Repository: nvaccess/nvda

Issue:
Windows Explorer crashes by going to the save-button  of metadata
**Reported by The_Dark_Man on 2015-09-09 15:08**
When I am in the Windows Explorer on a file with metadata and push the tab key I go through the Metadata Interpret, genre and so on. After this, there is “save” and “cancel”. When I tab on “save”, the windows explorer crashes. It’s closed. This bug is in NVDA 2015.3 new. I think, this isn’t correct. I had this problem with a mp3-file, for example. I use Windows 7 Professional. I tried it with NVDA 2015.2 ant there was no problem.



Discussion:
Comment 1 by bdorer on 2015-09-15 20:45
He is using list view and has the explorer sidebar enabled. I don't know wheather @jteh had any other questions. Is anyone able to reproduce this? I'm not able to reproduce with win10.
Sidenote: the crash occours with other files such as excel tables and goes away sometimes if you maximize the window.

I am not able to replicate this using Windows 10 either. Is anyone able to test using Windows 8.1 or Windows 7?

I am at a loss to quite understand what is being described here. is it that 
special folders carry this tab, as here in Windows 7, I have a folder full 
of mp3s and all sorts, and apart from properties I cannot see any other 
metadata viewing option.

In 7 Explorer will occasionally crash in any case. Its a well known issue 
with 7 generally.
 Brian

bglists@blueyonder.co.uk
Sent via blueyonder.
Please address personal email to:-
briang1@blueyonder.co.uk, putting 'Brian Gaff'
in the display name field. 


@Brian1Gaff is this still reproducible with NVDA 2018.4 RC1?
@The_Dark_Man
Ok the author is not available anymore and we didn't hear for a very long time any updates. I didn't see this issue ever and it seems we cannto reproduce it. Closing.
I am able to reproduce it on Windows 7 Pro x64 with latest NVDA Alpha snapshot. @Adriani90 Can you reopen please?
I am attaching log from the crash, and the dump generated from crashed explorer. Note that when the crash occurred NVDA freezes for about 5 minutes.
[issue_5337.zip](https://github.com/nvaccess/nvda/files/2824416/issue_5337.zip)

It looks like it is enough to tab to any metadata field and then try shift+tabbing back to cause this crash to happen. I understand that Windows 7 isn't the latest and greatest, but this is very serious, entire system is not responsive for about 5 minutes after this. @michaelDCurran @feerrenrut Any chance for fixing this? I've attached dump above, but if any additional info would be needed just let me know.
Looks like  Windows is prematurely freeing the memory of a richEdit document object before the COM subsystem tries to. That is most definitely a bad programming error on the Windows side. I doubt there is anything we can do on the NVDA side a part from some how black listing that control making it completely inaccessible. Even that may not be enough as it is possible that the UI Automation core library is the one accessing that control, not necessarily NvDA directly. This seems to be the most likely as no changes were directly made to our richEdit support between 2015.2 and 2015.3, however many UIA changes were made.
I've tested with UIA disabled and Windows Explorer still crashed not as severe though, NVDA freezes only for about a minute as opposed to 5.
I've bisected this and this crash was introduced by 89dd4b75289ce8938682d91d7347f1686db284d0

Resolving patch:
diff --git a/source/appModules/explorer.py b/source/appModules/explorer.py
--- a/source/appModules/explorer.py
+++ b/source/appModules/explorer.py
@@ -14,6 +14,7 @@
 import appModuleHandler
 import controlTypes
 import winUser
+import winVersion
 import api
 import speech
 import eventHandler
@@ -21,6 +22,7 @@
 from NVDAObjects.window import Window
 from NVDAObjects.IAccessible import sysListView32, IAccessible, List
 from NVDAObjects.UIA import UIA
+from NVDAObjects.window.edit import RichEdit50, EditTextInfo
 
 # Suppress incorrect Win 10 Task switching window focus
 class MultitaskingViewFrameWindow(UIA):
@@ -189,6 +191,19 @@ def _get_windowText(self):
 			return windowText.replace(CHAR_LTR_MARK,'').replace(CHAR_RTL_MARK,'')
 		return windowText
 
+
+class MetadataEditField(RichEdit50):
+	""" Used for metadata edit fields in Windows Explorer in Windows 7.
+	By default these fields would use ITextDocumentTextInfo ,
+	but to avoid Windows Explorer crashes we need to use EditTextInfo here. """
+	@classmethod
+	def _get_TextInfo(cls):
+		if ((winVersion.winVersion.major, winVersion.winVersion.minor) == (6, 1)):
+			cls.TextInfo = EditTextInfo
+		else:
+			cls.TextInfo = super(MetadataEditField, cls).TextInfo
+		return cls.TextInfo
+
 class AppModule(appModuleHandler.AppModule):
 
 	def chooseNVDAObjectOverlayClasses(self, obj, clsList):
@@ -235,6 +250,10 @@ def chooseNVDAObjectOverlayClasses(self, obj, clsList):
 			clsList.insert(0, StartButton)
 			return # Optimization: return early to avoid comparing class names and roles that will never match.
 
+		if windowClass == 'RICHEDIT50W' and obj.windowControlID == 256:
+			clsList.insert(0, MetadataEditField)
+			return  # Optimization: return early to avoid comparing class names and roles that will never match.
+
 		if isinstance(obj, UIA):
 			uiaClassName = obj.UIAElement.cachedClassName
 			if uiaClassName == "GridTileElement":


Test patch: