[Libreoffice-commits] core.git: Branch 'libreoffice-6-0' - include/sfx2 sfx2/source

[Thorsten Behrens]

 include/sfx2/sfxbasemodel.hxx    |    2 +-
 sfx2/source/doc/sfxbasemodel.cxx |    6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

New commits:
commit b16a0ffce51df1af9fb0656ec07ca1e643f8edfa
Author: Thorsten Behrens <Thorsten.Behrens at CIB.de>
Date:   Fri Jan 26 16:13:23 2018 +0100

    tdf#115090 keep internal BaseModel alive long enough
    
    There's reams of code already preventing a close during save
    (SfxSaveGuard), but this looks equally effective. Avoids
    SfxBaseModel::dispose() pulling the rug under us, when
    SfxBaseModel::postEvent_Impl() wants to access parts of the
    interface containers during notification.
    
    Plus this one:
    
    tdf#115090 prevent SfxBaseModel destruction during notifications
    
    Additionally ensure refcount stays above sea level while notifying
    clients (who might dispose their own references, causing our own
    refcount to drop to zero). Otherwise, 2nd loop in postEvent_Impl()
    might already operate on freed mem.
    
    Reviewed-on: https://gerrit.libreoffice.org/48871
    
    Change-Id: Iace1f9922c47a97ab2e798b577c6aec8a729da48
    Reviewed-on: https://gerrit.libreoffice.org/48709
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Thorsten Behrens <Thorsten.Behrens at CIB.de>
    (cherry picked from commit 1841fcf896f50b7df1375d431857ecddd5f5b392)
    Reviewed-on: https://gerrit.libreoffice.org/48762
    Reviewed-by: Michael Stahl <mstahl at redhat.com>

diff --git a/include/sfx2/sfxbasemodel.hxx b/include/sfx2/sfxbasemodel.hxx
index e721a77e35f4..03ee06484869 100644
--- a/include/sfx2/sfxbasemodel.hxx
+++ b/include/sfx2/sfxbasemodel.hxx
@@ -738,7 +738,7 @@ private:
 
 private:
 
-    std::unique_ptr<IMPL_SfxBaseModel_DataContainer> m_pData;
+    std::shared_ptr<IMPL_SfxBaseModel_DataContainer> m_pData;
     // cannot be held in m_pData, since it needs to be accessed in non-threadsafe context
     const bool                          m_bSupportEmbeddedScripts;
     const bool                          m_bSupportDocRecovery;
diff --git a/sfx2/source/doc/sfxbasemodel.cxx b/sfx2/source/doc/sfxbasemodel.cxx
index 2403ca27d212..7cb1076485a5 100644
--- a/sfx2/source/doc/sfxbasemodel.cxx
+++ b/sfx2/source/doc/sfxbasemodel.cxx
@@ -3058,6 +3058,12 @@ void SfxBaseModel::postEvent_Impl( const OUString& aName, const Reference< frame
     if ( impl_isDisposed() )
         return;
 
+    // keep m_pData alive, if notified target would dispose the document
+    std::shared_ptr<IMPL_SfxBaseModel_DataContainer> pData(m_pData);
+
+    // also make sure this object doesn't self-destruct while notifying
+    rtl::Reference<SfxBaseModel> self(this);
+
     DBG_ASSERT( !aName.isEmpty(), "Empty event name!" );
     if (aName.isEmpty())
         return;