[Libreoffice-commits] core.git: sfx2/source

[Thorsten Behrens]

 sfx2/source/doc/sfxbasemodel.cxx |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

New commits:
commit 8bda331afdbdfe42ae519d325014dd4fa9ef9ec2
Author: Thorsten Behrens <Thorsten.Behrens at CIB.de>
Date:   Tue Jan 30 01:58:08 2018 +0100

    tdf#115090 prevent SfxBaseModel destruction during notifications
    
    Additionally ensure refcount stays above sea level while notifying
    clients (who might dispose their own references, causing our own
    refcount to drop to zero). Otherwise, 2nd loop in postEvent_Impl()
    might already operate on freed mem.
    
    Change-Id: Ie06de9ea33f7e2e334e0ef39d13c50009261791e
    Reviewed-on: https://gerrit.libreoffice.org/48871
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Thorsten Behrens <Thorsten.Behrens at CIB.de>

diff --git a/sfx2/source/doc/sfxbasemodel.cxx b/sfx2/source/doc/sfxbasemodel.cxx
index d57fe3435f85..9987acf9b5db 100644
--- a/sfx2/source/doc/sfxbasemodel.cxx
+++ b/sfx2/source/doc/sfxbasemodel.cxx
@@ -3062,9 +3062,12 @@ void SfxBaseModel::postEvent_Impl( const OUString& aName, const Reference< frame
     if ( impl_isDisposed() )
         return;
 
-    // keep m_pData alive, if notified target would close the document
+    // keep m_pData alive, if notified target would dispose the document
     std::shared_ptr<IMPL_SfxBaseModel_DataContainer> pData(m_pData);
 
+    // also make sure this object doesn't self-destruct while notifying
+    rtl::Reference<SfxBaseModel> self(this);
+
     DBG_ASSERT( !aName.isEmpty(), "Empty event name!" );
     if (aName.isEmpty())
         return;