History

Michael Weghorn 206543c7be [API CHANGE] tdf#150683 a11y: Switch a11y child index to 64 bit With 16k column support in Calc enabled by default in commit `4c5f8ccf0a` Date: Tue Mar 8 12:44:49 2022 +0100 change default Calc number of columns to 16384 (tdf#50916) , the number of Calc cells in a spreadsheet is larger than SAL_MAX_INT32, meaning that a 32-bit a11y child index is no more enough and using it resulted in integer overflows in methods handling corresponding Calc cells in the a11y layer. This e.g. had the effect of the Orca and NVDA screen readers not announcing focused or selected cells properly when their a11y child index was out of the 32-bit integer range. Switch the internal a11y child indices to 64 bit to be able to handle this properly internally. Since the platform APIs (at least AT-SPI on Linux and IAccessible2 on Windows; from what I can see LO's macOS a11y bridge doesn't directly expose the child index) are still restricted to 32 bit, larger child indices still cannot be exposed via the platform APIs. As a consequence, use of the the IAccessible2 and AT-SPI methods that use the child index remains problematic in those cases where the child index is larger. However, as an alternative to using the AT-SPI Table interface and the IAccessibleTable/ IAccessibleTable2 interfaces with the child index to retrieve information about a specific cell, both AT-SPI and IAccessible2 also provide interfaces to retrieve that information directly from the cell object (TableCell interface for AT-SPI, IAccessibleTableCell for IAccessible2). Those interfaces are already implemented/exposed for winaccessibility (s. `CAccTable`) and the qt5/qt6/kf5 VCL plugins (s. the `QAccessibleTableCellInterface` methods implemented in `QtAccessibleInterface`). With the switch to 64-bit internal a11y child indices, these now behave correctly for cells with a child index that doesn't fit into 32 bit as well. NVDA on Windows already uses the IAccessibleTableCell interface and thus announcing focused cells works fine with this change in place. Orca on Linux currently doesn't make use of the AT-SPI TableCell interface yet, but with a suggested change to do so [1], announcement of selected cells works with the qt6 VCL plugin with a current qtbase dev branch as well - when combined with the suggested changes to implement support for the AT-SPI TableCell interface in Qt [2] [3] and the LO change based on that [4] and a fix for a nullptr dereference [5]. The gtk3 VCL plugin doesn't expose the AT-SPI TableCell interface yet, but once it does so (via `AtkTableCell`), it also works with the suggested Orca change [1] in place. (Adding that is planned for an upcoming change, works with a local WIP patch.) For handling return values that are larger than what platform APIs support, the following approach has been chosen for now: 1) When the return value is for the count of (selected) children, the maximum value N supported by the platform API is returned. (This is what `ScAccessibleTableBase::getAccessibleChildCount` did previously.) The first N elements can be accessed by their actual (selection) indices. 2) When the return value is the child/cell index, -2 is returned for objects whose index is greater than the maximum value supported by the platform API. Using a non-negative value would mean that the index would refer to another actually existing child. A child index of -1 on the other hand tends to be interpreted as "child is invalid" or "object isn't actually a child of its (previous) parent any more)". For the Orca case, this would result in objects with a child index of -1 not being announced, as they are considered "zombies" [6]. What's still somewhat problematic is the case where more than 2^31 children are selected, since access to those children still happens by the index into the selection in the platform APIs, and not all selected items are accessible this way. (Screen readers usually just retrieve the first and last element from the selection and announce those.) Orca already seems to apply different handling for the case for fully selected rows and columns, so "All cells selected" or "Columns ... to ... selected" is announced just fine even if more than 2^31 cells are selected. (Side note: While Microsoft User Interface Automation - UIA - also uses 32-bit indices, it also has specific methods in the ISelectionProvider2 interface that allow to explicitly retrieve the first and last selected item, `ISelectionProvider2::get_FirstSelectedItem` and `ISelectionProvider2::get_LastSelectedItem`, but we currently don't support UIA on Windows.) Bound checks at the beginning of the methods from the `XAccessibleContext`, `XAccessibleSelection` and `XAccessibleTable` interfaces that take a child index (or in helper methods called by those) should generally already prevent too large indices from being passed to the methods in the lower layer code that take smaller integer types. Such bound checking has been been added in various places where it wasn't present yet. If there any remaining issues of this kind that show after this commit, they can probably be solved in a similar way (s.e.g. the change to `AccessibleBrowseBox::getAccessibleChild` in this commit). A few asserts were also added at places where my understanding is that values shouldn't be larger than what is supported by a called method anyway. A test case will be added in a following change. [1] https://gitlab.gnome.org/GNOME/orca/-/merge_requests/131 [2] https://codereview.qt-project.org/c/qt/qtbase/+/428566 [3] https://codereview.qt-project.org/c/qt/qtbase/+/428567 [4] https://gerrit.libreoffice.org/c/core/+/138750 [5] https://codereview.qt-project.org/c/qt/qtbase/+/430157 [6] `82c8542002/src/orca/script_utilities.py (L5155)` Change-Id: I3af590c988b0e6754fc72545918412f39e8fea07 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139258 Tested-by: Jenkins Reviewed-by: Michael Weghorn <m.weghorn@posteo.de>		2022-09-02 15:47:37 +02:00
..
inc
source	[API CHANGE] tdf#150683 a11y: Switch a11y child index to 64 bit	2022-09-02 15:47:37 +02:00
CustomTarget_ia2_idl.mk
Library_uacccom.mk
Library_winaccessibility.mk
Makefile
Module_winaccessibility.mk
README.md
WinResTarget_uacccom.mk

README.md

Windows Accessibility Bridge

This code provides a bridge between our internal Accessibility interfaces (implemented on all visible 'things' in the suite: eg. windows, buttons, entry boxes etc.) - and the Windows MSAA / IAccessible2 COM interfaces that are familiar to windows users and Accessible Technologies (ATs) such as the NVDA screen reader.

The code breaks into three bits:

source/service/
- the UNO service providing the accessibility bridge. It essentially listens to events from the LibreOffice core and creates and synchronises COM peers for our internal accessibility objects when events arrive.
source/UAccCom/
- COM implementations of the MSAA / IAccessible2 interfaces to provide native peers for the accessibility code.
source/UAccCOMIDL/
- COM Interface Definition Language (IDL) for UAccCom.

Here is one way of visualising the code / control flow

VCL <-> UNO toolkit <-> UNO a11y <-> win a11y <-> COM / IAccessible2

vcl/ <-> toolkit/ <-> accessibility/ <-> winaccessibility/ <-> UAccCom/

Threading

It's possible that the UNO components are called from threads other than the main thread, so they have to be synchronized. It would be nice to put the component into a UNO apartment (and the COM components into STA) but UNO would spawn a new thread for it so it's not possible. The COM components also call into the same global AccObjectWinManager as the UNO components do so both have to be synchronized in the same way.

So we use the SolarMutex for all synchronization since anything else would be rather difficult to make work. Unfortunately there is a pre-existing problem in vcl with Win32 Window creation and destruction on non-main threads where a synchronous SendMessage is used while the SolarMutex is locked that can cause deadlocks if the main thread is waiting on the SolarMutex itself at that time and thus not handing the Win32 message; this is easy to trigger with JunitTests but hopefully not by actual end users.

Debugging / Playing with winaccessibility

If NVDA is running when soffice starts, IA2 should be automatically enabled and work as expected. In order to use 'accprobe' to debug it is necessary to override the check for whether an AT (like NVDA) is running; to do that use:

SAL_FORCE_IACCESSIBLE2=1 soffice.exe -writer

Then you can use accprobe to introspect the accessibility hierarchy remotely, checkout:

http://accessibility.linuxfoundation.org/a11yweb/util/accprobe/

But often it's more useful to look at NVDA's text output window.