Wrong downcast from svx::a11y::AccFrameSelectorChild

...to svx::a11y::AccFrameSelector (which are unrelated final classes).  UBSan
Calc "Format - Cells... - Borders - Line Arrangement - User-defined:" and
clicking into the top-right corner of the widget caused

> svx/source/dialog/frmsel.cxx:972:50: runtime error: downcast of address 0x60f0003dfa80 which does not point to an object of type 'a11y::AccFrameSelector'
> 0x60f0003dfa80: note: object is of type 'svx::a11y::AccFrameSelectorChild'
>  e1 03 80 0d  90 4f c2 88 ce 7f 00 00  02 00 00 00 be be be be  00 00 00 00 00 00 00 00  00 00 00 00
>               ^~~~~~~~~~~~~~~~~~~~~~~
>               vptr for 'svx::a11y::AccFrameSelectorChild'
>  #0 in svx::FrameSelector::SelectBorder(svx::FrameBorderType) at svx/source/dialog/frmsel.cxx:972:50
>  #1 in svx::FrameSelector::MouseButtonDown(MouseEvent const&) at svx/source/dialog/frmsel.cxx:1114:21
[...]

The code was like that ever since 60f11adb950e4f9645cc9ecb0f5af8235cc97366
"Integrate branch of IAccessible2", which had presumably confused
AccFrameSelector and AccFrameSelectorChild here (while there'd apparently not
been a deeper need for the static_casts anyway).

Change-Id: I1f52629143dcfc84e57e9539a428fb0f51fdc72e
Reviewed-on: https://gerrit.libreoffice.org/72910
Tested-by: Jenkins
Reviewed-by: Stephan Bergmann <sbergman@redhat.com>

2 files changed, 15 insertions, 17 deletions

diff --git a/svx/source/dialog/frmsel.cxx b/svx/source/dialog/frmsel.cxx
index 295bb0cf6e92..07cb2e0223bc 100644
--- a/svx/source/dialog/frmsel.cxx
+++ b/svx/source/dialog/frmsel.cxx
@@ -746,18 +746,17 @@ void FrameSelectorImpl::SetBorderState( FrameBorder& rBorder, FrameBorderState e
     Any aNew;
     Any& rMod = eState == FrameBorderState::Show ? aNew : aOld;
     rMod <<= AccessibleStateType::CHECKED;
-    Reference< XAccessible > xRet;
+    rtl::Reference< a11y::AccFrameSelectorChild > xRet;
     size_t nVecIdx = static_cast< size_t >( rBorder.GetType() );
     if( GetBorder(rBorder.GetType()).IsEnabled() && (1 <= nVecIdx) && (nVecIdx <= maChildVec.size()) )
         xRet = maChildVec[ --nVecIdx ].get();
-    a11y::AccFrameSelector* pFrameSelector = static_cast<a11y::AccFrameSelector*>(xRet.get());
 
     if( eState == FrameBorderState::Show )
         SetBorderCoreStyle( rBorder, &maCurrStyle );
     else
         rBorder.SetState( eState );
-    if (pFrameSelector)
-        pFrameSelector->NotifyAccessibleEvent( AccessibleEventId::STATE_CHANGED, aOld, aNew );
+    if (xRet.is())
+        xRet->NotifyAccessibleEvent( AccessibleEventId::STATE_CHANGED, aOld, aNew );
     DoInvalidate( true );
 }
 
@@ -968,13 +967,12 @@ void FrameSelector::SelectBorder( FrameBorderType eBorder )
     // MT: bFireFox as API parameter is ugly...
     // if (bFocus)
     {
-        Reference< XAccessible > xRet = GetChildAccessible(eBorder);
-        a11y::AccFrameSelector* pFrameSelector = static_cast<a11y::AccFrameSelector*>(xRet.get());
-        if (pFrameSelector)
+        rtl::Reference< a11y::AccFrameSelectorChild > xRet = GetChildAccessible(eBorder);
+        if (xRet.is())
         {
             Any aOldValue, aNewValue;
             aNewValue <<= AccessibleStateType::FOCUSED;
-            pFrameSelector->NotifyAccessibleEvent( AccessibleEventId::STATE_CHANGED, aOldValue, aNewValue );
+            xRet->NotifyAccessibleEvent( AccessibleEventId::STATE_CHANGED, aOldValue, aNewValue );
         }
     }
 }
@@ -1020,9 +1018,9 @@ Reference< XAccessible > FrameSelector::CreateAccessible()
     return mxAccess.get();
 }
 
-Reference< XAccessible > FrameSelector::GetChildAccessible( FrameBorderType eBorder )
+rtl::Reference< a11y::AccFrameSelectorChild > FrameSelector::GetChildAccessible( FrameBorderType eBorder )
 {
-    Reference< XAccessible > xRet;
+    rtl::Reference< a11y::AccFrameSelectorChild > xRet;
     size_t nVecIdx = static_cast< size_t >( eBorder );
     if( IsBorderEnabled( eBorder ) && (1 <= nVecIdx) && (nVecIdx <= mxImpl->maChildVec.size()) )
     {
@@ -1036,7 +1034,7 @@ Reference< XAccessible > FrameSelector::GetChildAccessible( FrameBorderType eBor
 
 Reference< XAccessible > FrameSelector::GetChildAccessible( sal_Int32 nIndex )
 {
-    return GetChildAccessible( GetEnabledBorderType( nIndex ) );
+    return GetChildAccessible( GetEnabledBorderType( nIndex ) ).get();
 }
 
 Reference< XAccessible > FrameSelector::GetChildAccessible( const Point& rPos )
@@ -1044,7 +1042,7 @@ Reference< XAccessible > FrameSelector::GetChildAccessible( const Point& rPos )
     Reference< XAccessible > xRet;
     for( FrameBorderCIter aIt( mxImpl->maEnabBorders ); !xRet.is() && aIt.Is(); ++aIt )
         if( (*aIt)->ContainsClickPoint( rPos ) )
-            xRet = GetChildAccessible( (*aIt)->GetType() );
+            xRet = GetChildAccessible( (*aIt)->GetType() ).get();
     return xRet;
 }
 
diff --git a/svx/source/inc/AccessibleFrameSelector.hxx b/svx/source/inc/AccessibleFrameSelector.hxx
index 8c1ce7e35c83..1e042e5cc896 100644
--- a/svx/source/inc/AccessibleFrameSelector.hxx
+++ b/svx/source/inc/AccessibleFrameSelector.hxx
@@ -71,11 +71,6 @@ public:
     virtual sal_Int32 SAL_CALL getForeground(  ) override;
     virtual sal_Int32 SAL_CALL getBackground(  ) override;
 
-    void NotifyAccessibleEvent(const sal_Int16 _nEventId, const css::uno::Any& _rOldValue, const css::uno::Any& _rNewValue)
-    {
-        ::comphelper::OAccessibleComponentHelper::NotifyAccessibleEvent(_nEventId, _rOldValue, _rNewValue);
-    }
-
     void    Invalidate();
 
 private:
@@ -120,6 +115,11 @@ public:
     virtual sal_Int32 SAL_CALL getForeground(  ) override;
     virtual sal_Int32 SAL_CALL getBackground(  ) override;
 
+    void NotifyAccessibleEvent(const sal_Int16 _nEventId, const css::uno::Any& _rOldValue, const css::uno::Any& _rNewValue)
+    {
+        ::comphelper::OAccessibleComponentHelper::NotifyAccessibleEvent(_nEventId, _rOldValue, _rNewValue);
+    }
+
     void    Invalidate();
 
 private: