[Libreoffice-commits] core.git: sc/source

[Marco Cecchetti]

 sc/source/ui/app/inputhdl.cxx  |   16 ++++++++--------
 sc/source/ui/view/viewdata.cxx |    7 ++++++-
 2 files changed, 14 insertions(+), 9 deletions(-)

New commits:
commit 3fcd1f80afcf789fbafae2a4360b62111089a5cd
Author: Marco Cecchetti <marco.cecchetti at collabora.com>
Date:   Mon Sep 19 17:21:39 2016 +0200

    Calc: edit engine could be accessed after being destroyed
    
    ScTabView <---------------- ScTabViewShell
    +ScViewData                 +ScInputHandler
       +EditView[4]                +EditEngine
                                    +ImpEditEngine
                                       +vector<pointer<EditView>>
    
    On tab view shell destruction:
    ~ScTabViewShell -> ~ScTabView -> ScViewData::KillEditView ->
    EditEngine::RemoveView
    
    but it occurs after the following:
    ~ScTabViewShell -> ~ScInputHandler -> ~EditEngine
    
    since data members are destroyed before ancestor classes.
    
    Change-Id: Ida56b8009c0d8a3cd23952259d78318e96ae5124
    Reviewed-on: https://gerrit.libreoffice.org/29409
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Marco Cecchetti <mrcekets at gmail.com>

diff --git a/sc/source/ui/app/inputhdl.cxx b/sc/source/ui/app/inputhdl.cxx
index 964896d..d440c69 100644
--- a/sc/source/ui/app/inputhdl.cxx
+++ b/sc/source/ui/app/inputhdl.cxx
@@ -661,14 +661,14 @@ ScInputHandler::~ScInputHandler()
     if ( pInputWin && pInputWin->GetInputHandler() == this )
         pInputWin->SetInputHandler( nullptr );
 
-    delete pRangeFindList;
-    delete pEditDefaults;
-    delete pEngine;
-    delete pLastState;
-    delete pDelayTimer;
-    delete pColumnData;
-    delete pFormulaData;
-    delete pFormulaDataPara;
+    delete pRangeFindList;     pRangeFindList = nullptr;
+    delete pEditDefaults;      pEditDefaults = nullptr;
+    delete pEngine;            pEngine = nullptr;
+    delete pLastState;         pLastState = nullptr;
+    delete pDelayTimer;        pDelayTimer = nullptr;
+    delete pColumnData;        pColumnData = nullptr;
+    delete pFormulaData;       pFormulaData = nullptr;
+    delete pFormulaDataPara;   pFormulaDataPara = nullptr;
 }
 
 void ScInputHandler::SetRefScale( const Fraction& rX, const Fraction& rY )
diff --git a/sc/source/ui/view/viewdata.cxx b/sc/source/ui/view/viewdata.cxx
index c79f53c..240661d 100644
--- a/sc/source/ui/view/viewdata.cxx
+++ b/sc/source/ui/view/viewdata.cxx
@@ -1435,11 +1435,16 @@ void ScViewData::ResetEditView()
 
 void ScViewData::KillEditView()
 {
+    EditEngine* pEngine = nullptr;
     for (sal_uInt16 i=0; i<4; i++)
         if (pEditView[i])
         {
             if (bEditActive[i])
-                pEditView[i]->GetEditEngine()->RemoveView(pEditView[i]);
+            {
+                pEngine = pEditView[i]->GetEditEngine();
+                if (pEngine)
+                    pEngine->RemoveView(pEditView[i]);
+            }
             delete pEditView[i];
             pEditView[i] = nullptr;
         }