABLED RESIZABLE SENSITIVE SHOWING VISIBLE)

      Child 3: name= role=window state=(ENABLED RESIZABLE SENSITIVE SHOWING VISIBLE)

    App 6: name=update-notifier role=application

    App 7: name=gnome-power-manager role=application

    App 8: name=gnome-cups-icon role=application

Traceback (most recent call last):

  • File "bug_387960.py", line 443 in ?
  • File "bug_387960.py", line 433 in test
  • File "bug_387960.py", line 356 in printDesktops

    app = desktop.getChildAtIndex(j)

CORBA.COMM_FAILURE

]0;jd@pokey: ~jd@pokey:~$ 
Script done on Thu 21 Dec 2006 09:18:52 AM EST
Comment 4 Rich Burridge 2006-12-28 21:52:35 UTC
Created attachment 79004 [details]
New version of the standalone Python script.
Comment 5 Rich Burridge 2006-12-28 21:53:34 UTC
Created attachment 79005 [details]
Output from running the python script when line 386 is "if True or string == "Some text":"
Comment 6 Rich Burridge 2006-12-28 21:54:12 UTC
Created attachment 79006 [details]
Output from the script when line 386 is "if string == "Some text":"
Comment 7 Rich Burridge 2006-12-28 21:58:23 UTC
Li, my instructions might have been slightly confusing. I suspect
you might have been hitting F11 when you had focus in the (inaccessible)
xterm window. 

Joanie, I suspect you had something running on your desktop that the script
didn't like. Maybe an application running as root? ...

I've rewritten the script to no longer call "printDesktops()" so the
latter problem should go away. I've rewritten the instructions as:

1. Run gedit
2. Type in "Some text" (without the double quotes).
3. Run the attached standalone python application in an xterm
4. Give focus to the gedit window and press F11.
5. Press F12 in the gedit window to terminate the python application
   or Control-C in the xterm window.

I've also attached the output from the script; both when causing gedit
to crash and a "good" run when the script specifically just looks for
the string "Some text".

If there is anything else I can do, please let me know.

Thanks.

Comment 8 bill.haneman 2007-01-02 14:41:09 UTC
Rich, can you provide a stack trace with debug symbols? (need symbols for at-spi, atk, and gail).  Also, are you using HEAD or a very recent at-spi/atk/gail set?  A serious issue with getAttributeRun was fixed in CVS HEAD around Dec 16/17 IIRC.
Comment 9 Rich Burridge 2007-01-02 15:46:48 UTC
Bill, can you not run the small standalone Python script to reproduce
the problem? I spent quite a lot of time generating that. If these sort
of scripts aren't useful, then I'll stop creating them.

I'm using whatever comes in GNOME 2.16.1 on a Ubuntu Edgy system.
Comment 10 bill.haneman 2007-01-02 16:17:44 UTC
Rich - your python script is very helpful :-), so please don't stop generating such scripts.  However the stack traces posted without debug symbols are not useful, so as a general request I would ask that you obtain debug versions of the libraries when investigating bugs.  It's standard (gnome) operating procedure to mark bugs without debug symbols in the stack trace as 'needinfo'.

Comment 11 Rich Burridge 2007-01-02 16:41:13 UTC
Bill - if you run the Python script I created on your machine 
(which presumably has the latest atk/gail from CVS HEAD), and 
you follow the steps provided, do you see gedit crash? If so, 
then you will surely have the debug symbols you are looking for.
This should take you 1-2 minutes. What am I missing?

> It's standard (gnome) operating procedure to mark bugs without 
> debug symbols in the stack trace as 'needinfo'.

Interesting. Hmm. So I should mark all of those bugs reported 
automatically by several Linux distros using bugbuddy, as "needinfo"
just because their are no debug symbols in them?
Comment 12 bill.haneman 2007-01-02 17:23:35 UTC
"Interesting. Hmm. So I should mark all of those bugs reported 
automatically by several Linux distros using bugbuddy, as "needinfo"
just because their are no debug symbols in them?"

Yep, that's what most maintainers do, if the root cause of the problem isn't obvious from the stripped stack trace.  In fact if you look just under the "comment box" in bugzilla while logged in you'll see links including "bad_stacktrace" which, if clicked, will mark the bug NEEDINFO while automatically adding a request for a stack trace with debug symbols.

(When reading bug mail I am not normally running debug/unstable/HEAD GNOME so I can't just run your python script and expect to get reasonable results.)
Comment 13 Joanmarie Diggs (IRC: joanie) 2007-01-02 19:36:12 UTC
How 'bout this one, Bill?  I *just* built the following from CVS HEAD:

* atk
* gail
* at-spi
* ORBit2
* gedit

-------------------------------------
Distribution: Ubuntu 6.10 (edgy)
Gnome Release: 2.16.1 2006-10-02 (Ubuntu)
BugBuddy Version: 2.16.0

Memory status: size: 37650432 vsize: 0 resident: 37650432 share: 0 rss: 15310848 rss_rlim: 0
CPU usage: start_time: 1167766093 rtime: 0 utime: 48 stime: 0 cutime:44 cstime: 0 timeout: 4 it_real_value: 0 frequency: 0

Backtrace was generated from '/usr/bin/gedit'

Using host libthread_db library "/lib/tls/i686/cmov/libthread_db.so.1".
[Thread debugging using libthread_db enabled]
[New Thread -1225673040 (LWP 8233)]
0xffffe410 in __kernel_vsyscall ()

Thread 1 (Thread -1225673040 (LWP 8233))

  • #0 __kernel_vsyscall
  • #1 __waitpid_nocancel
    from /lib/tls/i686/cmov/libpthread.so.0
  • #2 libgnomeui_segv_handle
    at gnome-ui-init.c line 874
  • #3 <signal handler called>
  • #4 impl_getAttributeRun
    at text.c line 582
  • #5 _ORBIT_skel_small_Accessibility_Text_getAttributeRun
    at Accessibility-common.c line 760
  • #6 ORBit_POAObject_invoke
    at poa.c line 1142
  • #7 ORBit_OAObject_invoke
    at orbit-adaptor.c line 336
  • #8 ORBit_small_invoke_adaptor
    at orbit-small.c line 844
  • #9 ORBit_POAObject_handle_request
    at poa.c line 1351
  • #10 ORBit_POAObject_invoke_incoming_request
    at poa.c line 1421
  • #11 ORBit_POA_handle_request
    at poa.c line 1643
  • #12 ORBit_handle_request
    at orbit-adaptor.c line 296
  • #13 giop_connection_handle_input
    at giop-recv-buffer.c line 1308
  • #14 link_connection_io_handler
    at linc-connection.c line 1387
  • #15 link_source_dispatch
    at linc-source.c line 159
  • #16 IA__g_main_context_dispatch
    at gmain.c line 2045
  • #17 g_main_context_iterate
    at gmain.c line 2677
  • #18 IA__g_main_context_iteration
    at gmain.c line 2736
  • #19 link_main_iteration
    at linc.c line 288
  • #20 giop_recv_buffer_get
    at giop-recv-buffer.c line 738
  • #21 ORBit_small_invoke_stub
    at orbit-small.c line 658
  • #22 ORBit_small_invoke_stub_n
    at orbit-small.c line 575
  • #23 ORBit_c_stub_invoke
    at poa.c line 2643
  • #24 Accessibility_DeviceEventController_notifyListenersSync
    at Accessibility-stubs.c line 1913
  • #25 spi_atk_bridge_key_listener
    at bridge.c line 1026
  • #26 notify_hf
    at gailutil.c line 264
  • #27 g_hash_table_foreach_remove_or_steal
    at ghash.c line 605
  • #28 gail_key_snooper
    at gailutil.c line 286
  • #29 IA__gtk_main_do_event
    at gtkmain.c line 1727
  • #30 gdk_event_dispatch
    at gdkevents-x11.c line 2320
  • #31 IA__g_main_context_dispatch
    at gmain.c line 2045
  • #32 g_main_context_iterate
    at gmain.c line 2677
  • #33 IA__g_main_loop_run
    at gmain.c line 2881
  • #34 IA__gtk_main
    at gtkmain.c line 1024
  • #35 main
    at gedit.c line 574
  • #0 __kernel_vsyscall

Comment 14 bill.haneman 2007-01-02 20:21:46 UTC
Thanks Joanmarie!  That was enough to locate the problem.  I'll attach a patch.
Comment 15 bill.haneman 2007-01-02 20:23:33 UTC
If you want to fix before I post the patch (just dealing with the cvs->subversion migration changes now), substitute param 'j' for 'i' in text.c line 581.
Comment 16 bill.haneman 2007-01-02 20:27:45 UTC
Created attachment 79212 [details] [review]
patch to fix this bug (fix array index).
Comment 17 Joanmarie Diggs (IRC: joanie) 2007-01-02 21:35:08 UTC
Thanks Bill.

@ Rich and for the purpose of documentation:  With your script, I can still crash OOo Writer 2.0.4 on Edgy even with Bill's patch. But it doesn't crash Writer 2.1 (at least not today's developer snapshot).