2 files changed, 21 insertions, 12 deletions
diff --git a/src/plugins/platforms/windows/uiautomation/qwindowsuiamainprovider.cpp b/src/plugins/platforms/windows/uiautomation/qwindowsuiamainprovider.cpp
index 943c1ff368..b2b401dd40 100644
--- a/src/plugins/platforms/windows/uiautomation/qwindowsuiamainprovider.cpp
+++ b/src/plugins/platforms/windows/uiautomation/qwindowsuiamainprovider.cpp
@@ -670,18 +670,26 @@ HRESULT QWindowsUiaMainProvider::ElementProviderFromPoint(double x, double y, IR
     QPoint point;
     nativeUiaPointToPoint(uiaPoint, window, &point);
 
-    QAccessibleInterface *targetacc = accessible->childAt(point.x(), point.y());
-
-    if (targetacc) {
-        QAccessibleInterface *acc = targetacc;
-        // Controls can be embedded within grouping elements. By default returns the innermost control.
-        while (acc) {
-            targetacc = acc;
-            // For accessibility tools it may be better to return the text element instead of its subcomponents.
-            if (targetacc->textInterface()) break;
-            acc = acc->childAt(point.x(), point.y());
+    if (auto targetacc = accessible->childAt(point.x(), point.y())) {
+        auto acc = accessible->childAt(point.x(), point.y());
+        // Reject the cases where childAt() returns a different instance in each call for the same
+        // element (e.g., QAccessibleTree), as it causes an endless loop with Youdao Dictionary installed.
+        if (targetacc == acc) {
+            // Controls can be embedded within grouping elements. By default returns the innermost control.
+            while (acc) {
+                targetacc = acc;
+                // For accessibility tools it may be better to return the text element instead of its subcomponents.
+                if (targetacc->textInterface()) break;
+                acc = targetacc->childAt(point.x(), point.y());
+                if (acc != targetacc->childAt(point.x(), point.y())) {
+                    qCDebug(lcQpaUiAutomation) << "Non-unique childAt() for" << targetacc;
+                    break;
+                }
+            }
+            *pRetVal = providerForAccessible(targetacc);
+        } else {
+            qCDebug(lcQpaUiAutomation) << "Non-unique childAt() for" << accessible;
         }
-        *pRetVal = providerForAccessible(targetacc);
     }
     return S_OK;
 }
diff --git a/src/plugins/platforms/windows/uiautomation/qwindowsuiatextrangeprovider.cpp b/src/plugins/platforms/windows/uiautomation/qwindowsuiatextrangeprovider.cpp
index 8e395669f8..d8b8f7281d 100644
--- a/src/plugins/platforms/windows/uiautomation/qwindowsuiatextrangeprovider.cpp
+++ b/src/plugins/platforms/windows/uiautomation/qwindowsuiatextrangeprovider.cpp
@@ -48,6 +48,7 @@
 #include <QtGui/qaccessible.h>
 #include <QtCore/qloggingcategory.h>
 #include <QtCore/qstring.h>
+#include <QtCore/qvarlengtharray.h>
 
 QT_BEGIN_NAMESPACE
 
@@ -227,7 +228,7 @@ HRESULT QWindowsUiaTextRangeProvider::GetBoundingRectangles(SAFEARRAY **pRetVal)
         return UIA_E_ELEMENTNOTAVAILABLE;
 
     int len = textInterface->characterCount();
-    QList<QRect> rectList;
+    QVarLengthArray<QRect> rectList;
 
     if ((m_startOffset >= 0) && (m_endOffset <= len) && (m_startOffset < m_endOffset)) {
         int start, end;