Crash when Orca is running, e. g. root_register called too late
Can be reproduced with GTK 4.6.2 with gnome-control-center 42, but very likely with almost any more complex GTK 4 application, the specific versions are these where the reproduction succeeded. The a11y log just before the crash:
Gtk-Message: 16:01:52.864: handling GetRole on /org/gnome/Settings/a11y/db1a110a_6cdb_44f5_8e39_36a7c746dcd4
Gtk-Message: 16:01:52.870: handling GetProperty Name on /org/gnome/Settings/a11y/db1a110a_6cdb_44f5_8e39_36a7c746dcd4
Gtk-Message: 16:01:52.874: handling GetProperty Parent on /org/gnome/Settings/a11y/db1a110a_6cdb_44f5_8e39_36a7c746dcd4
(gnome-control-center:19095): GLib-CRITICAL **: 16:01:52.875: g_variant_is_object_path: assertion 'string != NULL' failed
Thread 1 "gnome-control-c" received signal SIGTRAP, Trace/breakpoint trap.
g_logv (log_domain=0x7ffff7cef00e "GLib", log_level=G_LOG_LEVEL_CRITICAL, format=<optimized out>, args=<optimized out>) at ../glib/gmessages.c:1417
1417 g_private_set (&g_log_depth, GUINT_TO_POINTER (depth));
The string which failed the null check is the root_path of the ATSPI root which is accessed in gtk_at_spi_root_to_ref which is called by get_parent_context_ref. It seems to me that root_register function is not called before this set of events because neither a breakpoint on it or the relevant log lines are printed.