Files
libreoffice/sw/source/core/access/acccell.hxx

139 lines
5.0 KiB
C++
Raw Normal View History

/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
/*
* This file is part of the LibreOffice project.
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
*
* This file incorporates work covered by the following license notice:
*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed
* with this work for additional information regarding copyright
* ownership. The ASF licenses this file to you under the Apache
* License, Version 2.0 (the "License"); you may not use this file
* except in compliance with the License. You may obtain a copy of
* the License at http://www.apache.org/licenses/LICENSE-2.0 .
*/
#ifndef INCLUDED_SW_SOURCE_CORE_ACCESS_ACCCELL_HXX
#define INCLUDED_SW_SOURCE_CORE_ACCESS_ACCCELL_HXX
2002-04-11 12:42:31 +00:00
#include "acccontext.hxx"
#include <com/sun/star/accessibility/XAccessibleValue.hpp>
#include "accselectionhelper.hxx"
class SwCellFrame;
class SwAccessibleTable;
class SwFrameFormat;
2002-04-11 12:42:31 +00:00
class SwAccessibleCell : public SwAccessibleContext,
public css::accessibility::XAccessibleValue,
public css::accessibility::XAccessibleSelection,
public css::accessibility::XAccessibleExtendedAttributes
2002-04-11 12:42:31 +00:00
{
// Implementation for XAccessibleSelection interface
SwAccessibleSelectionHelper m_aSelectionHelper;
bool m_bIsSelected; // protected by base class mutex
2002-04-11 12:42:31 +00:00
bool IsSelected();
2002-04-11 12:42:31 +00:00
bool InvalidateMyCursorPos();
bool InvalidateChildrenCursorPos( const SwFrame *pFrame );
2002-04-11 12:42:31 +00:00
rtl::Reference<SwAccessibleTable> m_pAccTable;
2002-04-11 12:42:31 +00:00
protected:
// Set states for getAccessibleStateSet.
2014-04-11 08:21:34 +02:00
// This derived class additionally sets SELECTABLE(1) and SELECTED(+)
virtual void GetStates( ::utl::AccessibleStateSetHelper& rStateSet ) override;
2002-04-11 12:42:31 +00:00
virtual void InvalidateCursorPos_() override;
2002-04-11 12:42:31 +00:00
virtual ~SwAccessibleCell() override;
2002-04-11 12:42:31 +00:00
public:
tdf#58624 sw: fix ~SwAccessibleContext() use-after-free race As seen in JunitTest_toolkit_unoapi_1: Method doAccessibleAction() finished with state OK LOG> doAccessibleAction(): COMPLETED.OK debug:27272:12: -SwAccessibleParagraph mutexwait 0x3fd9f50 debug:27272:9: SwAccessibleContext::Dispose 0x3872620 11SwRootFrame debug:27272:9: SwAccessibleContext::DisposeChildren 0x4047c80 0x386d600 11SwPageFrame debug:27272:9: SwAccessibleContext::DisposeChildren xAcc 0 debug:27272:9: SwAccessibleContext::DisposeChildren 0x4047c80 0x386cef0 11SwBodyFrame debug:27272:9: SwAccessibleContext::DisposeChildren xAcc 0 debug:27272:9: SwAccessibleContext::DisposeChildren 0x4047c80 0x3878fe0 11SwTextFrame debug:27272:9: SwAccessibleContext::DisposeChildren xAcc 0 debug:27272:9: SwAccessibleMap::RemoveContext erase 0x3872620 debug:27272:9: ~SwAccessibleMap: frame entry 0x3878fe0 debug:27272:9: ~SwAccessibleMap: mpFrameMap 0x3eb64a0 debug:27272:9: ~SwAccessibleMap: mpShapeMap 0 soffice.bin: sw/source/core/access/accmap.cxx:1726: virtual SwAccessibleMap::~SwAccessibleMap(): Assertion `(!mpFrameMap || mpFrameMap->empty()) && "Frame map should be empty after disposing the root frame"' The problem here is that thread 12 is blocked on SolarMutex in ~SwAccessibleParagraph(), while thread 9 is in ~SwAccessibleMap(). This means that in SwAccessibleContext::DisposeChildren(), the WeakReference to the SwAccessibleParagraph cannot create a uno::Reference because its reference count is 0, so SwAccessibleContext::Dispose() is not called on it and it remains in the SwAccessibleMap::mpFrameMap. This triggers the assert and later on ~SwAccessibleContext() would access the deleted SwAccessibleMap and crash. To fix this, introduce a weak reference from SwAccessibleContext to SwAccessibleMap; use a std::weak_ptr because that is not derived from OWeakObject. The weak_ptr is only used in the dtor ~SwAccessibleContext(); as long as the ref-count of SwAccessibleContext is > 0 it is guaranteed that the SwAccessibleContext::m_pMap is either null or valid as the recursive Dispose() will work fine. It is possible that additional temporary owning references could delay the destruction of SwAccessibleMap, and the order of destruction of Writer documents is very fragile, so rely on the SolarMutex lock to prevent that; the only shared_ptr that owns SwAccessibleMap while SolarMutex is not locked is the one in SwViewShellImp. (An alternative fix would be to represent the 3 lifecycle stages of SwAccessibleContext by adding a C++-pointer to the SwAccessibleMap::mpFrameMap, so that DisposeChildren() can, if the WeakReference is no longer valid due to ref-count 0, use the pointer and clear SwAccessibleContext::m_pMap - this and the corresponding call to SwAccessibleMap::RemoveContext() from ~SwAccessibleContext() under a mutex that is shared_ptr-owned by SwAccessibleMap and all SwAccessibleContext.) Change-Id: If2b44c79189e3b3d276491a5c57d5404bb2be71a
2017-03-24 13:04:32 +01:00
SwAccessibleCell(std::shared_ptr<SwAccessibleMap> const& pInitMap,
const SwCellFrame *pCellFrame);
2002-04-11 12:42:31 +00:00
virtual bool HasCursor() override; // required by map to remember that object
2002-04-11 12:42:31 +00:00
// XAccessibleContext
2002-04-11 12:42:31 +00:00
/// Return this object's description.
virtual OUString SAL_CALL
getAccessibleDescription() override;
2002-04-11 12:42:31 +00:00
// XServiceInfo
2002-04-11 12:42:31 +00:00
// Returns an identifier for the implementation of this object.
virtual OUString SAL_CALL
getImplementationName() override;
2002-04-11 12:42:31 +00:00
// Return whether the specified service is supported by this class.
2002-04-11 12:42:31 +00:00
virtual sal_Bool SAL_CALL
supportsService (const OUString& sServiceName) override;
2002-04-11 12:42:31 +00:00
// Returns a list of all supported services. In this case that is just
// the AccessibleContext service.
virtual css::uno::Sequence< OUString> SAL_CALL
getSupportedServiceNames() override;
2002-04-17 13:07:39 +00:00
virtual void Dispose(bool bRecursive, bool bCanSkipInvisible = true) override;
2002-04-17 13:07:39 +00:00
virtual void InvalidatePosOrSize( const SwRect& rFrame ) override;
// XInterface
// (XInterface methods need to be implemented to disambiguate
// between those inherited through SwAccessibleContext and
// XAccessibleValue).
virtual css::uno::Any SAL_CALL queryInterface( const css::uno::Type& aType ) override;
virtual void SAL_CALL acquire( ) throw () override
{ SwAccessibleContext::acquire(); };
virtual void SAL_CALL release( ) throw () override
{ SwAccessibleContext::release(); };
// XTypeProvider
virtual css::uno::Sequence< css::uno::Type > SAL_CALL getTypes( ) override;
virtual css::uno::Sequence< sal_Int8 > SAL_CALL getImplementationId( ) override;
// XAccessibleValue
// XAccessibleExtendedAttributes
css::uno::Any SAL_CALL getExtendedAttributes() override ;
private:
SwFrameFormat* GetTableBoxFormat() const;
public:
virtual css::uno::Any SAL_CALL getCurrentValue( ) override;
virtual sal_Bool SAL_CALL setCurrentValue( const css::uno::Any& aNumber ) override;
virtual css::uno::Any SAL_CALL getMaximumValue( ) override;
virtual css::uno::Any SAL_CALL getMinimumValue( ) override;
// XAccessibleComponent
sal_Int32 SAL_CALL getBackground() override;
// XAccessibleSelection
virtual void SAL_CALL selectAccessibleChild( sal_Int32 nChildIndex ) override;
virtual sal_Bool SAL_CALL isAccessibleChildSelected( sal_Int32 nChildIndex ) override;
virtual void SAL_CALL clearAccessibleSelection( ) override;
virtual void SAL_CALL selectAllAccessibleChildren( ) override;
virtual sal_Int32 SAL_CALL getSelectedAccessibleChildCount( ) override;
virtual css::uno::Reference< css::accessibility::XAccessible > SAL_CALL getSelectedAccessibleChild(
sal_Int32 nSelectedChildIndex ) override;
virtual void SAL_CALL deselectAccessibleChild( sal_Int32 nSelectedChildIndex ) override;
2002-04-11 12:42:31 +00:00
};
#endif
/* vim:set shiftwidth=4 softtabstop=4 expandtab: */