Resolves: tdf#100574 Crash when selecting and applying border style...

when a first torn off instance was opened just before the second one
and then the second one sends focus back to the first when its popped
down.

The second one listens to losing the focus and disposes itself which leads to
dereferencing deleted stuff.

So add a reference count to the places these tear offs call popdown so its
still gets disposed but not deleted during the popdown and then protect against
members being disposed with a enough checks to get back to safely

Change-Id: Id5f8eb4771df36305e308a2a9a5035018948f121
(cherry picked from commit 886637d355e77cd61d85279f145c06b07385fecd)
Reviewed-on: https://gerrit.libreoffice.org/26751
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
(cherry picked from commit 521175906ba9516242968390b71d43edd447d480)
Reviewed-on: https://gerrit.libreoffice.org/27030
Tested-by: Caolán McNamara <caolanm@redhat.com>
Reviewed-by: Eike Rathke <erack@redhat.com>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>

2 files changed, 20 insertions, 5 deletions

diff --git a/svx/source/tbxctrls/tbcontrl.cxx b/svx/source/tbxctrls/tbcontrl.cxx
index 49da834f9227..17a4f3ff0b8a 100644
--- a/svx/source/tbxctrls/tbcontrl.cxx
+++ b/svx/source/tbxctrls/tbcontrl.cxx
@@ -1382,6 +1382,8 @@ void SvxColorWindow_Impl::KeyInput( const KeyEvent& rKEvt )
 
 IMPL_LINK_TYPED(SvxColorWindow_Impl, SelectHdl, ValueSet*, pColorSet, void)
 {
+    VclPtr<SvxColorWindow_Impl> xThis(this);
+
     Color aColor = pColorSet->GetItemColor( pColorSet->GetSelectItemId() );
     /*  #i33380# DR 2004-09-03 Moved the following line above the Dispatch() calls.
         This instance may be deleted in the meantime (i.e. when a dialog is opened
@@ -1413,6 +1415,8 @@ IMPL_LINK_NOARG_TYPED(SvxColorWindow_Impl, SelectPaletteHdl, ListBox&, void)
 
 IMPL_LINK_NOARG_TYPED(SvxColorWindow_Impl, AutoColorClickHdl, Button*, void)
 {
+    VclPtr<SvxColorWindow_Impl> xThis(this);
+
     Color aColor;
     switch ( theSlotId )
     {
@@ -1444,6 +1448,8 @@ IMPL_LINK_NOARG_TYPED(SvxColorWindow_Impl, AutoColorClickHdl, Button*, void)
 
 IMPL_LINK_NOARG_TYPED(SvxColorWindow_Impl, OpenPickerClickHdl, Button*, void)
 {
+    VclPtr<SvxColorWindow_Impl> xThis(this);
+
     if ( IsInPopupMode() )
         EndPopupMode();
     mrPaletteManager.PopupColorPicker(maCommand);
@@ -1691,6 +1697,8 @@ void SvxFrameWindow_Impl::DataChanged( const DataChangedEvent& rDCEvt )
 
 IMPL_LINK_NOARG_TYPED(SvxFrameWindow_Impl, SelectHdl, ValueSet*, void)
 {
+    VclPtr<SvxFrameWindow_Impl> xThis(this);
+
     SvxBoxItem          aBorderOuter( SID_ATTR_BORDER_OUTER );
     SvxBoxInfoItem      aBorderInner( SID_ATTR_BORDER_INNER );
     SvxBorderLine       theDefLine;
@@ -1790,10 +1798,13 @@ IMPL_LINK_NOARG_TYPED(SvxFrameWindow_Impl, SelectHdl, ValueSet*, void)
     aBorderInner.QueryValue( a );
     aArgs[1].Value = a;
 
-    /*  #i33380# DR 2004-09-03 Moved the following line above the Dispatch() call.
-        This instance may be deleted in the meantime (i.e. when a dialog is opened
-        while in Dispatch()), accessing members will crash in this case. */
-    aFrameSet->SetNoSelection();
+    if (aFrameSet)
+    {
+        /* #i33380# Moved the following line above the Dispatch() call.
+           This instance may be deleted in the meantime (i.e. when a dialog is opened
+           while in Dispatch()), accessing members will crash in this case. */
+        aFrameSet->SetNoSelection();
+    }
 
     SfxToolBoxControl::Dispatch( Reference< XDispatchProvider >( GetFrame()->getController(), UNO_QUERY ),
                                  ".uno:SetBorderStyle",
@@ -1984,6 +1995,8 @@ SvxLineWindow_Impl::SvxLineWindow_Impl( sal_uInt16 nId, const Reference< XFrame
 
 IMPL_LINK_NOARG_TYPED(SvxCurrencyList_Impl, SelectHdl, ListBox&, void)
 {
+    VclPtr<SvxCurrencyList_Impl> xThis(this);
+
     if ( IsInPopupMode() )
         EndPopupMode();
 
@@ -1998,6 +2011,8 @@ IMPL_LINK_NOARG_TYPED(SvxCurrencyList_Impl, SelectHdl, ListBox&, void)
 
 IMPL_LINK_NOARG_TYPED(SvxLineWindow_Impl, SelectHdl, ListBox&, void)
 {
+    VclPtr<SvxLineWindow_Impl> xThis(this);
+
     SvxLineItem     aLineItem( SID_FRAME_LINESTYLE );
     SvxBorderStyle  nStyle = SvxBorderStyle( m_aLineStyleLb->GetSelectEntryStyle() );
 
diff --git a/vcl/source/window/floatwin.cxx b/vcl/source/window/floatwin.cxx
index d130466d1603..2f415227df67 100644
--- a/vcl/source/window/floatwin.cxx
+++ b/vcl/source/window/floatwin.cxx
@@ -814,7 +814,7 @@ void FloatingWindow::ImplEndPopupMode( FloatWinPopupEndFlags nFlags, const VclPt
     SetTitleType( mnOldTitle );
 
     // set ToolBox again to normal
-    if ( mpImplData->mpBox )
+    if (mpImplData && mpImplData->mpBox)
     {
         mpImplData->mpBox->ImplFloatControl( false, this );
         mpImplData->mpBox = nullptr;