Repository: nvaccess/nvda

Issue:
Explorer.exe crashes in Windows 7 when start menu accessed with the mouse.
<!--
Please thoroughly read NVDA's wiki article on how to fill in this template, including how to provide the required files.
Issues may be closed if the required information is not present.
https://github.com/nvaccess/nvda/wiki/Github-issue-template-explanation-and-examples
-->

### Steps to reproduce:

On Windows 7:
1. Click on the Start button to open the start menu.
2. Move the mouse over a couple of the items in the start menu as if to select something.

### Actual behavior:

Explorer.exe stopped responding, and was restarted by Windows.
Intiailly I used SAPI 5 voice, and the log contained:
"DEBUGWARNING - eventHandler.executeEvent (11:39:07.355):
error executing event: mouseMove on <NVDAObjects.Dynamic_EditableTextWithoutAutoSelectDetectionUIA object at 0x052C8AF0> with extra args of {'y': 991, 'x': 337}
Traceback (most recent call last):
  File "eventHandler.pyo", line 155, in executeEvent
  File "eventHandler.pyo", line 92, in __init__
  File "eventHandler.pyo", line 100, in next
  File "NVDAObjects\__init__.pyo", line 928, in event_mouseMove
  File "documentBase.pyo", line 24, in makeTextInfo
  File "NVDAObjects\UIA\__init__.pyo", line 314, in __init__
COMError: (-2147220991, 'An event was unable to invoke any of the subscribers', (None, None, None, 0, None))"

Full log: [Win7Explorerlog.txt](https://github.com/nvaccess/nvda/files/3031994/Win7Explorerlog.txt)

I then restarted the computer, changed the synth to eSpeak and repeated with the same result.  It took about 10 or 15 seconds to crash this time and in the meantime reported each menu item as the mouse moved over it. After reading the last menu item before crashing, the log reads:

DEBUGWARNING - watchdog._watcher (12:53:44.414):
Trying to recover from freeze, core stack:
  File "nvda.pyw", line 233, in <module>
  File "core.pyo", line 519, in main
  File "wx\core.pyo", line 2134, in MainLoop
  File "gui\__init__.pyo", line 1003, in Notify
  File "core.pyo", line 491, in run
  File "mouseHandler.pyo", line 257, in pumpAll
  File "mouseHandler.pyo", line 223, in executeMouseMoveEvent
  File "eventHandler.pyo", line 155, in executeEvent
  File "eventHandler.pyo", line 92, in __init__
  File "eventHandler.pyo", line 100, in next
  File "NVDAObjects\__init__.pyo", line 928, in event_mouseMove
  File "documentBase.pyo", line 24, in makeTextInfo
  File "NVDAObjects\UIA\__init__.pyo", line 314, in __init__

DEBUGWARNING - eventHandler.executeEvent (12:53:44.584):
error executing event: mouseMove on <NVDAObjects.Dynamic_EditableTextWithoutAutoSelectDetectionUIA object at 0x050C2C30> with extra args of {'y': 988, 'x': 139}
Traceback (most recent call last):
  File "eventHandler.pyo", line 155, in executeEvent
  File "eventHandler.pyo", line 92, in __init__
  File "eventHandler.pyo", line 100, in next
  File "NVDAObjects\__init__.pyo", line 928, in event_mouseMove
  File "documentBase.pyo", line 24, in makeTextInfo
  File "NVDAObjects\UIA\__init__.pyo", line 314, in __init__
COMError: (-2147220991, 'An event was unable to invoke any of the subscribers', (None, None, None, 0, None))

This has been reported by several users with several other scenarios (all involving explorer), but using the mouse in the start menu seems a consistent way to trigger it.

### Expected behavior:
Explorer shouldn't crash.

### System configuration
#### NVDA installed/portable/running from source:
#### NVDA version:

NVDA 2019.1 installed 

#### Windows version:

Windows 7 Home Premium, version 6.1, build 7601, service pack 1.

#### Name and version of other software in use when reproducing the issue:

#### Other information about your system:

### Other questions
#### Does the issue still occur after restarting your PC?

Yes.

#### Have you tried any other versions of NVDA?
Previous versions of NVDA (2018.4.1) do not produce a crash, and repeating without NVDA running there is no crash.



Discussion:
I also meant to add, accessing the Start menu with the keyboard works fine.
Does this issue also occur if mouse tracking (NVDA+M) is disabled?
It does but there is something odd from time to time when reviewing 
characters ie actual spelling using the review modes that can end in the 
explorer has stopped working issue as well. Often I've seen strange things 
going on in older copies of Word resulting in the machine needing a reboot. 
Hard to get a log in such situations I find. Its only worse in the latest 
version of nvda.
 I do not use the mouse so I suspect that its not actually the mouse as 
such, more likely its easier to fit the criteria using it.
Its not a mega problem but it has happened  afew times since I put it on. I 
would need to do more testing to find out if the log is similar though.

These sort of effects are very hard to  get to happen to order.
 Brian

bglists@blueyonder.co.uk
Sent via blueyonder.
Please address personal E-mail to:-
briang1@blueyonder.co.uk, putting 'Brian Gaff'
in the display name field.
----- Original Message ----- 
From: "Quentin Christensen" <notifications@github.com>
To: "nvaccess/nvda" <nvda@noreply.github.com>
Cc: "Subscribed" <subscribed@noreply.github.com>
Sent: Tuesday, April 02, 2019 3:16 AM
Subject: Re: [nvaccess/nvda] Explorer.exe crashes in Windows 7 when start 
menu accessed with the mouse. (#9435)


>I also meant to add, accessing the Start menu with the keyboard works fine.
>
> -- 
> You are receiving this because you are subscribed to this thread.
> Reply to this email directly or view it on GitHub:
> https://github.com/nvaccess/nvda/issues/9435#issuecomment-478816679 


With mouse tracking disabled, the crash doesn't happen.

Brian, re crashes which require a reboot - in the %temp% folder, where the nvda.log is kept, there is usually an nvda-old.log which is the log from the previous time NVDA was run.  If you look for that file when you restart the computer, it should have just about everything NVDA recorded about what it was doing.  Also re the problems with issues which can be hard to reproduce, that was why I was specific in how to repro this one.  This one definitely seems to be triggered by the mouse.
cc: @nishimotz, @leonardder 
Ah, looks like i"m the author of this crash, see https://github.com/nvaccess/nvda/pull/8572.

Disabling mouse tracking seems to be an acceptable work around for now, but I"ll provide a fix anyway.
I don't know if it has the same underlying cause, but for me even with mouse tracking disabled it is sufficient to route mouse to start menu search field in Windows 7 to cause explorer to crash. When it crashes it takes NVDA with it, so the only way to go back to the working condition is to kill explorer.exe from another account.

Resolving patch:
diff --git a/source/NVDAObjects/UIA/__init__.py b/source/NVDAObjects/UIA/__init__.py
--- a/source/NVDAObjects/UIA/__init__.py
+++ b/source/NVDAObjects/UIA/__init__.py
@@ -33,6 +33,7 @@
 import braille
 import locationHelper
 import ui
+import winVersion
 
 class UIATextInfo(textInfos.TextInfo):
 
@@ -312,7 +313,9 @@ def __init__(self,obj,position,_rangeObj=None):
 			# sometimes rangeFromChild can return a NULL range
 			if not self._rangeObj: raise LookupError
 		elif isinstance(position,locationHelper.Point):
-			#rangeFromPoint used to cause a freeze in UIA client library!
+			if (winVersion.winVersion.major, winVersion.winVersion.minor) == (6, 1):
+				# #9435: RangeFromPoint causes a freeze in UIA client library in the Windows 7 start menu!
+				raise NotImplementedError("RangeFromPoint not supported on Windows 7")
 			self._rangeObj=self.obj.UIATextPattern.RangeFromPoint(position.toPOINT())
 		elif isinstance(position,UIAHandler.IUIAutomationTextRange):
 			self._rangeObj=position.clone()


Test patch: