tdf#156683 a11y: Dispose a11y cells with tab list box header

When disposing the `SvHeaderTabListBox`, also dispose
the a11y objects for its header cells and clear
the vector.

This fixes a crash on exit that could e.g. be triggered
as follows when using the qt6 VCL plugin on Linux:

1) start accerciser
2) start Writer with qt6 VCL plugin
3) press Alt+F12 to open the options dialog
4) enable "LibreOfficeDev" -> "Advanced" (i.e. Java Options dialog)
5) in Accerciser, click through LO a11y hierarchy, in particular on all of the cells of the JRE table
6) close the dialog and LO

Backtrace:

~"#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44\n"
>~"#1  0x00007f0f296a815f in __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78\n"
>~"#2  0x00007f0f2965a472 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26\n"
>~"#3  0x00007f0f296444b2 in __GI_abort () at ./stdlib/abort.c:79\n"
>~"#4  0x00007f0f296443d5 in __assert_fail_base (fmt=0x7f0f297b8dc8 \"%s%s%s:%u: %s%sAssertion `%s' failed.\\n%n\", assertion=assertion@entry=0x7f0f28b376a0 \"rClients.end() != rPos && \\\"AccessibleEventNotifier::implLookupClient: invalid client id \\\" \\\"(did you register your client?)!\\\"\", file=file@entry=0x7f0f28b37478 \".../comphelper/source/misc/accessibleeventnotifier.cxx\", line=line@entry=140, function=function@entry=0x7f0f28b375b0 \"bool {anonymous}::implLookupClient(comphelper::AccessibleEventNotifier::TClientId, std::__debug::unordered_map<unsigned int, comphelper::OInterfaceContainerHelper4<com::sun::star::accessibility::XAccessibleEventListener> >::iterator&)\") at ./assert/assert.c:92\n"
>~"#5  0x00007f0f296533a2 in __assert_fail (assertion=0x7f0f28b376a0 \"rClients.end() != rPos && \\\"AccessibleEventNotifier::implLookupClient: invalid client id \\\" \\\"(did you register your client?)!\\\"\", file=0x7f0f28b37478 \".../comphelper/source/misc/accessibleeventnotifier.cxx\", line=140, function=0x7f0f28b375b0 \"bool {anonymous}::implLookupClient(comphelper::AccessibleEventNotifier::TClientId, std::__debug::unordered_map<unsigned int, comphelper::OInterfaceContainerHelper4<com::sun::star::accessibility::XAccessibleEventListener> >::iterator&)\") at ./assert/assert.c:101\n"
>~"#6  0x00007f0f28913886 in (anonymous namespace)::implLookupClient(comphelper::AccessibleEventNotifier::TClientId, std::__debug::unordered_map<unsigned int, comphelper::OInterfaceContainerHelper4<com::sun::star::accessibility::XAccessibleEventListener>, std::hash<unsigned int>, std::equal_to<unsigned int>, std::allocator<std::pair<unsigned int const, comphelper::OInterfaceContainerHelper4<com::sun::star::accessibility::XAccessibleEventListener> > > >::iterator&) (nClient=218, rPos=...) at .../comphelper/source/misc/accessibleeventnotifier.cxx:140\n"

>~"#7  0x00007f0f28913b9a in comphelper::AccessibleEventNotifier::revokeClientNotifyDisposing(unsigned int, com::sun::star::uno::Reference<com::sun::star::uno::XInterface> const&) (_nClient=218, _rxEventSource=uno::Reference to (accessibility::AccessibleBrowseBoxHeaderCell *) 0x55fb25c8b3d0) at .../comphelper/source/misc/accessibleeventnotifier.cxx:185\n"
>~"#8  0x00007f0eef073244 in accessibility::AccessibleBrowseBoxBase::disposing() (this=0x55fb25c8b3d0) at .../accessibility/source/extended/AccessibleBrowseBoxBase.cxx:113\n"
>~"#9  0x00007f0f28474aeb in cppu::WeakComponentImplHelperBase::dispose() (this=0x55fb25c8b3d0) at .../cppuhelper/source/implbase.cxx:104\n"
>~"#10 0x00007f0eef0712c2 in cppu::PartialWeakComponentImplHelper<com::sun::star::accessibility::XAccessibleContext, com::sun::star::accessibility::XAccessibleComponent, com::sun::star::accessibility::XAccessibleEventBroadcaster, com::sun::star::awt::XFocusListener, com::sun::star::lang::XServiceInfo>::dispose() (this=0x55fb25c8b3d0) at .../include/cppuhelper/compbase.hxx:90\n"
>~"#11 0x00007f0f28474834 in cppu::WeakComponentImplHelperBase::release() (this=0x55fb25c8b3d0) at .../cppuhelper/source/implbase.cxx:79\n"
>~"#12 0x00007f0eef072124 in cppu::PartialWeakComponentImplHelper<com::sun::star::accessibility::XAccessibleContext, com::sun::star::accessibility::XAccessibleComponent, com::sun::star::accessibility::XAccessibleEventBroadcaster, com::sun::star::awt::XFocusListener, com::sun::star::lang::XServiceInfo>::release() (this=0x55fb25c8b3d0) at .../include/cppuhelper/compbase.hxx:86\n"
>~"#13 0x00007f0eef07544a in accessibility::BrowseBoxAccessibleElement::release() (this=0x55fb25c8b3d0) at .../accessibility/source/extended/AccessibleBrowseBoxBase.cxx:518\n"
>~"#14 0x00007f0f15842747 in com::sun::star::uno::Reference<com::sun::star::accessibility::XAccessible>::~Reference() (this=0x7f0f0c0246e0, __in_chrg=<optimized out>) at .../include/com/sun/star/uno/Reference.hxx:114\n"

>~"#15 0x00007f0f15862b9f in QtAccessibleWidget::~QtAccessibleWidget() (this=0x7f0f0c0246a0, __in_chrg=<optimized out>) at .../vcl/inc/qt6/../qt5/QtAccessibleWidget.hxx:39\n"
>~"#16 0x00007f0f15862c76 in QtAccessibleWidget::~QtAccessibleWidget() (this=0x7f0f0c0246a0, __in_chrg=<optimized out>) at .../vcl/inc/qt6/../qt5/QtAccessibleWidget.hxx:39\n"
>~"#17 0x00007f0f146ca101 in QAccessibleCache::deleteInterface(unsigned int, QObject*) (this=0x55fb1ef073e0, id=2147483876, obj=0x55fb25c8abf0) at /home/michi/development/git/qt5/qtbase/src/gui/accessible/qaccessiblecache.cpp:173\n"
>~"#18 0x00007f0f146c9712 in QAccessibleCache::~QAccessibleCache() (this=0x55fb1ef073e0, __in_chrg=<optimized out>) at /home/michi/development/git/qt5/qtbase/src/gui/accessible/qaccessiblecache.cpp:31\n"
>~"#19 0x00007f0f146c9798 in QAccessibleCache::~QAccessibleCache() (this=0x55fb1ef073e0, __in_chrg=<optimized out>) at /home/michi/development/git/qt5/qtbase/src/gui/accessible/qaccessiblecache.cpp:32\n"
>~"#20 0x00007f0f146c967e in cleanupAccessibleCache() () at /home/michi/development/git/qt5/qtbase/src/gui/accessible/qaccessiblecache.cpp:24\n"
>~"#21 0x00007f0f14fa22f7 in qt_call_post_routines() () at /home/michi/development/git/qt5/qtbase/src/corelib/kernel/qcoreapplication.cpp:325\n"

>~"#22 0x00007f0f13599da0 in QApplication::~QApplication() (this=0x55fb1dfd77b0, __in_chrg=<optimized out>) at /home/michi/development/git/qt5/qtbase/src/widgets/kernel/qapplication.cpp:663\n"
>~"#23 0x00007f0f1359a09e in QApplication::~QApplication() (this=0x55fb1dfd77b0, __in_chrg=<optimized out>) at /home/michi/development/git/qt5/qtbase/src/widgets/kernel/qapplication.cpp:717\n"
>~"#24 0x00007f0f158ce2c4 in std::default_delete<QApplication>::operator()(QApplication*) const (this=0x55fb1e07b220, __ptr=0x55fb1dfd77b0) at /usr/include/c++/13/bits/unique_ptr.h:99\n"
>~"#25 0x00007f0f158ce70c in std::__uniq_ptr_impl<QApplication, std::default_delete<QApplication> >::reset(QApplication*) (this=0x55fb1e07b220, __p=0x0) at /usr/include/c++/13/bits/unique_ptr.h:211\n"
>~"#26 0x00007f0f158cc643 in std::unique_ptr<QApplication, std::default_delete<QApplication> >::reset(QApplication*) (this=0x55fb1e07b220, __p=0x0) at /usr/include/c++/13/bits/unique_ptr.h:509\n"

>~"#27 0x00007f0f158c506b in QtInstance::~QtInstance() (this=0x55fb1e07b090, __in_chrg=<optimized out>) at .../vcl/qt6/../qt5/QtInstance.cxx:273\n"
>~"#28 0x00007f0f158c5142 in QtInstance::~QtInstance() (this=0x55fb1e07b090, __in_chrg=<optimized out>) at .../vcl/qt6/../qt5/QtInstance.cxx:274\n"

>~"#29 0x00007f0f202615d9 in DestroySalInstance(SalInstance*) (pInst=0x55fb1e07b0a0) at .../vcl/source/app/salplug.cxx:389\n"
>~"#30 0x00007f0f203401ee in DeInitVCL() () at .../vcl/source/app/svmain.cxx:600\n"
>~"#31 0x00007f0f2033e9bf in ImplSVMain() () at .../vcl/source/app/svmain.cxx:229\n"
>~"#32 0x00007f0f2033ea1b in SVMain() () at .../vcl/source/app/svmain.cxx:236\n"
>~"#33 0x00007f0f2989f6ed in soffice_main() () at .../desktop/source/app/sofficemain.cxx:94\n"
>~"#34 0x000055fb1c8769d4 in sal_main () at .../desktop/source/app/main.c:51\n"
>~"#35 0x000055fb1c8769ba in main (argc=3, argv=0x7fffd6677498) at .../desktop/source/app/main.c:49\n"

Change-Id: Ic5ba4f75cbeac3955417ca54c189b262289bfc79
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/156259
Tested-by: Jenkins
Reviewed-by: Michael Weghorn <m.weghorn@posteo.de>
(cherry picked from commit 978cce0001ef9f37fb5fa5037a876f31ec558166)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/156226
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
(cherry picked from commit f50616ab80a3895f7677fdcfe8d820affbff8de8)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/156388
Reviewed-by: Ilmari Lauhakangas <ilmari.lauhakangas@libreoffice.org>
Reviewed-by: Hossein <hossein@libreoffice.org>
Tested-by: Xisco Fauli <xiscofauli@libreoffice.org>

1 files changed, 6 insertions, 0 deletions

diff --git a/vcl/source/treelist/svtabbx.cxx b/vcl/source/treelist/svtabbx.cxx
index 86c215dd21b6..bb5d48253335 100644
--- a/vcl/source/treelist/svtabbx.cxx
+++ b/vcl/source/treelist/svtabbx.cxx
@@ -17,6 +17,7 @@
  *   the License at http://www.apache.org/licenses/LICENSE-2.0 .
  */
 
+#include <comphelper/types.hxx>
 #include <vcl/svtaccessiblefactory.hxx>
 #include <vcl/accessiblefactory.hxx>
 #include <vcl/toolkit/svtabbx.hxx>
@@ -24,6 +25,7 @@
 #include <vcl/toolkit/svlbitm.hxx>
 #include <vcl/toolkit/treelistentry.hxx>
 #include <com/sun/star/accessibility/AccessibleStateType.hpp>
+#include <com/sun/star/accessibility/XAccessible.hpp>
 #include <rtl/ustrbuf.hxx>
 #include <sal/log.hxx>
 #include <o3tl/safeint.hxx>
@@ -497,6 +499,10 @@ SvHeaderTabListBox::~SvHeaderTabListBox()
 
 void SvHeaderTabListBox::dispose()
 {
+    for (css::uno::Reference<css::accessibility::XAccessible>& rxChild : m_aAccessibleChildren)
+        comphelper::disposeComponent(rxChild);
+    m_aAccessibleChildren.clear();
+
     m_pImpl.reset();
     SvTabListBox::dispose();
 }