From b6b0f7b99b68c66ea2b5e8e507c52801796b4d97 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
Date: Wed, 18 Oct 2017 11:05:20 +0100
Subject: [PATCH] a11y: crash in use after dispose

calc, chart in tab 3 with a11y enabled, select chart
switch to tab 1, crash cause mpParent has been deleted, IsDisposed
is correctly set, but shape accesses parent anyway

Change-Id: I6f57a798bfcc82eebb883291cec54e157ff5187b

potential deref of empty xStateSet

Change-Id: I83d876b0d966b18cdf85249b7e856e4e4f4dec27
---
 svx/source/accessibility/AccessibleShape.cxx | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/svx/source/accessibility/AccessibleShape.cxx b/svx/source/accessibility/AccessibleShape.cxx
index 043ba8e..47c0aca 100644
--- a/svx/source/accessibility/AccessibleShape.cxx
+++ b/svx/source/accessibility/AccessibleShape.cxx
@@ -410,7 +410,9 @@ uno::Reference<XAccessibleStateSet> SAL_CALL
     ::osl::MutexGuard aGuard (maMutex);
     Reference<XAccessibleStateSet> xStateSet;
 
-    if (IsDisposed())
+    bool bDisposed = IsDisposed();
+
+    if (bDisposed)
     {
         // Return a minimal state set that only contains the DEFUNC state.
         xStateSet = AccessibleContextBase::getAccessibleStateSet ();
@@ -461,7 +463,7 @@ uno::Reference<XAccessibleStateSet> SAL_CALL
             xStateSet.set( new ::utl::AccessibleStateSetHelper (*pStateSet));
         }
     }
-    if (mpParent && mpParent->IsDocumentSelAll())
+    if (!bDisposed && xStateSet.is() && mpParent && mpParent->IsDocumentSelAll())
     {
         ::utl::AccessibleStateSetHelper* pStateSet =
             static_cast< ::utl::AccessibleStateSetHelper*>(xStateSet.get());
-- 
2.9.5