diff options
| author | Stephan Bergmann <sbergman@redhat.com> | 2019-05-24 16:11:45 +0200 |
|---|---|---|
| committer | Stephan Bergmann <sbergman@redhat.com> | 2019-05-24 17:14:02 +0200 |
| commit | 3e2f1767db05b1bcc17a5f47ae025faee214f6f6 (patch) | |
| tree | f1f4d74560161ef0d33096b2a3fd7ba770090e5a /include | |
| parent | 78e003e0dcfe67cf56618a2af033abe37adee1ca (diff) | |
Wrong downcast from svx::a11y::AccFrameSelectorChild
...to svx::a11y::AccFrameSelector (which are unrelated final classes). UBSan
Calc "Format - Cells... - Borders - Line Arrangement - User-defined:" and
clicking into the top-right corner of the widget caused
> svx/source/dialog/frmsel.cxx:972:50: runtime error: downcast of address 0x60f0003dfa80 which does not point to an object of type 'a11y::AccFrameSelector'
> 0x60f0003dfa80: note: object is of type 'svx::a11y::AccFrameSelectorChild'
> e1 03 80 0d 90 4f c2 88 ce 7f 00 00 02 00 00 00 be be be be 00 00 00 00 00 00 00 00 00 00 00 00
> ^~~~~~~~~~~~~~~~~~~~~~~
> vptr for 'svx::a11y::AccFrameSelectorChild'
> #0 in svx::FrameSelector::SelectBorder(svx::FrameBorderType) at svx/source/dialog/frmsel.cxx:972:50
> #1 in svx::FrameSelector::MouseButtonDown(MouseEvent const&) at svx/source/dialog/frmsel.cxx:1114:21
[...]
The code was like that ever since 60f11adb950e4f9645cc9ecb0f5af8235cc97366
"Integrate branch of IAccessible2", which had presumably confused
AccFrameSelector and AccFrameSelectorChild here (while there'd apparently not
been a deeper need for the static_casts anyway).
Change-Id: I1f52629143dcfc84e57e9539a428fb0f51fdc72e
Reviewed-on: https://gerrit.libreoffice.org/72910
Tested-by: Jenkins
Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
Diffstat (limited to 'include')
| -rw-r--r-- | include/svx/frmsel.hxx | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/include/svx/frmsel.hxx b/include/svx/frmsel.hxx index 83245e1a65fc..2222ad1d7d71 100644 --- a/include/svx/frmsel.hxx +++ b/include/svx/frmsel.hxx @@ -63,7 +63,7 @@ namespace o3tl namespace svx { struct FrameSelectorImpl; - +namespace a11y { class AccFrameSelectorChild; } /** All possible states of a frame border. */ enum class FrameBorderState @@ -160,7 +160,7 @@ public: a11yrelationset get_accessible_relation_set() { return GetDrawingArea()->get_accessible_relation_set(); } /** Returns the accessibility child object of the specified frame border (if enabled). */ - css::uno::Reference< css::accessibility::XAccessible > + rtl::Reference< a11y::AccFrameSelectorChild > GetChildAccessible( FrameBorderType eBorder ); /** Returns the accessibility child object with specified index (counts enabled frame borders only). */ css::uno::Reference< css::accessibility::XAccessible > |