Prevent basctl::PropBrw using basctl::Layout from within ~Layout

...as is reproducible when creating a new dialog via "Tools - Macros - Organize
Dialogs", adding e.g. some date/time controls to it, then closing LO.

Invalid read of size 8
 at 0x23DD58DB: basctl::Layout::SplittedSide::Remove(basctl::DockingWindow*) (/basctl/source/basicide/layout.cxx:205)
 by 0x23DD4F65: basctl::Layout::Remove(basctl::DockingWindow*) (/basctl/source/basicide/layout.cxx:62)
 by 0x23D847B7: basctl::DialogWindowLayout::RemovePropertyBrowser() (/basctl/source/basicide/baside3.cxx:1459)
 by 0x23E45AB3: basctl::PropBrw::~PropBrw() (/basctl/source/dlged/propbrw.cxx:202)
 by 0x23E45BA5: basctl::PropBrw::~PropBrw() (/basctl/source/dlged/propbrw.cxx:205)
 by 0x7E03A49: VCLXDevice::DestroyOutputDevice() (/toolkit/source/awt/vclxdevice.cxx:56)
 by 0x7E4655D: VCLXWindow::dispose() (/toolkit/source/awt/vclxwindow.cxx:956)
 by 0x7FD451C: UnoWrapper::WindowDestroyed(Window*) (/toolkit/source/helper/unowrapper.cxx:263)
 by 0x95EA632: Window::~Window() (/vcl/source/window/window.cxx:4365)
 by 0x23DD4EFD: basctl::Layout::~Layout() (/basctl/source/basicide/layout.cxx:56)
 by 0x23D89E39: basctl::DialogWindowLayout::~DialogWindowLayout() (in /data/lo/core/solver/unxlngx6/installation/opt/program/libbasctllo.so)
 by 0x23D89E69: basctl::DialogWindowLayout::~DialogWindowLayout() (/basctl/source/inc/baside3.hxx:125)
 ...
Address 0x19d17da0 is 0 bytes inside a block of size 80 free'd
 at 0x4A078DE: operator delete(void*) (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
 by 0x23DD92D5: __gnu_cxx::new_allocator<basctl::Layout::SplittedSide::Item>::deallocate(basctl::Layout::SplittedSide::Item*, unsigned long) (/usr/include/c++/4.8.1/ext/new_allocator.h:110)
 by 0x23DD8C77: std::__cxx1998::_Vector_base<basctl::Layout::SplittedSide::Item, std::allocator<basctl::Layout::SplittedSide::Item> >::_M_deallocate(basctl::Layout::SplittedSide::Item*, unsigned long) (/usr/include/c++/4.8.1/bits/stl_vector.h:174)
 by 0x23DD7F89: std::__cxx1998::_Vector_base<basctl::Layout::SplittedSide::Item, std::allocator<basctl::Layout::SplittedSide::Item> >::~_Vector_base() (/usr/include/c++/4.8.1/bits/stl_vector.h:160)
 by 0x23DD73DC: std::__cxx1998::vector<basctl::Layout::SplittedSide::Item, std::allocator<basctl::Layout::SplittedSide::Item> >::~vector() (/usr/include/c++/4.8.1/bits/stl_vector.h:416)
 by 0x23DD6A05: std::__debug::vector<basctl::Layout::SplittedSide::Item, std::allocator<basctl::Layout::SplittedSide::Item> >::~vector() (/usr/include/c++/4.8.1/debug/vector:144)
 by 0x23DD6889: basctl::Layout::SplittedSide::~SplittedSide() (/basctl/source/basicide/layout.hxx:80)
 by 0x23DD4EF1: basctl::Layout::~Layout() (/basctl/source/basicide/layout.cxx:56)
 by 0x23D89E39: basctl::DialogWindowLayout::~DialogWindowLayout() (in /data/lo/core/solver/unxlngx6/installation/opt/program/libbasctllo.so)
 by 0x23D89E69: basctl::DialogWindowLayout::~DialogWindowLayout() (/basctl/source/inc/baside3.hxx:125)
 by 0x23D997F3: void boost::checked_delete<basctl::DialogWindowLayout>(basctl::DialogWindowLayout*) (/workdir/unxlngx6/UnpackedTarball/boost/boost/checked_delete.hpp:34)
 by 0x23D99694: boost::scoped_ptr<basctl::DialogWindowLayout>::~scoped_ptr() (/workdir/unxlngx6/UnpackedTarball/boost/boost/smart_ptr/scoped_ptr.hpp:82)
 by 0x23D9A5E7: basctl::Shell::~Shell() (/basctl/source/basicide/basidesh.cxx:223)
 by 0x23D9A717: basctl::Shell::~Shell() (/basctl/source/basicide/basidesh.cxx:248)
 by 0x6942297: SfxViewFrame::ReleaseObjectShell_Impl() (/sfx2/source/view/viewfrm.cxx:1089)
 by 0x6943BAB: SfxViewFrame::~SfxViewFrame() (/sfx2/source/view/viewfrm.cxx:1484)
 by 0x6943E09: SfxViewFrame::~SfxViewFrame() (/sfx2/source/view/viewfrm.cxx:1505)
 by 0x69427EC: SfxViewFrame::Close() (/sfx2/source/view/viewfrm.cxx:1144)
 by 0x6919441: SfxFrame::DoClose_Impl() (/sfx2/source/view/frame.cxx:175)
 by 0x6934542: SfxBaseController::dispose() (/sfx2/source/view/sfxbasecontroller.cxx:1035)
 by 0x1BC8C5B3: framework::Frame::setComponent(com::sun::star::uno::Reference<com::sun::star::awt::XWindow> const&, com::sun::star::uno::Reference<com::sun::star::frame::XController> const&) (/framework/source/services/frame.cxx:1357)
 by 0x1BBAF54B: framework::CloseDispatcher::implts_establishBackingMode() (/framework/source/dispatch/closedispatcher.cxx:540)
 by 0x1BBAEB15: framework::CloseDispatcher::impl_asyncCallback(void*) (/framework/source/dispatch/closedispatcher.cxx:391)
 by 0x1BBAE6AF: framework::CloseDispatcher::dispatchWithNotification(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XDispatchResultListener> const&) (/framework/source/dispatch/closedispatcher.cxx:228)
 by 0x23A2A71D: framework::DispatchHelper::executeDispatch(com::sun::star::uno::Reference<com::sun::star::frame::XDispatchProvider> const&, rtl::OUString const&, rtl::OUString const&, int, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (/framework/source/services/dispatchhelper.cxx:142)
 by 0x1BC06442: framework::LayoutManager::MenuBarClose(void*) (/framework/source/layoutmanager/layoutmanager.cxx:2638)
 by 0x1BC062F6: framework::LayoutManager::LinkStubMenuBarClose(void*, void*) (/framework/source/layoutmanager/layoutmanager.cxx:2621)
 by 0x9053555: Link::Call(void*) const (/include/tools/link.hxx:123)
 by 0x9610263: ImplHandleUserEvent(ImplSVEvent*) (/vcl/source/window/winproc.cxx:1975)
 by 0x961173A: ImplWindowFrameProc(Window*, SalFrame*, unsigned short, void const*) (/vcl/source/window/winproc.cxx:2590)
 by 0x961FCAE: SalFrame::CallCallback(unsigned short, void const*) const (in /data/lo/core/solver/unxlngx6/installation/opt/program/libvcllo.so)
 by 0x961F74D: SalGenericDisplay::DispatchInternalEvent() (/vcl/generic/app/gendisp.cxx:91)
 by 0x171A5821: GtkData::userEventFn(void*) (/vcl/unx/gtk/app/gtkdata.cxx:933)
 by 0x171A587C: call_userEventFn (/vcl/unx/gtk/app/gtkdata.cxx:943)
 by 0x3B78E47E05: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.3600.3)
 by 0x3B78E48157: ??? (in /usr/lib64/libglib-2.0.so.0.3600.3)
 by 0x3B78E481FB: g_main_context_iteration (in /usr/lib64/libglib-2.0.so.0.3600.3)
 by 0x171A47B0: GtkData::Yield(bool, bool) (/vcl/unx/gtk/app/gtkdata.cxx:574)
 by 0x171A82BD: GtkInstance::Yield(bool, bool) (/vcl/unx/gtk/app/gtkinst.cxx:405)
 by 0x906C838: ImplYield(bool, bool) (/vcl/source/app/svapp.cxx:417)
 by 0x9068F00: Application::Yield() (/vcl/source/app/svapp.cxx:451)
 by 0x9068EB0: Application::Execute() (/vcl/source/app/svapp.cxx:396)
 by 0x4EC6117: desktop::Desktop::Main() (/desktop/source/app/app.cxx:1720)
 by 0x9075192: ImplSVMain() (/vcl/source/app/svmain.cxx:162)
 by 0x907529C: SVMain() (/vcl/source/app/svmain.cxx:198)
 by 0x4F0A9C0: soffice_main (/desktop/source/app/sofficemain.cxx:81)
 by 0x40096B: sal_main (/desktop/source/app/main.c:48)
 by 0x40094C: main (/desktop/source/app/main.c:47)

Change-Id: If7ec0fceec6da1731df8ac389406327fbd95b382
Reviewed-on: https://gerrit.libreoffice.org/5291
Tested-by: Lionel Elie Mamane <lionel@mamane.lu>
Reviewed-by: Lionel Elie Mamane <lionel@mamane.lu>
Reviewed-by: Noel Power <noel.power@suse.com>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

3 files changed, 10 insertions, 14 deletions

diff --git a/basctl/source/basicide/baside3.cxx b/basctl/source/basicide/baside3.cxx
index 2643400dcc01..2d981b65abd2 100644
--- a/basctl/source/basicide/baside3.cxx
+++ b/basctl/source/basicide/baside3.cxx
@@ -1407,6 +1407,15 @@ DialogWindowLayout::DialogWindowLayout (Window* pParent, ObjectCatalog& rObjectC
     ShowPropertyBrowser();
 }
 
+DialogWindowLayout::~DialogWindowLayout()
+{
+    if (pPropertyBrowser != 0)
+    {
+        Remove(pPropertyBrowser);
+        delete pPropertyBrowser;
+    }
+}
+
 // shows the property browser (and creates if necessary)
 void DialogWindowLayout::ShowPropertyBrowser ()
 {
@@ -1443,18 +1452,6 @@ void DialogWindowLayout::UpdatePropertyBrowser ()
         pPropertyBrowser->Update(GetShell());
 }
 
-// Removes the property browser from the layout.
-// Called by PropBrw when closed. It'll destroy itself.
-void DialogWindowLayout::RemovePropertyBrowser ()
-{
-    if (pPropertyBrowser)
-        Remove(pPropertyBrowser);
-    pPropertyBrowser = 0;
-    // refreshing the button state
-    if (SfxBindings* pBindings = GetBindingsPtr())
-        pBindings->Invalidate(SID_SHOW_PROPERTYBROWSER);
-}
-
 void DialogWindowLayout::Activating (BaseWindow& rChild)
 {
     assert(dynamic_cast<DialogWindow*>(&rChild));
diff --git a/basctl/source/dlged/propbrw.cxx b/basctl/source/dlged/propbrw.cxx
index 24ec2d76aa17..f3600ec2810d 100644
--- a/basctl/source/dlged/propbrw.cxx
+++ b/basctl/source/dlged/propbrw.cxx
@@ -199,7 +199,6 @@ PropBrw::~PropBrw()
 {
     if ( m_xBrowserController.is() )
         ImplDestroyController();
-    rLayout.RemovePropertyBrowser();
 
     DBG_DTOR(PropBrw,NULL);
 }
diff --git a/basctl/source/inc/baside3.hxx b/basctl/source/inc/baside3.hxx
index 2b0b476d3259..eaeefdd64b7b 100644
--- a/basctl/source/inc/baside3.hxx
+++ b/basctl/source/inc/baside3.hxx
@@ -126,11 +126,11 @@ class DialogWindowLayout : public Layout
 {
 public:
     DialogWindowLayout (Window* pParent, ObjectCatalog&);
+    ~DialogWindowLayout();
 public:
     void ShowPropertyBrowser ();
     void UpdatePropertyBrowser ();
     void DisablePropertyBrowser ();
-    void RemovePropertyBrowser ();
 public:
     // Layout:
     virtual void Activating (BaseWindow&);