stack:
UAccCOM.dll!ATL::CComObjectRootBase::OuterAddRef() Line 2631
UAccCOM.dll!ATL::CComContainedObject<CAccImage>::AddRef() Line 3719
AccEventCache.dll!00007ffd2039be28()
AccEventCache.dll!00007ffd20355677()
AccEventCache.dll!00007ffd20346d41()
AccEventCache.dll!00007ffd20347f9a()
AccEventCache.dll!00007ffd20338ba2()
AccEventCache.dll!00007ffd20380dd8()
AccEventCache.dll!00007ffd2037fd7b()
AccEventCache.dll!00007ffd2037f7ee()
AccEventCache.dll!00007ffd2037d9e6()
AccEventCache.dll!00007ffd2037d07f()
^ JAWS
GlobalHooksDispatcher.dll!00007ffd214daed4()
GlobalHooksDispatcher.dll!00007ffd214d8d84()
user32.dll!00007ffd492068ac()
ntdll.dll!00007ffd4ae71424()
win32u.dll!NtUserNotifyWinEvent()
winaccessibility.dll!AccObjectWinManager::NotifyAccEvent(com::sun::star::accessibility::XAccessible * pXAcc, UnoMSAAEvent eEvent) Line 182
^ selfAccObj looks very dead here but that is a red herring!
winaccessibility.dll!AccContainerEventListener::FireStateFocusedChange(bool enable) Line 351
winaccessibility.dll!AccContainerEventListener::SetComponentState(__int64 state, bool enable) Line 178
winaccessibility.dll!AccParagraphEventListener::SetComponentState(__int64 state, bool enable) Line 123
winaccessibility.dll!AccContainerEventListener::HandleStateChangedEvent(com::sun::star::uno::Any oldValue, com::sun::star::uno::Any newValue) Line 106
winaccessibility.dll!AccContainerEventListener::notifyEvent(const com::sun::star::accessibility::AccessibleEventObject & aEvent) Line 72
winaccessibility.dll!AccParagraphEventListener::notifyEvent(const com::sun::star::accessibility::AccessibleEventObject & aEvent) Line 77
comphelper.dll!comphelper::AccessibleEventNotifier::addEvent(const unsigned long _nClient, const com::sun::star::accessibility::AccessibleEventObject & _rEvent) Line 256
swlo.dll!SwAccessibleContext::FireAccessibleEvent(com::sun::star::accessibility::AccessibleEventObject & rEvent) Line 457
swlo.dll!SwAccessibleContext::FireStateChangedEvent(__int64 nState, bool bNewState) Line 478
swlo.dll!SwAccessibleParagraph::InvalidateFocus_() Line 397
swlo.dll!SwAccessibleContext::InvalidateFocus() Line 1314
swlo.dll!SwAccessibleMap::InvalidateFocus() Line 2695
swlo.dll!SwViewShell::InvalidateAccessibleFocus() Line 2597
swlo.dll!SwEditWin::GetFocus() Line 5569
vcllo.dll!vcl::Window::CompatGetFocus() Line 3891
vcllo.dll!vcl::Window::ImplGrabFocus(GetFocusFlags nFlags) Line 385
vcllo.dll!vcl::Window::GrabFocus() Line 2983
sfxlo.dll!SfxFrame::GrabFocusOnComponent_Impl() Line 650
The problem is quite simply that CMAccessible::SmartQI() returns a
pointer that is the result of querying the newly created COM aggregation
for IID_IUnknown instead of the requested `iid` interface.
Apparently the wrong result happens to work in many cases, but the
CAccTable actually has 2 interfaces IAccessibleTable and
IAccessibleTable2, and the COM aggravation for IAccessibleTable2 is the
one that crashes; in this case the correct pointer is an offset of 8 to
the start of CAccTable, while in the working cases there is no offset.
So likely the bug was introduced by commits
3b86569fcb and
d0e8e6e3cd but only started to crash with
839dbf9ecf.
Change-Id: I7c7d295c8032b95fe7f64b8da4dd9bc3212563f9
(cherry picked from commit 9502a9f76731afa0f5105e6d79b069222677f88d)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/194730
Reviewed-by: Michael Stahl <michael.stahl@collabora.com>
Tested-by: Jenkins
Michael Stahl
b2c03ef9c7