a11y crash on deleting certain frame in certain document

I've an internal RH document which crashes in a11y when a paragraph with a
graphic and a drawing frame in it is deleted.

The SdrObject is removed and deleted, but when
SwAccessibleContext::DisposeChild is called the object does not pass IsShowing
so its not removed from the accessibility map. Leaving an entry in the map
pointing to a deleted SdrObject

So here take the route-one approach of always removing from the map
accessibility children which depend on a SdrObject which is getting deleted,
whether or not it is inside the visible area at the moment.

The real change here is to SwAccessibleContext::DisposeChild and to
SwFrame::RemoveDrawObj

Change-Id: I764cd54d6216d233756f52b5be66c80737b5e38d
Reviewed-on: https://gerrit.libreoffice.org/26824
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Michael Stahl <mstahl@redhat.com>

1 files changed, 4 insertions, 4 deletions

diff --git a/sw/source/core/access/acctable.cxx b/sw/source/core/access/acctable.cxx
index 8f2c4e3ea60e..8172657d0eff 100644
--- a/sw/source/core/access/acctable.cxx
+++ b/sw/source/core/access/acctable.cxx
@@ -1391,18 +1391,18 @@ void SwAccessibleTable::InvalidatePosOrSize( const SwRect& rOldBox )
     SwAccessibleContext::InvalidatePosOrSize( rOldBox );
 }
 
-void SwAccessibleTable::Dispose( bool bRecursive )
+void SwAccessibleTable::Dispose(bool bRecursive, bool bCanSkipInvisible)
 {
     SolarMutexGuard aGuard;
 
     if( GetRegisteredIn() )
         GetRegisteredInNonConst()->Remove( this );
 
-    SwAccessibleContext::Dispose( bRecursive );
+    SwAccessibleContext::Dispose(bRecursive, bCanSkipInvisible);
 }
 
 void SwAccessibleTable::DisposeChild( const SwAccessibleChild& rChildFrameOrObj,
-                                      bool bRecursive )
+                                      bool bRecursive, bool bCanSkipInvisible )
 {
     SolarMutexGuard aGuard;
 
@@ -1421,7 +1421,7 @@ void SwAccessibleTable::DisposeChild( const SwAccessibleChild& rChildFrameOrObj,
     // about its change. We then must not call the superclass
     uno::Reference< XAccessible > xAcc( GetMap()->GetContext( pFrame, false ) );
     if( !xAcc.is() )
-        SwAccessibleContext::DisposeChild( rChildFrameOrObj, bRecursive );
+        SwAccessibleContext::DisposeChild( rChildFrameOrObj, bRecursive, bCanSkipInvisible );
 }
 
 void SwAccessibleTable::InvalidateChildPosOrSize( const SwAccessibleChild& rChildFrameOrObj,