Fix crash in tst_Spellchecking::spellcheck

The test tst_Spellchecking::spellcheck crashes when run with

    QT_LOGGING_RULES=qt.accessibility.cache.debug=true

which triggers debug output from

    QAccessible::registerAccessibleInterface and
    QAccessible::deleteAccessibleInterface

These functions are called during the construction/destruction of
BrowserAccessibilityQt. The problem is that BrowserAccessibilityQt is not
necessarily in a valid state at these times: BrowserAccessibilityQt relies on
it's manager to be *fully* initialized yet BrowserAccessibilityQt may be
constructed/destructed *during* the managers construction/destruction.

The solution is to override QAccessibleInterface::isValid to return true only if
the manager is in a valid state too. This disables the debug output and avoids
the crash.

Fixes: QTBUG-72878
Change-Id: Icffe4e503145133c24535fb094bbcb606568e57c
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
Reviewed-by: Peter Varga <pvarga@inf.u-szeged.hu>

3 files changed, 11 insertions, 1 deletions

diff --git a/src/core/browser_accessibility_manager_qt.cpp b/src/core/browser_accessibility_manager_qt.cpp
index 644a0a9f0..7fb1386c5 100644
--- a/src/core/browser_accessibility_manager_qt.cpp
+++ b/src/core/browser_accessibility_manager_qt.cpp
@@ -76,6 +76,12 @@ BrowserAccessibilityManagerQt::BrowserAccessibilityManagerQt(
       , m_parentObject(parentObject)
 {
     Initialize(initialTree);
+    m_valid = true; // BrowserAccessibilityQt can start using the AXTree
+}
+
+BrowserAccessibilityManagerQt::~BrowserAccessibilityManagerQt()
+{
+    m_valid = false; // BrowserAccessibilityQt should stop using the AXTree
 }
 
 QAccessibleInterface *BrowserAccessibilityManagerQt::rootParentAccessible()
diff --git a/src/core/browser_accessibility_manager_qt.h b/src/core/browser_accessibility_manager_qt.h
index a2d6db458..87c8875ba 100644
--- a/src/core/browser_accessibility_manager_qt.h
+++ b/src/core/browser_accessibility_manager_qt.h
@@ -57,14 +57,17 @@ public:
                                   const ui::AXTreeUpdate& initialTree,
                                   BrowserAccessibilityDelegate* delegate,
                                   BrowserAccessibilityFactory* factory = new BrowserAccessibilityFactory());
+    ~BrowserAccessibilityManagerQt() override;
     void FireBlinkEvent(ax::mojom::Event event_type,
                         BrowserAccessibility* node) override;
 
     QAccessibleInterface *rootParentAccessible();
+    bool isValid() const { return m_valid; }
 
 private:
     Q_DISABLE_COPY(BrowserAccessibilityManagerQt)
     QObject *m_parentObject;
+    bool m_valid = false;
 };
 
 }
diff --git a/src/core/browser_accessibility_qt.cpp b/src/core/browser_accessibility_qt.cpp
index a672ccc06..29fbbc542 100644
--- a/src/core/browser_accessibility_qt.cpp
+++ b/src/core/browser_accessibility_qt.cpp
@@ -68,7 +68,8 @@ BrowserAccessibilityQt::BrowserAccessibilityQt()
 
 bool BrowserAccessibilityQt::isValid() const
 {
-    return true;
+    auto managerQt = static_cast<BrowserAccessibilityManagerQt *>(manager_);
+    return managerQt && managerQt->isValid();
 }
 
 QObject *BrowserAccessibilityQt::object() const