[Libreoffice-commits] core.git: svx/source

[Caolán McNamara]

 svx/source/accessibility/AccessibleShape.cxx |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

New commits:
commit aa3c054fe5d7b082532f1108f30a54bc4cdeb64c
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Oct 18 11:05:20 2017 +0100

    Resolves: tdf#109282: a11y crash in use after dispose
    
    calc, chart in tab 3 with a11y enabled, select chart
    switch to tab 1, crash cause mpParent has been deleted, IsDisposed
    is correctly set, but shape accesses parent anyway
    
    Change-Id: I6f57a798bfcc82eebb883291cec54e157ff5187b
    Reviewed-on: https://gerrit.libreoffice.org/43487
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/svx/source/accessibility/AccessibleShape.cxx b/svx/source/accessibility/AccessibleShape.cxx
index 4dc9ab0b6987..b2ff186ae7cb 100644
--- a/svx/source/accessibility/AccessibleShape.cxx
+++ b/svx/source/accessibility/AccessibleShape.cxx
@@ -407,7 +407,9 @@ uno::Reference<XAccessibleStateSet> SAL_CALL
     ::osl::MutexGuard aGuard (maMutex);
     Reference<XAccessibleStateSet> xStateSet;
 
-    if (IsDisposed())
+    bool bDisposed = IsDisposed();
+
+    if (bDisposed)
     {
         // Return a minimal state set that only contains the DEFUNC state.
         xStateSet = AccessibleContextBase::getAccessibleStateSet ();
@@ -458,7 +460,7 @@ uno::Reference<XAccessibleStateSet> SAL_CALL
             xStateSet.set( new ::utl::AccessibleStateSetHelper (*pStateSet));
         }
     }
-    if (mpParent && mpParent->IsDocumentSelAll())
+    if (!bDisposed && mpParent && mpParent->IsDocumentSelAll())
     {
         ::utl::AccessibleStateSetHelper* pStateSet =
             static_cast< ::utl::AccessibleStateSetHelper*>(xStateSet.get());