[Libreoffice-commits] core.git: vcl/source

[Caolán McNamara]

 vcl/source/window/event.cxx |   22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

New commits:
commit 027c836915deadc901920d84b2718f9617caea0e
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon May 23 10:59:27 2016 +0100

    Resolves: rhbz#1338546 use-after-delete of WindowImpl
    
    Change-Id: I528aacd042ff17e6f6cdcd434d1c790b2139928e

diff --git a/vcl/source/window/event.cxx b/vcl/source/window/event.cxx
index c7d1777..aa09c10 100644
--- a/vcl/source/window/event.cxx
+++ b/vcl/source/window/event.cxx
@@ -220,11 +220,14 @@ void Window::CallEventListeners( sal_uLong nEvent, void* pData )
         mpWindowImpl->mnEventListenersIteratingCount++;
         auto& rWindowImpl = *mpWindowImpl;
         comphelper::ScopeGuard aGuard(
-            [&rWindowImpl]()
+            [&rWindowImpl, &xWindow]()
             {
-                rWindowImpl.mnEventListenersIteratingCount--;
-                if (rWindowImpl.mnEventListenersIteratingCount == 0)
-                    rWindowImpl.maEventListenersDeleted.clear();
+                if (!xWindow->IsDisposed())
+                {
+                    rWindowImpl.mnEventListenersIteratingCount--;
+                    if (rWindowImpl.mnEventListenersIteratingCount == 0)
+                        rWindowImpl.maEventListenersDeleted.clear();
+                }
             }
         );
         for ( Link<VclWindowEvent&,void>& rLink : aCopy )
@@ -250,11 +253,14 @@ void Window::CallEventListeners( sal_uLong nEvent, void* pData )
             // we use an iterating counter/flag and a set of deleted Link's to avoid O(n^2) behaviour
             rWindowImpl.mnChildEventListenersIteratingCount++;
             comphelper::ScopeGuard aGuard(
-                [&rWindowImpl]()
+                [&rWindowImpl, &xWindow]()
                 {
-                    rWindowImpl.mnChildEventListenersIteratingCount--;
-                    if (rWindowImpl.mnChildEventListenersIteratingCount == 0)
-                        rWindowImpl.maChildEventListenersDeleted.clear();
+                    if (!xWindow->IsDisposed())
+                    {
+                        rWindowImpl.mnChildEventListenersIteratingCount--;
+                        if (rWindowImpl.mnChildEventListenersIteratingCount == 0)
+                            rWindowImpl.maChildEventListenersDeleted.clear();
+                    }
                 }
             );
             for ( Link<VclWindowEvent&,void>& rLink : aCopy )