Merging upstream version 4:24.2.4.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

26 files changed, 179 insertions, 67 deletions

diff --git a/vcl/osx/DataFlavorMapping.cxx b/vcl/osx/DataFlavorMapping.cxx
index 361e268bcd..ade3f48dd1 100644
--- a/vcl/osx/DataFlavorMapping.cxx
+++ b/vcl/osx/DataFlavorMapping.cxx
@@ -732,10 +732,7 @@ NSArray* DataFlavorMapper::flavorSequenceToTypesArray(const css::uno::Sequence<c
           const NSString* str = openOfficeToSystemFlavor(flavors[i], bNeedDummyInternalFlavor, bIsSystemClipboard);
 
           if (str != nullptr)
-          {
-              [str retain];
               [array addObject: str];
-          }
       }
   }
 
diff --git a/vcl/osx/a11yactionwrapper.mm b/vcl/osx/a11yactionwrapper.mm
index 9bea25c119..f9c5089a19 100644
--- a/vcl/osx/a11yactionwrapper.mm
+++ b/vcl/osx/a11yactionwrapper.mm
@@ -55,16 +55,22 @@
     NSMutableArray * actionNames = [ [ NSMutableArray alloc ] init ];
     if ( [ wrapper accessibleAction ] ) {
         for ( int cnt = 0; cnt < [ wrapper accessibleAction ] -> getAccessibleActionCount(); cnt++ ) {
-            [ actionNames addObject: [ AquaA11yActionWrapper nativeActionNameFor: CreateNSString ( [ wrapper accessibleAction ] -> getAccessibleActionDescription ( cnt ) ) ] ];
+            // Related tdf#158914: explicitly call autorelease selector
+            // CreateNSString() is not a getter. It expects the caller to
+            // release the returned string.
+            [ actionNames addObject: [ AquaA11yActionWrapper nativeActionNameFor: [ CreateNSString ( [ wrapper accessibleAction ] -> getAccessibleActionDescription ( cnt ) ) autorelease ] ] ];
         }
     }
-    return actionNames;
+    return [actionNames autorelease];
 }
 
 +(void)doAction:(NSString *)action ofElement:(AquaA11yWrapper *)wrapper {
     if ( [ wrapper accessibleAction ] ) {
         for ( int cnt = 0; cnt < [ wrapper accessibleAction ] -> getAccessibleActionCount(); cnt++ ) {
-            if ( [ action isEqualToString: [ AquaA11yActionWrapper nativeActionNameFor: CreateNSString ( [ wrapper accessibleAction ] -> getAccessibleActionDescription ( cnt ) ) ] ] ) {
+            // Related tdf#158914: explicitly call autorelease selector
+            // CreateNSString() is not a getter. It expects the caller to
+            // release the returned string.
+            if ( [ action isEqualToString: [ AquaA11yActionWrapper nativeActionNameFor: [ CreateNSString ( [ wrapper accessibleAction ] -> getAccessibleActionDescription ( cnt ) ) autorelease ] ] ] ) {
                 [ wrapper accessibleAction ] -> doAccessibleAction ( cnt );
                 break;
             }
diff --git a/vcl/osx/a11ycomponentwrapper.mm b/vcl/osx/a11ycomponentwrapper.mm
index d9d6db1754..15363a6687 100644
--- a/vcl/osx/a11ycomponentwrapper.mm
+++ b/vcl/osx/a11ycomponentwrapper.mm
@@ -48,7 +48,10 @@ using namespace ::com::sun::star::uno;
 
 +(id)descriptionAttributeForElement:(AquaA11yWrapper *)wrapper {
     if ( [ wrapper accessibleExtendedComponent ] ) {
-        return CreateNSString ( [ wrapper accessibleExtendedComponent ] -> getToolTipText() );
+        // Related tdf#158914: explicitly call autorelease selector
+        // CreateNSString() is not a getter. It expects the caller to
+        // release the returned string.
+        return [ CreateNSString ( [ wrapper accessibleExtendedComponent ] -> getToolTipText() ) autorelease ];
     } else {
         return nil;
     }
diff --git a/vcl/osx/a11yfactory.mm b/vcl/osx/a11yfactory.mm
index 0783252c7e..27b5ad2d81 100644
--- a/vcl/osx/a11yfactory.mm
+++ b/vcl/osx/a11yfactory.mm
@@ -140,7 +140,6 @@ static bool enabled = false;
         } else {
             aWrapper = [ [ AquaA11yWrapper alloc ] initWithAccessibleContext: rxAccessibleContext ];
         }
-        [ nativeRole release ];
         [ aWrapper setActsAsRadioGroup: asRadioGroup ];
         #if 0
         /* #i102033# NSAccessibility does not seemt to know an equivalent for transient children.
@@ -169,8 +168,8 @@ static bool enabled = false;
     // TODO: when RADIO_BUTTON search for associated RadioGroup-wrapper and delete that as well
     AquaA11yWrapper * theWrapper = [ AquaA11yFactory wrapperForAccessibleContext: rxAccessibleContext createIfNotExists: NO ];
     if ( theWrapper != nil ) {
-        NSAccessibilityPostNotification( theWrapper, NSAccessibilityUIElementDestroyedNotification );
         [ [ AquaA11yFactory allWrapper ] removeObjectForKey: [ AquaA11yFactory keyForAccessibleContext: rxAccessibleContext ] ];
+        [ theWrapper setDisposed ];
         [ theWrapper release ];
     }
 }
diff --git a/vcl/osx/a11yrolehelper.mm b/vcl/osx/a11yrolehelper.mm
index a1cf62f327..5b621a74e2 100644
--- a/vcl/osx/a11yrolehelper.mm
+++ b/vcl/osx/a11yrolehelper.mm
@@ -144,17 +144,14 @@ using namespace ::com::sun::star::uno;
     id nativeRole = [ AquaA11yRoleHelper simpleMapNativeRoleFrom: accessibleContext ];
     if ( accessibleContext -> getAccessibleRole() == AccessibleRole::LABEL ) {
         if ( accessibleContext -> getAccessibleChildCount() > 0 ) {
-            [ nativeRole release ];
             nativeRole = NSAccessibilityOutlineRole;
         } else if ( accessibleContext -> getAccessibleParent().is() ) {
             Reference < XAccessibleContext > rxParentContext = accessibleContext -> getAccessibleParent() -> getAccessibleContext();
             if ( rxParentContext.is() ) {
                 NSString * roleParent = static_cast<NSString *>([ AquaA11yRoleHelper simpleMapNativeRoleFrom: rxParentContext.get() ]);
                 if ( [ roleParent isEqualToString: NSAccessibilityOutlineRole ] ) {
-                    [ nativeRole release ];
                     nativeRole = NSAccessibilityRowRole;
                 }
-                [ roleParent release ];
             }
         }
     } else if ( accessibleContext -> getAccessibleRole() == AccessibleRole::COMBO_BOX ) {
@@ -165,7 +162,6 @@ using namespace ::com::sun::star::uno;
                 if ( rxAccessibleContext.is() && rxAccessibleContext -> getAccessibleRole() == AccessibleRole::TEXT ) {
                     sal_Int64 nStateSet = rxAccessibleContext -> getAccessibleStateSet();
                     if ( !(nStateSet & AccessibleStateType::EDITABLE ) ) {
-                        [ nativeRole release ];
                         nativeRole = NSAccessibilityPopUpButtonRole;
                     }
                 }
diff --git a/vcl/osx/a11yselectionwrapper.mm b/vcl/osx/a11yselectionwrapper.mm
index 9d3beee2d3..4c9d1c7bfc 100644
--- a/vcl/osx/a11yselectionwrapper.mm
+++ b/vcl/osx/a11yselectionwrapper.mm
@@ -34,10 +34,13 @@ using namespace ::com::sun::star::uno;
     Reference< XAccessibleSelection > xAccessibleSelection = [ wrapper accessibleSelection ];
     if( xAccessibleSelection.is() )
     {
-        NSMutableArray * children = [ [ NSMutableArray alloc ] init ];
         try {
             sal_Int64 n = xAccessibleSelection -> getSelectedAccessibleChildCount();
 
+            // Related tdf#158914: implicitly call autorelease selector
+            // Callers expect this selector to return an autoreleased object.
+            NSMutableArray * children = [ NSMutableArray arrayWithCapacity: n ];
+
             // Fix hanging when selecting a column or row in Calc
             // When a Calc column is selected, the child count will be
             // at least a million. Constructing that many C++ Calc objects
@@ -49,7 +52,12 @@ using namespace ::com::sun::star::uno;
                 n = MAXIMUM_ACCESSIBLE_TABLE_CELLS;
 
             for ( sal_Int64 i=0 ; i < n ; ++i ) {
-                [ children addObject: [ AquaA11yFactory wrapperForAccessible: xAccessibleSelection -> getSelectedAccessibleChild( i ) ] ];
+                // Related tdf#158914: explicitly call release selector
+                // [ AquaA11yFactory wrapperForAccessible: ] is not a getter.
+                // It expects the caller to release the returned object.
+                id child_wrapper = [ AquaA11yFactory wrapperForAccessible: xAccessibleSelection -> getSelectedAccessibleChild( i ) ];
+                [ children addObject: child_wrapper ];
+                [ child_wrapper release ];
             }
 
             return children;
diff --git a/vcl/osx/a11ytextattributeswrapper.mm b/vcl/osx/a11ytextattributeswrapper.mm
index 4404dc6463..11b205a803 100644
--- a/vcl/osx/a11ytextattributeswrapper.mm
+++ b/vcl/osx/a11ytextattributeswrapper.mm
@@ -210,7 +210,10 @@ using namespace ::com::sun::star::uno;
             } else if ( property.Name == "CharFontName" ) {
                 OUString fontname;
                 property.Value >>= fontname;
-                [fontDescriptor setName:CreateNSString(fontname)];
+                // Related tdf#158914: explicitly call autorelease selector
+                // CreateNSString() is not a getter. It expects the caller to
+                // release the returned string.
+                [ fontDescriptor setName: [ CreateNSString(fontname) autorelease ] ];
             } else if ( property.Name == "CharWeight" ) {
                 [fontDescriptor setBold:[AquaA11yTextAttributesWrapper convertBoldStyle:property]];
             } else if ( property.Name == "CharPosture" ) {
@@ -313,8 +316,11 @@ using namespace ::com::sun::star::uno;
     int endIndex = loc + len;
     int currentIndex = loc;
     try {
-        NSString * myString = CreateNSString ( [ wrapper accessibleText ] -> getText() ); // TODO: dirty fix for i87817
-        string = [ [ NSMutableAttributedString alloc ] initWithString: CreateNSString ( [ wrapper accessibleText ] -> getTextRange ( loc, loc + len ) ) ];
+        // Related tdf#158914: explicitly call autorelease selector
+        // CreateNSString() is not a getter. It expects the caller to
+        // release the returned string.
+        NSString * myString = [ CreateNSString ( [ wrapper accessibleText ] -> getText() ) autorelease ]; // TODO: dirty fix for i87817
+        string = [ [ NSMutableAttributedString alloc ] initWithString: [ CreateNSString ( [ wrapper accessibleText ] -> getTextRange ( loc, loc + len ) ) autorelease ] ];
         [ string autorelease ];
         if ( [ wrapper accessibleTextAttributes ] && [myString characterAtIndex:0] != 57361) { // TODO: dirty fix for i87817
             [ string beginEditing ];
diff --git a/vcl/osx/a11ytextwrapper.mm b/vcl/osx/a11ytextwrapper.mm
index cfd4ae7c1c..5a932d38a2 100644
--- a/vcl/osx/a11ytextwrapper.mm
+++ b/vcl/osx/a11ytextwrapper.mm
@@ -39,7 +39,10 @@ using namespace ::com::sun::star::uno;
 @implementation AquaA11yTextWrapper : NSObject
 
 +(id)valueAttributeForElement:(AquaA11yWrapper *)wrapper {
-    return CreateNSString ( [ wrapper accessibleText ] -> getText() );
+    // Related tdf#158914: explicitly call autorelease selector
+    // CreateNSString() is not a getter. It expects the caller to
+    // release the returned string.
+    return [ CreateNSString ( [ wrapper accessibleText ] -> getText() ) autorelease ];
 }
 
 +(void)setValueAttributeForElement:(AquaA11yWrapper *)wrapper to:(id)value
@@ -54,7 +57,10 @@ using namespace ::com::sun::star::uno;
 }
 
 +(id)selectedTextAttributeForElement:(AquaA11yWrapper *)wrapper {
-    return CreateNSString ( [ wrapper accessibleText ] -> getSelectedText() );
+    // Related tdf#158914: explicitly call autorelease selector
+    // CreateNSString() is not a getter. It expects the caller to
+    // release the returned string.
+    return [ CreateNSString ( [ wrapper accessibleText ] -> getSelectedText() ) autorelease ];
 }
 
 +(void)setSelectedTextAttributeForElement:(AquaA11yWrapper *)wrapper to:(id)value {
@@ -175,9 +181,12 @@ using namespace ::com::sun::star::uno;
 +(id)stringForRangeAttributeForElement:(AquaA11yWrapper *)wrapper forParameter:(id)range {
     int loc = [ range rangeValue ].location;
     int len = [ range rangeValue ].length;
-    NSMutableString * textRange = [ [ NSMutableString alloc ] init ];
+    NSMutableString * textRange = [ NSMutableString string ];
     try {
-        [ textRange appendString: CreateNSString ( [ wrapper accessibleText ] -> getTextRange ( loc, loc + len ) ) ];
+        // Related tdf#158914: explicitly call autorelease selector
+        // CreateNSString() is not a getter. It expects the caller to
+        // release the returned string.
+        [ textRange appendString: [ CreateNSString ( [ wrapper accessibleText ] -> getTextRange ( loc, loc + len ) ) autorelease ] ];
     } catch ( IndexOutOfBoundsException & ) {
         // empty
     }
diff --git a/vcl/osx/a11ywrapper.mm b/vcl/osx/a11ywrapper.mm
index df1d3690df..9ad6f0d473 100644
--- a/vcl/osx/a11ywrapper.mm
+++ b/vcl/osx/a11ywrapper.mm
@@ -84,10 +84,28 @@ static std::ostream &operator<<(std::ostream &s, NSObject *obj) {
     return self;
 }
 
+-(void)setDisposed {
+    // Related: tdf#148453 Acquire solar mutex during native accessibility calls
+    SolarMutexGuard aGuard;
+
+    mIsDisposed = YES;
+
+    // Release all strong C++ references
+    maReferenceWrapper = ReferenceWrapper();
+
+    // Related tdf@158914 avoid resurrecting object's C++ references
+    // Posting an NSAccessibilityUIElementDestroyedNotification
+    // notification causes [ AquaA11yWrapper isAccessibilityElement ]
+    // to be called on the object so mark the object as disposed
+    // before posting the destroyed notification.
+    NSAccessibilityPostNotification( self, NSAccessibilityUIElementDestroyedNotification );
+}
+
 -(void) setDefaults: (Reference < XAccessibleContext >) rxAccessibleContext {
     mActsAsRadioGroup = NO;
     maReferenceWrapper.rAccessibleContext = rxAccessibleContext;
     mIsTableCell = NO;
+    mIsDisposed = NO;
     // Querying all supported interfaces
     try {
         // XAccessibleComponent
@@ -230,7 +248,6 @@ static std::ostream &operator<<(std::ostream &s, NSObject *obj) {
         if ( ! [ subRole isEqualToString: @"" ] ) {
             return subRole;
         } else {
-            [ subRole release ];
             SAL_WNODEPRECATED_DECLARATIONS_PUSH
                 //TODO: 10.10 accessibilityAttributeValue:
             return [ super accessibilityAttributeValue: NSAccessibilitySubroleAttribute ];
@@ -240,7 +257,10 @@ static std::ostream &operator<<(std::ostream &s, NSObject *obj) {
 }
 
 -(id)titleAttribute {
-    return CreateNSString ( [ self accessibleContext ] -> getAccessibleName() );
+    // Related tdf#158914: explicitly call autorelease selector
+    // CreateNSString() is not a getter. It expects the caller to
+    // release the returned string.
+    return [ CreateNSString ( [ self accessibleContext ] -> getAccessibleName() ) autorelease ];
 }
 
 -(id)descriptionAttribute {
@@ -249,7 +269,10 @@ static std::ostream &operator<<(std::ostream &s, NSObject *obj) {
     } else if ( [ self accessibleExtendedComponent ] ) {
         return [ AquaA11yComponentWrapper descriptionAttributeForElement: self ];
     } else {
-        return CreateNSString ( [ self accessibleContext ] -> getAccessibleDescription() );
+        // Related tdf#158914: explicitly call autorelease selector
+        // CreateNSString() is not a getter. It expects the caller to
+        // release the returned string.
+        return [ CreateNSString ( [ self accessibleContext ] -> getAccessibleDescription() ) autorelease ];
     }
 }
 
@@ -330,14 +353,15 @@ static std::ostream &operator<<(std::ostream &s, NSObject *obj) {
                 }
             }
         }
-        return children;
+        return [children autorelease];
     } else if ( [ self accessibleTable ] )
     {
         AquaA11yTableWrapper* pTable = [self isKindOfClass: [AquaA11yTableWrapper class]] ? static_cast<AquaA11yTableWrapper*>(self) : nil;
         return [ AquaA11yTableWrapper childrenAttributeForElement: pTable ];
     } else {
+        NSMutableArray * children = [ [ NSMutableArray alloc ] init ];
+
         try {
-            NSMutableArray * children = [ [ NSMutableArray alloc ] init ];
             Reference< XAccessibleContext > xContext( [ self accessibleContext ] );
 
             try {
@@ -375,12 +399,13 @@ static std::ostream &operator<<(std::ostream &s, NSObject *obj) {
                 }
             }
 
-            [ children autorelease ];
-            return NSAccessibilityUnignoredChildren( children );
+            return NSAccessibilityUnignoredChildren( [ children autorelease ] );
         } catch (const Exception &) {
             // TODO: Log
-            return nil;
         }
+
+        [ children autorelease ];
+        return [NSArray array];
     }
 }
 
@@ -426,7 +451,10 @@ static std::ostream &operator<<(std::ostream &s, NSObject *obj) {
 }
 
 -(id)helpAttribute {
-    return CreateNSString ( [ self accessibleContext ] -> getAccessibleDescription() );
+    // Related tdf#158914: explicitly call autorelease selector
+    // CreateNSString() is not a getter. It expects the caller to
+    // release the returned string.
+    return [ CreateNSString ( [ self accessibleContext ] -> getAccessibleDescription() ) autorelease ];
 }
 
 -(id)roleDescriptionAttribute {
@@ -450,15 +478,11 @@ static std::ostream &operator<<(std::ostream &s, NSObject *obj) {
         // build string
         NSNumber * nIndex = [ NSNumber numberWithInt: index ];
         NSNumber * nGroupsize = [ NSNumber numberWithInt: [ children count ] ];
-        NSMutableString * value = [ [ NSMutableString alloc ] init ];
+        NSMutableString * value = [ NSMutableString string ];
         [ value appendString: @"radio button " ];
         [ value appendString: [ nIndex stringValue ] ];
         [ value appendString: @" of " ];
         [ value appendString: [ nGroupsize stringValue ] ];
-        // clean up and return string
-        [ nIndex release ];
-        [ nGroupsize release ];
-        [ children release ];
         return value;
     } else {
         return [ AquaA11yRoleHelper getRoleDescriptionFrom:
@@ -643,9 +667,6 @@ static std::ostream &operator<<(std::ostream &s, NSObject *obj) {
                 titleElement = [ AquaA11yFactory wrapperForAccessibleContext: rxAccessible -> getAccessibleContext() ];
             }
         }
-        if ( title ) {
-            [ title release ];
-        }
         return titleElement;
     } else {
         return nil;
@@ -688,6 +709,8 @@ static std::ostream &operator<<(std::ostream &s, NSObject *obj) {
 -(id)accessibilityAttributeValue:(NSString *)attribute {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return nil;
 
     SAL_INFO("vcl.a11y", "[" << self << " accessibilityAttributeValue:" << attribute << "]");
     // #i90575# guard NSAccessibility protocol against unwanted access
@@ -721,13 +744,15 @@ static std::ostream &operator<<(std::ostream &s, NSObject *obj) {
 -(BOOL)accessibilityIsIgnored {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return YES;
 
     SAL_INFO("vcl.a11y", "[" << self << " accessibilityIsIgnored]");
     // #i90575# guard NSAccessibility protocol against unwanted access
     if ( isPopupMenuOpen ) {
         return NO;
     }
-    bool ignored = false;
+    BOOL ignored = false;
     try {
         sal_Int16 nRole = [ self accessibleContext ] -> getAccessibleRole();
         switch ( nRole ) {
@@ -755,6 +780,8 @@ static std::ostream &operator<<(std::ostream &s, NSObject *obj) {
 -(NSArray *)accessibilityAttributeNames {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return nil;
 
     SAL_INFO("vcl.a11y", "[" << self << " accessibilityAttributeNames]");
     // #i90575# guard NSAccessibility protocol against unwanted access
@@ -818,21 +845,9 @@ static std::ostream &operator<<(std::ostream &s, NSObject *obj) {
         if ( [ self accessibleValue ] ) {
             [ AquaA11yValueWrapper addAttributeNamesTo: attributeNames ];
         }
-        if ( nativeSubrole ) {
-            [ nativeSubrole release ];
-        }
-        if ( title ) {
-            [ title release ];
-        }
         // Related: tdf#153374 Don't release autoreleased attributeNames
         return attributeNames;
     } catch ( DisposedException & ) { // Object is no longer available
-        if ( nativeSubrole ) {
-            [ nativeSubrole release ];
-        }
-        if ( title ) {
-            [ title release ];
-        }
         // Related: tdf#153374 Don't release autoreleased attributeNames
         // Also, return an autoreleased empty array instead of a retained array.
         [ AquaA11yFactory removeFromWrapperRepositoryFor: [ self accessibleContext ] ];
@@ -843,6 +858,8 @@ static std::ostream &operator<<(std::ostream &s, NSObject *obj) {
 -(BOOL)accessibilityIsAttributeSettable:(NSString *)attribute {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return NO;
 
     SAL_INFO("vcl.a11y", "[" << self << " accessibilityAttributeIsSettable:" << attribute << "]");
     bool isSettable = false;
@@ -864,6 +881,8 @@ static std::ostream &operator<<(std::ostream &s, NSObject *obj) {
 -(NSArray *)accessibilityParameterizedAttributeNames {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return [ NSArray array ];
 
     SAL_INFO("vcl.a11y", "[" << self << " accessibilityParameterizedAttributeNames]");
     NSMutableArray * attributeNames = [ NSMutableArray array ];
@@ -877,6 +896,8 @@ static std::ostream &operator<<(std::ostream &s, NSObject *obj) {
 -(id)accessibilityAttributeValue:(NSString *)attribute forParameter:(id)parameter {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return nil;
 
     SAL_INFO("vcl.a11y", "[" << self << " accessibilityAttributeValue:" << attribute << " forParameter:" << (static_cast<NSObject*>(parameter)) << "]");
     SEL methodSelector = [ self selectorForAttribute: attribute asGetter: YES withGetterParameter: YES ];
@@ -903,6 +924,8 @@ static std::ostream &operator<<(std::ostream &s, NSObject *obj) {
 -(void)accessibilitySetValue:(id)value forAttribute:(NSString *)attribute {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return;
 
     SAL_INFO("vcl.a11y", "[" << self << " accessibilitySetValue:" << (static_cast<NSObject*>(value)) << " forAttribute:" << attribute << "]");
     SEL methodSelector = [ self selectorForAttribute: attribute asGetter: NO withGetterParameter: NO ];
@@ -923,6 +946,8 @@ static std::ostream &operator<<(std::ostream &s, NSObject *obj) {
 -(id)accessibilityFocusedUIElement {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return nil;
 
     SAL_INFO("vcl.a11y", "[" << self << " accessibilityFocusedUIElement]");
     // #i90575# guard NSAccessibility protocol against unwanted access
@@ -977,9 +1002,6 @@ static std::ostream &operator<<(std::ostream &s, NSObject *obj) {
     } else if ( enabled && [ self accessibleAction ] ) {
         wrapper = self ;
     }
-    [ parentRole release ];
-    [ enabledAttr release ];
-    [ role release ];
     return wrapper;
 }
 
@@ -990,6 +1012,8 @@ static std::ostream &operator<<(std::ostream &s, NSObject *obj) {
 -(BOOL)performAction:(NSString *)action {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return NO;
 
     SAL_INFO("vcl.a11y", "[" << self << " accessibilityPerformAction:" << action << "]");
     AquaA11yWrapper * actionResponder = [ self actionResponder ];
@@ -1003,6 +1027,8 @@ static std::ostream &operator<<(std::ostream &s, NSObject *obj) {
 -(NSArray *)accessibilityActionNames {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return nil;
 
     SAL_INFO("vcl.a11y", "[" << self << " accessibilityActionNames]");
     NSArray * actionNames = nil;
@@ -1010,7 +1036,7 @@ static std::ostream &operator<<(std::ostream &s, NSObject *obj) {
     if ( actionResponder ) {
         actionNames = [ AquaA11yActionWrapper actionNamesForElement: actionResponder ];
     } else {
-        actionNames = [ [ NSArray alloc ] init ];
+        actionNames = [ NSArray array ];
     }
     return actionNames;
 }
@@ -1097,13 +1123,10 @@ static Reference < XAccessibleContext > hitTestRunner ( css::awt::Point point,
 -(id)accessibilityHitTest:(NSPoint)point {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return nil;
 
     SAL_INFO("vcl.a11y", "[" << self << " accessibilityHitTest:" << point << "]");
-    static id wrapper = nil;
-    if ( nil != wrapper ) {
-        [ wrapper release ];
-        wrapper = nil;
-    }
     Reference < XAccessibleContext > hitChild;
     NSRect screenRect = [ [ NSScreen mainScreen ] frame ];
     css::awt::Point hitPoint ( static_cast<sal_Int32>(point.x) , static_cast<sal_Int32>(screenRect.size.height - point.y) );
@@ -1141,12 +1164,16 @@ static Reference < XAccessibleContext > hitTestRunner ( css::awt::Point point,
         hitChild = hitTestRunner ( hitPoint, maReferenceWrapper.rAccessibleContext );
     }
     if ( hitChild.is() ) {
-        wrapper = [ AquaA11yFactory wrapperForAccessibleContext: hitChild ];
-    }
-    if ( wrapper ) {
-        [ wrapper retain ]; // TODO: retain only when transient ?
+        // Related tdf#158914: do not retain wrapper
+        // [ AquaA11yFactory wrapperForAccessibleContext: ] already retains
+        // the returned object so retaining it until the next call to this
+        // selector can lead to a memory leak when dragging selected cells
+        // in Calc to a new location. So autorelease the object so that
+        // transient objects stay alive but not past the next clearing of
+        // the autorelease pool.
+        return [ [ AquaA11yFactory wrapperForAccessibleContext: hitChild ] autorelease ];
     }
-    return wrapper;
+    return nil;
 }
 
 #pragma mark -
@@ -1548,6 +1575,8 @@ static Reference < XAccessibleContext > hitTestRunner ( css::awt::Point point,
 {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return NSZeroRect;
 
     try {
         XAccessibleComponent *pAccessibleComponent = [ self accessibleComponent ];
@@ -1578,6 +1607,11 @@ static Reference < XAccessibleContext > hitTestRunner ( css::awt::Point point,
     // don't explicitly report (non-)expanded state when not expandable
     if (aSelector == @selector(isAccessibilityExpanded))
     {
+        // Acquire solar mutex during native accessibility calls
+        SolarMutexGuard aGuard;
+        if ( mIsDisposed )
+            return NO;
+
         const sal_Int64 nStateSet = [ self accessibleContext ] -> getAccessibleStateSet();
         if (!( nStateSet & AccessibleStateType::EXPANDABLE))
             return false;
diff --git a/vcl/osx/a11ywrapperbutton.mm b/vcl/osx/a11ywrapperbutton.mm
index a2c0d0398f..d988e0b644 100644
--- a/vcl/osx/a11ywrapperbutton.mm
+++ b/vcl/osx/a11ywrapperbutton.mm
@@ -39,6 +39,8 @@
 -(NSArray *)accessibilityAttributeNames {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return [ NSArray array ];
 
     // Default Attributes
     NSMutableArray * attributeNames = [ NSMutableArray arrayWithArray: [ super accessibilityAttributeNames ] ];
diff --git a/vcl/osx/a11ywrappercheckbox.mm b/vcl/osx/a11ywrappercheckbox.mm
index 9e0f221985..7f78e68de8 100644
--- a/vcl/osx/a11ywrappercheckbox.mm
+++ b/vcl/osx/a11ywrappercheckbox.mm
@@ -39,6 +39,8 @@
 -(BOOL)accessibilityIsAttributeSettable:(NSString *)attribute {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return NO;
 
     if ( [ attribute isEqualToString: NSAccessibilityValueAttribute ] ) {
         return NO;
@@ -49,6 +51,8 @@
 -(NSArray *)accessibilityAttributeNames {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return [ NSArray array ];
 
     // Default Attributes
     NSMutableArray * attributeNames = [ NSMutableArray arrayWithArray: [ super accessibilityAttributeNames ] ];
diff --git a/vcl/osx/a11ywrappercombobox.mm b/vcl/osx/a11ywrappercombobox.mm
index bfcef7275e..d9a0727d9d 100644
--- a/vcl/osx/a11ywrappercombobox.mm
+++ b/vcl/osx/a11ywrappercombobox.mm
@@ -113,6 +113,8 @@ using namespace ::com::sun::star::uno;
 -(BOOL)accessibilityIsAttributeSettable:(NSString *)attribute {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return NO;
 
     if ( [ self textArea ] != nil && (
          [ attribute isEqualToString: NSAccessibilitySelectedTextAttribute ]
@@ -126,6 +128,8 @@ using namespace ::com::sun::star::uno;
 -(void)accessibilitySetValue:(id)value forAttribute:(NSString *)attribute {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return;
 
     if ( [ self textArea ] != nil && (
          [ attribute isEqualToString: NSAccessibilitySelectedTextAttribute ]
@@ -139,6 +143,8 @@ using namespace ::com::sun::star::uno;
 -(NSArray *)accessibilityAttributeNames {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return [ NSArray array ];
 
     // Default Attributes
     NSMutableArray * attributeNames = [ NSMutableArray arrayWithArray: [ super accessibilityAttributeNames ] ];
diff --git a/vcl/osx/a11ywrappergroup.mm b/vcl/osx/a11ywrappergroup.mm
index 7ed70d47ba..f50d23677f 100644
--- a/vcl/osx/a11ywrappergroup.mm
+++ b/vcl/osx/a11ywrappergroup.mm
@@ -33,6 +33,8 @@
 -(NSArray *)accessibilityAttributeNames {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return [ NSArray array ];
 
     // Default Attributes
     NSMutableArray * attributeNames = [ NSMutableArray arrayWithArray: [ super accessibilityAttributeNames ] ];
diff --git a/vcl/osx/a11ywrapperlist.mm b/vcl/osx/a11ywrapperlist.mm
index 25b3fa37ac..e1c3f4f090 100644
--- a/vcl/osx/a11ywrapperlist.mm
+++ b/vcl/osx/a11ywrapperlist.mm
@@ -31,6 +31,8 @@ using namespace ::com::sun::star::accessibility;
 -(NSArray *)accessibilityAttributeNames {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return [ NSArray array ];
 
     // Default Attributes
     NSMutableArray * attributeNames = [ NSMutableArray arrayWithArray: [ super accessibilityAttributeNames ] ];
diff --git a/vcl/osx/a11ywrapperradiobutton.mm b/vcl/osx/a11ywrapperradiobutton.mm
index 5022cc18c2..bd2d8bde68 100644
--- a/vcl/osx/a11ywrapperradiobutton.mm
+++ b/vcl/osx/a11ywrapperradiobutton.mm
@@ -38,6 +38,8 @@
 -(BOOL)accessibilityIsAttributeSettable:(NSString *)attribute {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return NO;
 
     if ( [ attribute isEqualToString: NSAccessibilityValueAttribute ] ) {
         return NO;
@@ -48,6 +50,8 @@
 -(NSArray *)accessibilityAttributeNames {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return [ NSArray array ];
 
     // Default Attributes
     NSMutableArray * attributeNames = [ NSMutableArray arrayWithArray: [ super accessibilityAttributeNames ] ];
diff --git a/vcl/osx/a11ywrapperradiogroup.mm b/vcl/osx/a11ywrapperradiogroup.mm
index 9768dbbb69..0896439400 100644
--- a/vcl/osx/a11ywrapperradiogroup.mm
+++ b/vcl/osx/a11ywrapperradiogroup.mm
@@ -30,6 +30,8 @@
 -(NSArray *)accessibilityAttributeNames {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return [ NSArray array ];
 
     // Default Attributes
     NSMutableArray * attributeNames = [ NSMutableArray arrayWithArray: [ super accessibilityAttributeNames ] ];
diff --git a/vcl/osx/a11ywrapperrow.mm b/vcl/osx/a11ywrapperrow.mm
index 0c140c82c6..a00e210ad2 100644
--- a/vcl/osx/a11ywrapperrow.mm
+++ b/vcl/osx/a11ywrapperrow.mm
@@ -36,6 +36,8 @@
 -(NSArray *)accessibilityAttributeNames {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return [ NSArray array ];
 
     // Default Attributes
     NSMutableArray * attributeNames = [ NSMutableArray arrayWithArray: [ super accessibilityAttributeNames ] ];
diff --git a/vcl/osx/a11ywrapperscrollarea.mm b/vcl/osx/a11ywrapperscrollarea.mm
index 22037220d4..4fa30a9f04 100644
--- a/vcl/osx/a11ywrapperscrollarea.mm
+++ b/vcl/osx/a11ywrapperscrollarea.mm
@@ -62,6 +62,8 @@
 -(NSArray *)accessibilityAttributeNames {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return [ NSArray array ];
 
     // Default Attributes
     NSMutableArray * attributeNames = [ NSMutableArray arrayWithArray: [ super accessibilityAttributeNames ] ];
diff --git a/vcl/osx/a11ywrapperscrollbar.mm b/vcl/osx/a11ywrapperscrollbar.mm
index 4a4612d3bb..8117e391ba 100644
--- a/vcl/osx/a11ywrapperscrollbar.mm
+++ b/vcl/osx/a11ywrapperscrollbar.mm
@@ -34,6 +34,8 @@ using namespace ::com::sun::star::accessibility;
 -(NSArray *)accessibilityAttributeNames {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return [ NSArray array ];
 
     // Default Attributes
     NSMutableArray * attributeNames = [ NSMutableArray arrayWithArray: [ super accessibilityAttributeNames ] ];
diff --git a/vcl/osx/a11ywrappersplitter.mm b/vcl/osx/a11ywrappersplitter.mm
index 39ec496af2..993d8a0204 100644
--- a/vcl/osx/a11ywrappersplitter.mm
+++ b/vcl/osx/a11ywrappersplitter.mm
@@ -31,6 +31,8 @@ using namespace ::com::sun::star::accessibility;
 -(NSArray *)accessibilityAttributeNames {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return [ NSArray array ];
 
     // Default Attributes
     NSMutableArray * attributeNames = [ NSMutableArray arrayWithArray: [ super accessibilityAttributeNames ] ];
diff --git a/vcl/osx/a11ywrapperstatictext.mm b/vcl/osx/a11ywrapperstatictext.mm
index 114c4179e8..317de60ee8 100644
--- a/vcl/osx/a11ywrapperstatictext.mm
+++ b/vcl/osx/a11ywrapperstatictext.mm
@@ -37,6 +37,8 @@
 -(NSArray *)accessibilityAttributeNames {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return [ NSArray array ];
 
     // Default Attributes
     NSMutableArray * attributeNames = [ NSMutableArray arrayWithArray: [ super accessibilityAttributeNames ] ];
diff --git a/vcl/osx/a11ywrappertabgroup.mm b/vcl/osx/a11ywrappertabgroup.mm
index 3d32ccc041..de484a5994 100644
--- a/vcl/osx/a11ywrappertabgroup.mm
+++ b/vcl/osx/a11ywrappertabgroup.mm
@@ -29,6 +29,8 @@
 -(NSArray *)accessibilityAttributeNames {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return [ NSArray array ];
 
     // Default Attributes
     NSMutableArray * attributeNames = [ NSMutableArray arrayWithArray: [ super accessibilityAttributeNames ] ];
diff --git a/vcl/osx/a11ywrappertextarea.mm b/vcl/osx/a11ywrappertextarea.mm
index 354030fb9a..a53550f084 100644
--- a/vcl/osx/a11ywrappertextarea.mm
+++ b/vcl/osx/a11ywrappertextarea.mm
@@ -29,6 +29,8 @@
 -(NSArray *)accessibilityAttributeNames {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return [ NSArray array ];
 
     // Default Attributes
     NSMutableArray * attributeNames = [ NSMutableArray arrayWithArray: [ super accessibilityAttributeNames ] ];
diff --git a/vcl/osx/a11ywrappertoolbar.mm b/vcl/osx/a11ywrappertoolbar.mm
index 28b5d01328..e2d0ec5a2a 100644
--- a/vcl/osx/a11ywrappertoolbar.mm
+++ b/vcl/osx/a11ywrappertoolbar.mm
@@ -29,6 +29,8 @@
 -(NSArray *)accessibilityAttributeNames {
     // Related: tdf#148453 Acquire solar mutex during native accessibility calls
     SolarMutexGuard aGuard;
+    if ( mIsDisposed )
+        return [ NSArray array ];
 
     // Default Attributes
     NSMutableArray * attributeNames = [ NSMutableArray arrayWithArray: [ super accessibilityAttributeNames ] ];
diff --git a/vcl/osx/salinst.cxx b/vcl/osx/salinst.cxx
index 7f755bb618..33101c8d1b 100644
--- a/vcl/osx/salinst.cxx
+++ b/vcl/osx/salinst.cxx
@@ -750,7 +750,22 @@ bool AquaSalInstance::AnyInput( VclInputFlags nType )
         // not NSEventTypeScrollWheel.
         NSEvent* pCurrentEvent = [NSApp currentEvent];
         if( pCurrentEvent && [pCurrentEvent type] == NSEventTypeScrollWheel )
-            nEventMask &= ~NSEventMaskScrollWheel;
+        {
+            // tdf#160767 skip fix for tdf#155266 when the event hasn't changed
+            // When scrolling in Writer with automatic spellchecking enabled,
+            // the current event never changes because the fix for tdf#155266
+            // causes Writer to get stuck in a loop. So, if the current event
+            // has not changed since the last pass through this code, skip
+            // the fix for tdf#155266.
+            static NSEvent *pLastCurrentEvent = nil;
+            if( pLastCurrentEvent != pCurrentEvent )
+            {
+                if( pLastCurrentEvent )
+                    [pLastCurrentEvent release];
+                pLastCurrentEvent = [pCurrentEvent retain];
+                nEventMask &= ~NSEventMaskScrollWheel;
+            }
+        }
     }
 
     if( nType & VclInputFlags::KEYBOARD)
diff --git a/vcl/osx/salmenu.cxx b/vcl/osx/salmenu.cxx
index 6ea16a6588..800affc060 100644
--- a/vcl/osx/salmenu.cxx
+++ b/vcl/osx/salmenu.cxx
@@ -163,6 +163,7 @@ static void initAppMenu()
     pNewItem = [pAppMenu addItemWithTitle: pString
         action: nil
         keyEquivalent: @""];
+    [pString release];
     NSMenu *servicesMenu = [[[NSMenu alloc] initWithTitle:@"Services"] autorelease];
     [pNewItem setSubmenu: servicesMenu];
     [NSApp setServicesMenu: servicesMenu];