vcl,accessibility: try to fix a crash while disposing SvxFontNameBox_Impl

This happened in a 6.3 based branch, no idea how to reproduce it.
Clearly the SvxFontNameBox_Impl is being disposed and in its base class
Window::dispose() when a call to SvxFontNameBox_Impl::CreateAccessible()
happens, which seems very suspicious; try to prevent that.

mergedlo.dll!ImplListBox::InsertEntry(long nPos, const rtl::OUString & rStr) Zeile 2225
unter d:\lo\core\vcl\source\control\imp_listbox.cxx (2225)
mergedlo.dll!ComboBox::InsertEntry(const rtl::OUString & rStr, long nPos) Zeile 886
unter d:\lo\core\vcl\source\control\combobox.cxx (886)
mergedlo.dll!FontNameBox::Fill(const FontList * pList) Zeile 447
unter d:\lo\core\svtools\source\control\ctrlbox.cxx (447)
[Inlineframe] mergedlo.dll!SvxFontNameBox_Impl::Fill(const FontList * pList) Zeile 236
unter d:\lo\core\svx\source\tbxctrls\tbcontrl.cxx (236)
mergedlo.dll!lcl_GetDocFontList(const FontList * * ppFontList, SvxFontNameBox_Impl * pBox) Zeile 1290
unter d:\lo\core\svx\source\tbxctrls\tbcontrl.cxx (1290)
mergedlo.dll!SvxFontNameBox_Impl::FillList() Zeile 1331
unter d:\lo\core\svx\source\tbxctrls\tbcontrl.cxx (1331)
mergedlo.dll!SvxFontNameBox_Impl::CreateAccessible() Zeile 3739
unter d:\lo\core\svx\source\tbxctrls\tbcontrl.cxx (3739)
mergedlo.dll!vcl::Window::GetAccessible(bool bCreate) Zeile 129
unter d:\lo\core\vcl\source\window\accessibility.cxx (129)
acclo.dll!VCLXAccessibleToolBox::getAccessibleChild(long i) Zeile 733
unter d:\lo\core\accessibility\source\standard\vclxaccessibletoolbox.cxx (733)
acclo.dll!VCLXAccessibleToolBox::GetItemWindowAccessible(const VclWindowEvent & rVclWindowEvent) Zeile 784
unter d:\lo\core\accessibility\source\standard\vclxaccessibletoolbox.cxx (784)
acclo.dll!VCLXAccessibleToolBox::GetChildAccessible(const VclWindowEvent & rVclWindowEvent) Zeile 795
unter d:\lo\core\accessibility\source\standard\vclxaccessibletoolbox.cxx (795)
mergedlo.dll!VCLXAccessibleComponent::ProcessWindowChildEvent(const VclWindowEvent & rVclWindowEvent) Zeile 165
unter d:\lo\core\toolkit\source\awt\vclxaccessiblecomponent.cxx (165)
acclo.dll!VCLXAccessibleToolBox::ProcessWindowChildEvent(const VclWindowEvent & rVclWindowEvent) Zeile 657
unter d:\lo\core\accessibility\source\standard\vclxaccessibletoolbox.cxx (657)
mergedlo.dll!VCLXAccessibleComponent::WindowChildEventListener(VclWindowEvent & rEvent) Zeile 129
unter d:\lo\core\toolkit\source\awt\vclxaccessiblecomponent.cxx (129)
mergedlo.dll!VCLXAccessibleComponent::LinkStubWindowChildEventListener(void * instance, VclWindowEvent & data) Zeile 118
unter d:\lo\core\toolkit\source\awt\vclxaccessiblecomponent.cxx (118)
[Inlineframe] mergedlo.dll!Link<VclWindowEvent &,void>::Call(VclWindowEvent &) Zeile 84
unter d:\lo\core\include\tools\link.hxx (84)
mergedlo.dll!vcl::Window::CallEventListeners(VclEventId nEvent, void * pData) Zeile 280
unter d:\lo\core\vcl\source\window\event.cxx (280)
mergedlo.dll!vcl::Window::ImplResetReallyVisible() Zeile 735
unter d:\lo\core\vcl\source\window\stacking.cxx (735)
mergedlo.dll!vcl::Window::ImplResetReallyVisible() Zeile 747
unter d:\lo\core\vcl\source\window\stacking.cxx (747)
mergedlo.dll!vcl::Window::Show(bool bVisible, ShowFlags nFlags) Zeile 2198
unter d:\lo\core\vcl\source\window\window.cxx (2198)
mergedlo.dll!vcl::Window::Show(bool bVisible, ShowFlags nFlags) Zeile 2176
unter d:\lo\core\vcl\source\window\window.cxx (2176)
[Inlineframe] mergedlo.dll!vcl::Window::Hide() Zeile 925
unter d:\lo\core\include\vcl\window.hxx (925)
mergedlo.dll!vcl::Window::dispose() Zeile 402
unter d:\lo\core\vcl\source\window\window.cxx (402)
mergedlo.dll!Edit::dispose() Zeile 258
unter d:\lo\core\vcl\source\control\edit.cxx (258)
mergedlo.dll!ComboBox::dispose() Zeile 132
unter d:\lo\core\vcl\source\control\combobox.cxx (132)
mergedlo.dll!SvxFontNameBox_Impl::dispose() Zeile 1322
unter d:\lo\core\svx\source\tbxctrls\tbcontrl.cxx (1322)
[Inlineframe] mergedlo.dll!VclPtr<SvxFontNameBox_Impl>::disposeAndClear() Zeile 206
unter d:\lo\core\include\vcl\vclptr.hxx (206)
mergedlo.dll!SvxFontNameToolBoxControl::dispose() Zeile 3309
unter d:\lo\core\svx\source\tbxctrls\tbcontrl.cxx (3309)
mergedlo.dll!framework::ToolBarManager::RemoveControllers() Zeile 651
unter d:\lo\core\framework\source\uielement\toolbarmanager.cxx (651)
mergedlo.dll!framework::ToolBarManager::dispose() Zeile 468
unter d:\lo\core\framework\source\uielement\toolbarmanager.cxx (468)
mergedlo.dll!framework::ToolBarWrapper::dispose() Zeile 105
unter d:\lo\core\framework\source\uielement\toolbarwrapper.cxx (105)
mergedlo.dll!framework::ToolbarLayoutManager::destroyToolbars() Zeile 666
unter d:\lo\core\framework\source\layoutmanager\toolbarlayoutmanager.cxx (666)
mergedlo.dll!framework::ToolbarLayoutManager::reset() Zeile 364
unter d:\lo\core\framework\source\layoutmanager\toolbarlayoutmanager.cxx (364)
mergedlo.dll!framework::LayoutManager::implts_reset(bool bAttached) Zeile 458
unter d:\lo\core\framework\source\layoutmanager\layoutmanager.cxx (458)
mergedlo.dll!framework::LayoutManager::frameAction(const com::sun::star::frame::FrameActionEvent & aEvent) Zeile 2757
unter d:\lo\core\framework\source\layoutmanager\layoutmanager.cxx (2757)
mergedlo.dll!`anonymous namespace'::XFrameImpl::implts_sendFrameActionEvent(const com::sun::star::frame::FrameAction & aAction) Zeile 2952
unter d:\lo\core\framework\source\services\frame.cxx (2952)
mergedlo.dll!`anonymous namespace'::XFrameImpl::setComponent(const com::sun::star::uno::Reference<com::sun::star::awt::XWindow> & xComponentWindow, const com::sun::star::uno::Reference<com::sun::star::frame::XController> & xController) Zeile 1470
unter d:\lo\core\framework\source\services\frame.cxx (1470)
mergedlo.dll!`anonymous namespace'::XFrameImpl::close(unsigned char bDeliverOwnership) Zeile 1701
unter d:\lo\core\framework\source\services\frame.cxx (1701)
mergedlo.dll!framework::pattern::frame::closeIt(const com::sun::star::uno::Reference<com::sun::star::uno::XInterface> & xResource) Zeile 62
unter d:\lo\core\framework\source\inc\pattern\frame.hxx (62)
[Inlineframe] mergedlo.dll!framework::CloseDispatcher::implts_closeFrame() Zeile 492
unter d:\lo\core\framework\source\dispatch\closedispatcher.cxx (492)

Change-Id: Ie05cd05158df58021d0fb4a19e9e38cd35af2426
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/164451
Tested-by: Jenkins
Reviewed-by: Michael Weghorn <m.weghorn@posteo.de>
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>

1 files changed, 8 insertions, 3 deletions

diff --git a/accessibility/source/standard/vclxaccessibletoolbox.cxx b/accessibility/source/standard/vclxaccessibletoolbox.cxx
index d52d26b95d73..9094ce357b6b 100644
--- a/accessibility/source/standard/vclxaccessibletoolbox.cxx
+++ b/accessibility/source/standard/vclxaccessibletoolbox.cxx
@@ -630,9 +630,14 @@ Reference< XAccessible > SAL_CALL VCLXAccessibleToolBox::getAccessibleChild( sal
         if ( pItemWindow )
         {
             Reference< XAccessible> xParent = xChild;
-            rtl::Reference<OToolBoxWindowItem> xChild2( new OToolBoxWindowItem(0,::comphelper::getProcessComponentContext(),pItemWindow->GetAccessible(),xParent) );
-            pItemWindow->SetAccessible(xChild2);
-            xChild->SetChild( xChild2 );
+            auto const xInnerAcc(pItemWindow->GetAccessible());
+            if (xInnerAcc) // else child is being disposed - avoid crashing
+            {
+                rtl::Reference<OToolBoxWindowItem> xChild2(new OToolBoxWindowItem(0,
+                    ::comphelper::getProcessComponentContext(), xInnerAcc, xParent));
+                pItemWindow->SetAccessible(xChild2);
+                xChild->SetChild( xChild2 );
+            }
         }
         if ( nHighlightItemId > ToolBoxItemId(0) && nItemId == nHighlightItemId )
             xChild->SetFocus( true );