From 3ba417fe93fd25d1a4c2f3d1cd368e9bd93882d4 Mon Sep 17 00:00:00 2001
From: Michael Stahl <mstahl@redhat.com>
Date: Thu, 12 Dec 2013 12:30:53 +0100
Subject: winaccessibility: do not access freed AccObject

The AccObject is stored by value in XIdAccList, so don't call GetResID()
after it has been erased.

Change-Id: I391aad1e3ab71d443cc6e6b92381f74918e0bcfb
(cherry picked from commit b22e987113374399c7455f7979bc34519eac69da)
---
 winaccessibility/source/service/AccObjectWinManager.cxx | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'winaccessibility')

diff --git a/winaccessibility/source/service/AccObjectWinManager.cxx b/winaccessibility/source/service/AccObjectWinManager.cxx
index 8559e2b65782..bb9434a40508 100644
--- a/winaccessibility/source/service/AccObjectWinManager.cxx
+++ b/winaccessibility/source/service/AccObjectWinManager.cxx
@@ -556,9 +556,10 @@ void AccObjectWinManager::DeleteAccObj( XAccessible* pXAcc )
     {
         accObj.GetIMAccessible()->Release();
     }
-    XIdAccList.erase( pXAcc );
-    XResIdAccList.erase( accObj.GetResID() );
+    size_t i = XResIdAccList.erase(accObj.GetResID());
+    assert(i != 0);
     DeleteFromHwndXAcc(pXAcc);
+    XIdAccList.erase(pXAcc); // note: this invalidates accObj so do it last!
 }
 
 /**
-- 
cgit