[Libreoffice-commits] core.git: Branch 'libreoffice-5-4' - svx/source

[Caolán McNamara]

 svx/source/accessibility/AccessibleShape.cxx |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

New commits:
commit a2cd7c7a1015abe17b46cd40ae4bf5b3296d62e7
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Oct 18 11:05:20 2017 +0100

    Resolves: tdf#109282: a11y crash in use after dispose
    
    calc, chart in tab 3 with a11y enabled, select chart
    switch to tab 1, crash cause mpParent has been deleted, IsDisposed
    is correctly set, but shape accesses parent anyway
    
    Change-Id: I6f57a798bfcc82eebb883291cec54e157ff5187b
    Reviewed-on: https://gerrit.libreoffice.org/43490
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Tested-by: Michael Stahl <mstahl at redhat.com>

diff --git a/svx/source/accessibility/AccessibleShape.cxx b/svx/source/accessibility/AccessibleShape.cxx
index de059e9bb7fd..ffc2a6bc5f2e 100644
--- a/svx/source/accessibility/AccessibleShape.cxx
+++ b/svx/source/accessibility/AccessibleShape.cxx
@@ -408,7 +408,9 @@ uno::Reference<XAccessibleStateSet> SAL_CALL
     ::osl::MutexGuard aGuard (maMutex);
     Reference<XAccessibleStateSet> xStateSet;
 
-    if (IsDisposed())
+    bool bDisposed = IsDisposed();
+
+    if (bDisposed)
     {
         // Return a minimal state set that only contains the DEFUNC state.
         xStateSet = AccessibleContextBase::getAccessibleStateSet ();
@@ -459,7 +461,7 @@ uno::Reference<XAccessibleStateSet> SAL_CALL
             xStateSet.set( new ::utl::AccessibleStateSetHelper (*pStateSet));
         }
     }
-    if (mpParent && mpParent->IsDocumentSelAll())
+    if (!bDisposed && mpParent && mpParent->IsDocumentSelAll())
     {
         ::utl::AccessibleStateSetHelper* pStateSet =
             static_cast< ::utl::AccessibleStateSetHelper*>(xStateSet.get());