diff options
| -rw-r--r-- | sdext/source/presenter/PresenterAccessibility.cxx | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/sdext/source/presenter/PresenterAccessibility.cxx b/sdext/source/presenter/PresenterAccessibility.cxx index 951a18c5fca5..936c75df35f7 100644 --- a/sdext/source/presenter/PresenterAccessibility.cxx +++ b/sdext/source/presenter/PresenterAccessibility.cxx @@ -451,9 +451,12 @@ public: void FocusObject (const ::rtl::Reference<PresenterAccessible::AccessibleObject>& rpObject); + ~AccessibleFocusManager(); + private: static std::shared_ptr<AccessibleFocusManager> mpInstance; ::std::vector<rtl::Reference<PresenterAccessible::AccessibleObject> > maFocusableObjects; + bool m_isInDtor = false; AccessibleFocusManager(); }; @@ -1810,10 +1813,18 @@ std::shared_ptr<AccessibleFocusManager> const & AccessibleFocusManager::Instance } AccessibleFocusManager::AccessibleFocusManager() - : maFocusableObjects() { } +AccessibleFocusManager::~AccessibleFocusManager() +{ + // copy member to stack, then drop it - otherwise will get use-after-free + // from AccessibleObject::disposing(), it will call ~Reference *twice* + auto const temp(std::move(maFocusableObjects)); + (void) temp; + m_isInDtor = true; +} + void AccessibleFocusManager::AddFocusableObject ( const ::rtl::Reference<PresenterAccessible::AccessibleObject>& rpObject) { @@ -1833,7 +1844,7 @@ void AccessibleFocusManager::RemoveFocusableObject ( maFocusableObjects.erase(iObject); else { - OSL_ASSERT(iObject!=maFocusableObjects.end()); + OSL_ASSERT(m_isInDtor); // in dtor, was removed already } } |