Kaydet (Commit) 3e2f1767 authored tarafından Stephan Bergmann's avatar Stephan Bergmann

Wrong downcast from svx::a11y::AccFrameSelectorChild

...to svx::a11y::AccFrameSelector (which are unrelated final classes).  UBSan
Calc "Format - Cells... - Borders - Line Arrangement - User-defined:" and
clicking into the top-right corner of the widget caused

> svx/source/dialog/frmsel.cxx:972:50: runtime error: downcast of address 0x60f0003dfa80 which does not point to an object of type 'a11y::AccFrameSelector'
> 0x60f0003dfa80: note: object is of type 'svx::a11y::AccFrameSelectorChild'
>  e1 03 80 0d  90 4f c2 88 ce 7f 00 00  02 00 00 00 be be be be  00 00 00 00 00 00 00 00  00 00 00 00
>               ^~~~~~~~~~~~~~~~~~~~~~~
>               vptr for 'svx::a11y::AccFrameSelectorChild'
>  #0 in svx::FrameSelector::SelectBorder(svx::FrameBorderType) at svx/source/dialog/frmsel.cxx:972:50
>  #1 in svx::FrameSelector::MouseButtonDown(MouseEvent const&) at svx/source/dialog/frmsel.cxx:1114:21
[...]

The code was like that ever since 60f11adb
"Integrate branch of IAccessible2", which had presumably confused
AccFrameSelector and AccFrameSelectorChild here (while there'd apparently not
been a deeper need for the static_casts anyway).

Change-Id: I1f52629143dcfc84e57e9539a428fb0f51fdc72e
Reviewed-on: https://gerrit.libreoffice.org/72910
Tested-by: Jenkins
Reviewed-by: 's avatarStephan Bergmann <sbergman@redhat.com>
üst 78e003e0
......@@ -63,7 +63,7 @@ namespace o3tl
namespace svx {
struct FrameSelectorImpl;
namespace a11y { class AccFrameSelectorChild; }
/** All possible states of a frame border. */
enum class FrameBorderState
......@@ -160,7 +160,7 @@ public:
a11yrelationset get_accessible_relation_set() { return GetDrawingArea()->get_accessible_relation_set(); }
/** Returns the accessibility child object of the specified frame border (if enabled). */
css::uno::Reference< css::accessibility::XAccessible >
rtl::Reference< a11y::AccFrameSelectorChild >
GetChildAccessible( FrameBorderType eBorder );
/** Returns the accessibility child object with specified index (counts enabled frame borders only). */
css::uno::Reference< css::accessibility::XAccessible >
......
......@@ -746,18 +746,17 @@ void FrameSelectorImpl::SetBorderState( FrameBorder& rBorder, FrameBorderState e
Any aNew;
Any& rMod = eState == FrameBorderState::Show ? aNew : aOld;
rMod <<= AccessibleStateType::CHECKED;
Reference< XAccessible > xRet;
rtl::Reference< a11y::AccFrameSelectorChild > xRet;
size_t nVecIdx = static_cast< size_t >( rBorder.GetType() );
if( GetBorder(rBorder.GetType()).IsEnabled() && (1 <= nVecIdx) && (nVecIdx <= maChildVec.size()) )
xRet = maChildVec[ --nVecIdx ].get();
a11y::AccFrameSelector* pFrameSelector = static_cast<a11y::AccFrameSelector*>(xRet.get());
if( eState == FrameBorderState::Show )
SetBorderCoreStyle( rBorder, &maCurrStyle );
else
rBorder.SetState( eState );
if (pFrameSelector)
pFrameSelector->NotifyAccessibleEvent( AccessibleEventId::STATE_CHANGED, aOld, aNew );
if (xRet.is())
xRet->NotifyAccessibleEvent( AccessibleEventId::STATE_CHANGED, aOld, aNew );
DoInvalidate( true );
}
......@@ -968,13 +967,12 @@ void FrameSelector::SelectBorder( FrameBorderType eBorder )
// MT: bFireFox as API parameter is ugly...
// if (bFocus)
{
Reference< XAccessible > xRet = GetChildAccessible(eBorder);
a11y::AccFrameSelector* pFrameSelector = static_cast<a11y::AccFrameSelector*>(xRet.get());
if (pFrameSelector)
rtl::Reference< a11y::AccFrameSelectorChild > xRet = GetChildAccessible(eBorder);
if (xRet.is())
{
Any aOldValue, aNewValue;
aNewValue <<= AccessibleStateType::FOCUSED;
pFrameSelector->NotifyAccessibleEvent( AccessibleEventId::STATE_CHANGED, aOldValue, aNewValue );
xRet->NotifyAccessibleEvent( AccessibleEventId::STATE_CHANGED, aOldValue, aNewValue );
}
}
}
......@@ -1020,9 +1018,9 @@ Reference< XAccessible > FrameSelector::CreateAccessible()
return mxAccess.get();
}
Reference< XAccessible > FrameSelector::GetChildAccessible( FrameBorderType eBorder )
rtl::Reference< a11y::AccFrameSelectorChild > FrameSelector::GetChildAccessible( FrameBorderType eBorder )
{
Reference< XAccessible > xRet;
rtl::Reference< a11y::AccFrameSelectorChild > xRet;
size_t nVecIdx = static_cast< size_t >( eBorder );
if( IsBorderEnabled( eBorder ) && (1 <= nVecIdx) && (nVecIdx <= mxImpl->maChildVec.size()) )
{
......@@ -1036,7 +1034,7 @@ Reference< XAccessible > FrameSelector::GetChildAccessible( FrameBorderType eBor
Reference< XAccessible > FrameSelector::GetChildAccessible( sal_Int32 nIndex )
{
return GetChildAccessible( GetEnabledBorderType( nIndex ) );
return GetChildAccessible( GetEnabledBorderType( nIndex ) ).get();
}
Reference< XAccessible > FrameSelector::GetChildAccessible( const Point& rPos )
......@@ -1044,7 +1042,7 @@ Reference< XAccessible > FrameSelector::GetChildAccessible( const Point& rPos )
Reference< XAccessible > xRet;
for( FrameBorderCIter aIt( mxImpl->maEnabBorders ); !xRet.is() && aIt.Is(); ++aIt )
if( (*aIt)->ContainsClickPoint( rPos ) )
xRet = GetChildAccessible( (*aIt)->GetType() );
xRet = GetChildAccessible( (*aIt)->GetType() ).get();
return xRet;
}
......
......@@ -71,11 +71,6 @@ public:
virtual sal_Int32 SAL_CALL getForeground( ) override;
virtual sal_Int32 SAL_CALL getBackground( ) override;
void NotifyAccessibleEvent(const sal_Int16 _nEventId, const css::uno::Any& _rOldValue, const css::uno::Any& _rNewValue)
{
::comphelper::OAccessibleComponentHelper::NotifyAccessibleEvent(_nEventId, _rOldValue, _rNewValue);
}
void Invalidate();
private:
......@@ -120,6 +115,11 @@ public:
virtual sal_Int32 SAL_CALL getForeground( ) override;
virtual sal_Int32 SAL_CALL getBackground( ) override;
void NotifyAccessibleEvent(const sal_Int16 _nEventId, const css::uno::Any& _rOldValue, const css::uno::Any& _rNewValue)
{
::comphelper::OAccessibleComponentHelper::NotifyAccessibleEvent(_nEventId, _rOldValue, _rNewValue);
}
void Invalidate();
private:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment