[Libreoffice-commits] .: sfx2/source

[Kohei Yoshida]

 sfx2/source/control/unoctitm.cxx |   14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

New commits:
commit f6d9b4afbda6cf1a3db822b5fb5125448ef9e1d1
Author: Kohei Yoshida <kohei.yoshida at gmail.com>
Date:   Thu May 24 11:40:46 2012 -0400

    Delete SfxItemSet before the current shell gets destroyed.
    
    SfxItemSet takes hold of the SfxItemPool instance from the current
    shell, and accesses it when it gets destroyed.  The problem arises
    when the current shell gets destroyed before the SfxItemSet instnace
    does, in which case an illegal memory access ensues.
    
    This fixes intermittent crashes when opening a document in Writer.
    
    Change-Id: Ib5e74b43051f868f22f6efdb311e6c2a75326d9a

diff --git a/sfx2/source/control/unoctitm.cxx b/sfx2/source/control/unoctitm.cxx
index 005db6e..360590f 100644
--- a/sfx2/source/control/unoctitm.cxx
+++ b/sfx2/source/control/unoctitm.cxx
@@ -67,6 +67,8 @@
 #include <sfx2/msgpool.hxx>
 #include <sfx2/objsh.hxx>
 
+#include <boost/scoped_ptr.hpp>
+
 namespace css = ::com::sun::star;
 using namespace ::com::sun::star::uno;
 using namespace ::com::sun::star::util;
@@ -725,16 +727,20 @@ void SAL_CALL SfxDispatchController_Impl::dispatch( const ::com::sun::star::util
                     }
 
                     eMapUnit = GetCoreMetric( pShell->GetPool(), GetId() );
-                    SfxAllItemSet aSet( pShell->GetPool() );
-                    TransformParameters( GetId(), lNewArgs, aSet, pSlot );
-                    if ( aSet.Count() )
+                    boost::scoped_ptr<SfxAllItemSet> xSet(new SfxAllItemSet(pShell->GetPool()));
+                    TransformParameters(GetId(), lNewArgs, *xSet, pSlot);
+                    if (xSet->Count())
                     {
                         // execute with arguments - call directly
-                        pItem = pDispatcher->Execute( GetId(), nCall, &aSet, &aInternalSet, nModifier );
+                        pItem = pDispatcher->Execute(GetId(), nCall, xSet.get(), &aInternalSet, nModifier);
                         bSuccess = (pItem != NULL);
                     }
                     else
                     {
+                        // Be sure to delete this before we send a dispatch
+                        // request, which will destroy the current shell.
+                        xSet.reset();
+
                         // execute using bindings, enables support for toggle/enum etc.
                         SfxRequest aReq( GetId(), nCall, pShell->GetPool() );
                         aReq.SetModifier( nModifier );