Office applications xp/2002/2003 crash i if nvda/b pressed in Win xp

[nvaccessAuto]

Reported by briang1 on 2010-04-06 10:03
In the stable release 2010 1, any attempt to use the nvda/b key to read any text of the application crashes nvda to the dwin screen. The Office application is unaffected.
Further, if the xp machine has kb971513 installed, this effect does not occur. (At least not here!)
nvda can be restarted, but of course it never properly terminated, so may be unstable.

This is true in snaps at least up to 10.
Applications tested. Word 2003 (by Burt) Powerpoint, access, Excel, Front page.
The latter Office Xp as I do not have the later version, but it seems likely this will be true of later version.
I understand Office 2007 is OK.
The log file is useless as the record ends with the keypress.

[nvaccessAuto]

Comment 2 by jteh on 2010-05-19 08:57
Technical details: firstChild on the MSO Generic Control Container toolbar (window class: MsoCommandBar) causes NVDA to crash. Attaching a debugger revealed that it seems to be crashing in some Python string function and the stack also showed something related to garbage collection. (I didn't think to copy the debugger output at the time; can do it again if needed.) Anyway, the stack didn't really give me any idea of why the crash is occurring, though it's almost certainly something to do with ctypes retrieving some string. accNavigate with NAVDIR_FIRSTCHILD returns nothing, so it must be using AccessibleChildren. Strangely enough, children[0] works without crashing. I can't work out what I'm missing here, but will investigate further.

[nvaccessAuto]

Comment 3 by jteh on 2010-05-19 11:01
Okay. It looks like calling !AccessibleChildren with anything less than childCount returns S_FALSE and gives back IDispatch pointers which crash Python somehow. According to MSDN, S_FALSE is only supposed to be returned if there are less returned items than requested, but this isn't the case anyway, so the implementation is already broken there.

As noted earlier, accNavigate with NAVDIR_FIRSTCHILD is broken, but NAVDIR_NEXT returns the first child.

I could waste time debugging why it crashes Python, but given all of this brokenness, I think it's better to just work around it given what I know now. I'll work on this soon.

[nvaccessAuto]

Comment 4 by jteh on 2010-05-20 04:34
Fixed in 77e0a2a. Thanks for filing the ticket.
Changes:
State: closed