a11y crash on deleting certain frame in certain document

I've an internal RH document which crashes in a11y when a paragraph with a
graphic and a drawing frame in it is deleted.

The SdrObject is removed and deleted, but when
SwAccessibleContext::DisposeChild is called the object does not pass IsShowing
so its not removed from the accessibility map. Leaving an entry in the map
pointing to a deleted SdrObject

So here take the route-one approach of always removing from the map
accessibility children which depend on a SdrObject which is getting deleted,
whether or not it is inside the visible area at the moment.

The real change here is to SwAccessibleContext::DisposeChild and to
SwFrame::RemoveDrawObj

Change-Id: I764cd54d6216d233756f52b5be66c80737b5e38d
Reviewed-on: https://gerrit.libreoffice.org/26824
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Michael Stahl <mstahl@redhat.com>

1 files changed, 5 insertions, 5 deletions

diff --git a/sw/source/core/inc/viewimp.hxx b/sw/source/core/inc/viewimp.hxx
index 4ebe4897c7fb..be88ca9d2036 100644
--- a/sw/source/core/inc/viewimp.hxx
+++ b/sw/source/core/inc/viewimp.hxx
@@ -225,10 +225,10 @@ public:
 
     /// Remove a frame from the accessible view
     void DisposeAccessible( const SwFrame *pFrame, const SdrObject *pObj,
-                            bool bRecursive );
+                            bool bRecursive, bool bCanSkipInvisible );
     inline void DisposeAccessibleFrame( const SwFrame *pFrame,
                                bool bRecursive = false );
-    inline void DisposeAccessibleObj( const SdrObject *pObj );
+    inline void DisposeAccessibleObj( const SdrObject *pObj, bool bCanSkipInvisible );
 
     /// Move a frame's position in the accessible view
     void MoveAccessible( const SwFrame *pFrame, const SdrObject *pObj,
@@ -278,12 +278,12 @@ inline SwAccessibleMap& SwViewShellImp::GetAccessibleMap()
 inline void SwViewShellImp::DisposeAccessibleFrame( const SwFrame *pFrame,
                                bool bRecursive )
 {
-    DisposeAccessible( pFrame, nullptr, bRecursive );
+    DisposeAccessible( pFrame, nullptr, bRecursive, true );
 }
 
-inline void SwViewShellImp::DisposeAccessibleObj( const SdrObject *pObj )
+inline void SwViewShellImp::DisposeAccessibleObj( const SdrObject *pObj, bool bCanSkipInvisible )
 {
-    DisposeAccessible( nullptr, pObj, false );
+    DisposeAccessible( nullptr, pObj, false, bCanSkipInvisible );
 }
 
 inline void SwViewShellImp::MoveAccessibleFrame( const SwFrame *pFrame,