Crash on copying selected message text — NSRangeException in accessibility focus path (12.9, macOS 26.6.1) #1441

Summary

Telegram for macOS crashes when text selection in a message changes the first responder — reproducibly on selecting text in a chat message and copying it, by keyboard shortcut or by context menu.

Crashed 7 times in ~9 hours on one machine, every time with an identical uncaught NSRangeException.

Version: 12.9 (282555), ru.keepcoder.Telegram
macOS: 26.6.1 (25G76), Apple silicon
Exception: EXC_BREAKPOINT (SIGTRAP) from NSApplicationUncaughtExceptionHandler

The exception

*** -[__NSArrayM objectAtIndex:]: index 0 beyond bounds for empty array
NSRangeException

Where it comes from

It is not thrown on the copy itself. It is thrown from AppKit's accessibility path, which runs when the first responder changes — and selecting text in a message changes it:

-[NSWindow _realMakeFirstResponder:]
  NSAccessibilityHandleFocusChangedForce
    -[NSView _accessibilityUIElementSpecifier]
      _NSAccessibilityEntryPointValueForAttribute
        -[NSView(NSViewAccessibility) accessibilityParentAttribute]
          +[NSTableViewCellMockElement cellForRow:column:tableView:]
            -[NSTableViewCellMockElement initWithRow:column:tableView:]
              → objectAtIndex: on an empty array   ← throws here

NSTableViewCellMockElement is built for a row/column that no longer exists, so the lookup indexes an empty backing array. The likely shape of the bug: the message list NSTableView is asked for accessibility information about a row while its data source is empty or mid-update.

Because the throw happens inside an AppKit callback, nothing catches it and NSApplicationUncaughtExceptionHandler terminates the process.

Steps to reproduce

1. Open any chat with messages.
2. Select part of a message's text (click-drag, or double-click a word).
3. Copy it — ⌘C, or right-click → Copy.
4. The app dies. No error dialog, just termination.

Reproduces with the mouse and with the keyboard, so it is the selection/focus change rather than the copy command.

Notes

• All 7 crash reports on this machine carry the same composed_message and the same accessibility frames — this is one bug, not a family.
• macOS 26 changed accessibility internals; the reporter has no older macOS to compare against, so whether 12.9 crashed the same way on macOS 15 is unverified.
• No VoiceOver in use. The accessibility path runs regardless, which is why an ordinary user hits it.

What would help

Guarding the row/column lookup in the accessibility parent path when the table's data source is empty would stop the throw; the underlying question is why accessibility is asked about a row that is not there during a focus change.

Crash reports (.ips) available on request — they contain user identifiers, so they are not pasted here.