vcl/source/treelist/svtabbx.cxx |    6 ++++++
 1 file changed, 6 insertions(+)

New commits:
commit 978cce0001ef9f37fb5fa5037a876f31ec558166
Author:     Michael Weghorn <m.wegh...@posteo.de>
AuthorDate: Tue Aug 29 18:41:32 2023 +0200
Commit:     Michael Weghorn <m.wegh...@posteo.de>
CommitDate: Wed Aug 30 11:56:47 2023 +0200

    tdf#156683 a11y: Dispose a11y cells with tab list box header
    
    When disposing the `SvHeaderTabListBox`, also dispose
    the a11y objects for its header cells and clear
    the vector.
    
    This fixes a crash on exit that could e.g. be triggered
    as follows when using the qt6 VCL plugin on Linux:
    
    1) start accerciser
    2) start Writer with qt6 VCL plugin
    3) press Alt+F12 to open the options dialog
    4) enable "LibreOfficeDev" -> "Advanced" (i.e. Java Options dialog)
    5) in Accerciser, click through LO a11y hierarchy, in particular on all of 
the cells of the JRE table
    6) close the dialog and LO
    
    Backtrace:
    
        ~"#0  __pthread_kill_implementation (threadid=<optimized out>, 
signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44\n"
        >~"#1  0x00007f0f296a815f in __pthread_kill_internal (signo=6, 
threadid=<optimized out>) at ./nptl/pthread_kill.c:78\n"
        >~"#2  0x00007f0f2965a472 in __GI_raise (sig=sig@entry=6) at 
../sysdeps/posix/raise.c:26\n"
        >~"#3  0x00007f0f296444b2 in __GI_abort () at ./stdlib/abort.c:79\n"
        >~"#4  0x00007f0f296443d5 in __assert_fail_base (fmt=0x7f0f297b8dc8 
\"%s%s%s:%u: %s%sAssertion `%s' failed.\\n%n\", 
assertion=assertion@entry=0x7f0f28b376a0 \"rClients.end() != rPos && 
\\\"AccessibleEventNotifier::implLookupClient: invalid client id \\\" \\\"(did 
you register your client?)!\\\"\", file=file@entry=0x7f0f28b37478 
\".../comphelper/source/misc/accessibleeventnotifier.cxx\", 
line=line@entry=140, function=function@entry=0x7f0f28b375b0 \"bool 
{anonymous}::implLookupClient(comphelper::AccessibleEventNotifier::TClientId, 
std::__debug::unordered_map<unsigned int, 
comphelper::OInterfaceContainerHelper4<com::sun::star::accessibility::XAccessibleEventListener>
 >::iterator&)\") at ./assert/assert.c:92\n"
        >~"#5  0x00007f0f296533a2 in __assert_fail (assertion=0x7f0f28b376a0 
\"rClients.end() != rPos && \\\"AccessibleEventNotifier::implLookupClient: 
invalid client id \\\" \\\"(did you register your client?)!\\\"\", 
file=0x7f0f28b37478 \".../comphelper/source/misc/accessibleeventnotifier.cxx\", 
line=140, function=0x7f0f28b375b0 \"bool 
{anonymous}::implLookupClient(comphelper::AccessibleEventNotifier::TClientId, 
std::__debug::unordered_map<unsigned int, 
comphelper::OInterfaceContainerHelper4<com::sun::star::accessibility::XAccessibleEventListener>
 >::iterator&)\") at ./assert/assert.c:101\n"
        >~"#6  0x00007f0f28913886 in (anonymous 
namespace)::implLookupClient(comphelper::AccessibleEventNotifier::TClientId, 
std::__debug::unordered_map<unsigned int, 
comphelper::OInterfaceContainerHelper4<com::sun::star::accessibility::XAccessibleEventListener>,
 std::hash<unsigned int>, std::equal_to<unsigned int>, 
std::allocator<std::pair<unsigned int const, 
comphelper::OInterfaceContainerHelper4<com::sun::star::accessibility::XAccessibleEventListener>
 > > >::iterator&) (nClient=218, rPos=...) at 
.../comphelper/source/misc/accessibleeventnotifier.cxx:140\n"
    
        >~"#7  0x00007f0f28913b9a in 
comphelper::AccessibleEventNotifier::revokeClientNotifyDisposing(unsigned int, 
com::sun::star::uno::Reference<com::sun::star::uno::XInterface> const&) 
(_nClient=218, _rxEventSource=uno::Reference to 
(accessibility::AccessibleBrowseBoxHeaderCell *) 0x55fb25c8b3d0) at 
.../comphelper/source/misc/accessibleeventnotifier.cxx:185\n"
        >~"#8  0x00007f0eef073244 in 
accessibility::AccessibleBrowseBoxBase::disposing() (this=0x55fb25c8b3d0) at 
.../accessibility/source/extended/AccessibleBrowseBoxBase.cxx:113\n"
        >~"#9  0x00007f0f28474aeb in 
cppu::WeakComponentImplHelperBase::dispose() (this=0x55fb25c8b3d0) at 
.../cppuhelper/source/implbase.cxx:104\n"
        >~"#10 0x00007f0eef0712c2 in 
cppu::PartialWeakComponentImplHelper<com::sun::star::accessibility::XAccessibleContext,
 com::sun::star::accessibility::XAccessibleComponent, 
com::sun::star::accessibility::XAccessibleEventBroadcaster, 
com::sun::star::awt::XFocusListener, 
com::sun::star::lang::XServiceInfo>::dispose() (this=0x55fb25c8b3d0) at 
.../include/cppuhelper/compbase.hxx:90\n"
        >~"#11 0x00007f0f28474834 in 
cppu::WeakComponentImplHelperBase::release() (this=0x55fb25c8b3d0) at 
.../cppuhelper/source/implbase.cxx:79\n"
        >~"#12 0x00007f0eef072124 in 
cppu::PartialWeakComponentImplHelper<com::sun::star::accessibility::XAccessibleContext,
 com::sun::star::accessibility::XAccessibleComponent, 
com::sun::star::accessibility::XAccessibleEventBroadcaster, 
com::sun::star::awt::XFocusListener, 
com::sun::star::lang::XServiceInfo>::release() (this=0x55fb25c8b3d0) at 
.../include/cppuhelper/compbase.hxx:86\n"
        >~"#13 0x00007f0eef07544a in 
accessibility::BrowseBoxAccessibleElement::release() (this=0x55fb25c8b3d0) at 
.../accessibility/source/extended/AccessibleBrowseBoxBase.cxx:518\n"
        >~"#14 0x00007f0f15842747 in 
com::sun::star::uno::Reference<com::sun::star::accessibility::XAccessible>::~Reference()
 (this=0x7f0f0c0246e0, __in_chrg=<optimized out>) at 
.../include/com/sun/star/uno/Reference.hxx:114\n"
    
        >~"#15 0x00007f0f15862b9f in QtAccessibleWidget::~QtAccessibleWidget() 
(this=0x7f0f0c0246a0, __in_chrg=<optimized out>) at 
.../vcl/inc/qt6/../qt5/QtAccessibleWidget.hxx:39\n"
        >~"#16 0x00007f0f15862c76 in QtAccessibleWidget::~QtAccessibleWidget() 
(this=0x7f0f0c0246a0, __in_chrg=<optimized out>) at 
.../vcl/inc/qt6/../qt5/QtAccessibleWidget.hxx:39\n"
        >~"#17 0x00007f0f146ca101 in QAccessibleCache::deleteInterface(unsigned 
int, QObject*) (this=0x55fb1ef073e0, id=2147483876, obj=0x55fb25c8abf0) at 
/home/michi/development/git/qt5/qtbase/src/gui/accessible/qaccessiblecache.cpp:173\n"
        >~"#18 0x00007f0f146c9712 in QAccessibleCache::~QAccessibleCache() 
(this=0x55fb1ef073e0, __in_chrg=<optimized out>) at 
/home/michi/development/git/qt5/qtbase/src/gui/accessible/qaccessiblecache.cpp:31\n"
        >~"#19 0x00007f0f146c9798 in QAccessibleCache::~QAccessibleCache() 
(this=0x55fb1ef073e0, __in_chrg=<optimized out>) at 
/home/michi/development/git/qt5/qtbase/src/gui/accessible/qaccessiblecache.cpp:32\n"
        >~"#20 0x00007f0f146c967e in cleanupAccessibleCache() () at 
/home/michi/development/git/qt5/qtbase/src/gui/accessible/qaccessiblecache.cpp:24\n"
        >~"#21 0x00007f0f14fa22f7 in qt_call_post_routines() () at 
/home/michi/development/git/qt5/qtbase/src/corelib/kernel/qcoreapplication.cpp:325\n"
    
        >~"#22 0x00007f0f13599da0 in QApplication::~QApplication() 
(this=0x55fb1dfd77b0, __in_chrg=<optimized out>) at 
/home/michi/development/git/qt5/qtbase/src/widgets/kernel/qapplication.cpp:663\n"
        >~"#23 0x00007f0f1359a09e in QApplication::~QApplication() 
(this=0x55fb1dfd77b0, __in_chrg=<optimized out>) at 
/home/michi/development/git/qt5/qtbase/src/widgets/kernel/qapplication.cpp:717\n"
        >~"#24 0x00007f0f158ce2c4 in 
std::default_delete<QApplication>::operator()(QApplication*) const 
(this=0x55fb1e07b220, __ptr=0x55fb1dfd77b0) at 
/usr/include/c++/13/bits/unique_ptr.h:99\n"
        >~"#25 0x00007f0f158ce70c in std::__uniq_ptr_impl<QApplication, 
std::default_delete<QApplication> >::reset(QApplication*) (this=0x55fb1e07b220, 
__p=0x0) at /usr/include/c++/13/bits/unique_ptr.h:211\n"
        >~"#26 0x00007f0f158cc643 in std::unique_ptr<QApplication, 
std::default_delete<QApplication> >::reset(QApplication*) (this=0x55fb1e07b220, 
__p=0x0) at /usr/include/c++/13/bits/unique_ptr.h:509\n"
    
        >~"#27 0x00007f0f158c506b in QtInstance::~QtInstance() 
(this=0x55fb1e07b090, __in_chrg=<optimized out>) at 
.../vcl/qt6/../qt5/QtInstance.cxx:273\n"
        >~"#28 0x00007f0f158c5142 in QtInstance::~QtInstance() 
(this=0x55fb1e07b090, __in_chrg=<optimized out>) at 
.../vcl/qt6/../qt5/QtInstance.cxx:274\n"
    
        >~"#29 0x00007f0f202615d9 in DestroySalInstance(SalInstance*) 
(pInst=0x55fb1e07b0a0) at .../vcl/source/app/salplug.cxx:389\n"
        >~"#30 0x00007f0f203401ee in DeInitVCL() () at 
.../vcl/source/app/svmain.cxx:600\n"
        >~"#31 0x00007f0f2033e9bf in ImplSVMain() () at 
.../vcl/source/app/svmain.cxx:229\n"
        >~"#32 0x00007f0f2033ea1b in SVMain() () at 
.../vcl/source/app/svmain.cxx:236\n"
        >~"#33 0x00007f0f2989f6ed in soffice_main() () at 
.../desktop/source/app/sofficemain.cxx:94\n"
        >~"#34 0x000055fb1c8769d4 in sal_main () at 
.../desktop/source/app/main.c:51\n"
        >~"#35 0x000055fb1c8769ba in main (argc=3, argv=0x7fffd6677498) at 
.../desktop/source/app/main.c:49\n"
    
    Change-Id: Ic5ba4f75cbeac3955417ca54c189b262289bfc79
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/156259
    Tested-by: Jenkins
    Reviewed-by: Michael Weghorn <m.wegh...@posteo.de>

diff --git a/vcl/source/treelist/svtabbx.cxx b/vcl/source/treelist/svtabbx.cxx
index ca668d45ddb0..0c3a179f0adf 100644
--- a/vcl/source/treelist/svtabbx.cxx
+++ b/vcl/source/treelist/svtabbx.cxx
@@ -17,6 +17,7 @@
  *   the License at http://www.apache.org/licenses/LICENSE-2.0 .
  */
 
+#include <comphelper/types.hxx>
 #include <vcl/svtaccessiblefactory.hxx>
 #include <vcl/accessiblefactory.hxx>
 #include <vcl/toolkit/svtabbx.hxx>
@@ -24,6 +25,7 @@
 #include <vcl/toolkit/svlbitm.hxx>
 #include <vcl/toolkit/treelistentry.hxx>
 #include <com/sun/star/accessibility/AccessibleStateType.hpp>
+#include <com/sun/star/accessibility/XAccessible.hpp>
 #include <rtl/ustrbuf.hxx>
 #include <sal/log.hxx>
 #include <o3tl/safeint.hxx>
@@ -497,6 +499,10 @@ SvHeaderTabListBox::~SvHeaderTabListBox()
 
 void SvHeaderTabListBox::dispose()
 {
+    for (css::uno::Reference<css::accessibility::XAccessible>& rxChild : 
m_aAccessibleChildren)
+        comphelper::disposeComponent(rxChild);
+    m_aAccessibleChildren.clear();
+
     m_pImpl.reset();
     SvTabListBox::dispose();
 }

Reply via email to