Clear all m_pVCLMenu->pItemList->maItemList[i]->m_pSubMenu

...even if no correpsonding xPopupMenu proxy has been set up for some i (because
that sub-menu has never been opened by the user).  Otherwise, the Menu that
m_pVCLMenu->pItemList->maItemList[i]->m_pSubMenu points to will be deleted
(during a recursive xSubMenuManager->dispose call), and when later for some
sub-menu j > i that /has/ been opened by the user SetPopupMenu is called, that
can lead to

> Menu::GetPopupMenu(unsigned short) const at vcl/source/window/menu.cxx:835
> Menu::GetAccessible() at vcl/source/window/menu.cxx:1400
> OAccessibleMenuItemComponent::getAccessibleParent() at accessibility/source/standard/accessiblemenuitemcomponent.cxx:339
> non-virtual thunk to OAccessibleMenuItemComponent::getAccessibleParent() at accessibility/source/standard/accessiblemenuitemcomponent.cxx:335
> atk_object_wrapper_new(com::sun::star::uno::Reference<com::sun::star::accessibility::XAccessible> const&, AtkObject*) at vcl/unx/gtk3/a11y/../../gtk/a11y/atkwrapper.cxx:839
> atk_object_wrapper_ref(com::sun::star::uno::Reference<com::sun::star::accessibility::XAccessible> const&, bool) at vcl/unx/gtk3/a11y/../../gtk/a11y/atkwrapper.cxx:795
> AtkListener::handleChildAdded(com::sun::star::uno::Reference<com::sun::star::accessibility::XAccessibleContext> const&, com::sun::star::uno::Reference<com::sun::star::accessibility::XAccessible> const&) at vcl/unx/gtk3/a11y/../../gtk/a11y/atklistener.cxx:157
> AtkListener::notifyEvent(com::sun::star::accessibility::AccessibleEventObject const&) at vcl/unx/gtk3/a11y/../../gtk/a11y/atklistener.cxx:296
> comphelper::AccessibleEventNotifier::addEvent(unsigned int, com::sun::star::accessibility::AccessibleEventObject const&) at comphelper/source/misc/accessibleeventnotifier.cxx:281
> comphelper::OAccessibleContextHelper::NotifyAccessibleEvent(short, com::sun::star::uno::Any const&, com::sun::star::uno::Any const&) at comphelper/source/misc/accessiblecontexthelper.cxx:188
> OAccessibleMenuBaseComponent::InsertChild(int) at accessibility/source/standard/accessiblemenubasecomponent.cxx:436
> OAccessibleMenuBaseComponent::ProcessMenuEvent(VclMenuEvent const&) at accessibility/source/standard/accessiblemenubasecomponent.cxx:624
> OAccessibleMenuBaseComponent::MenuEventListener(VclMenuEvent&) at accessibility/source/standard/accessiblemenubasecomponent.cxx:572
> OAccessibleMenuBaseComponent::LinkStubMenuEventListener(void*, VclMenuEvent&) at accessibility/source/standard/accessiblemenubasecomponent.cxx:569
> Link<VclMenuEvent&, void>::Call(VclMenuEvent&) const at include/tools/link.hxx:84
> Menu::ImplCallEventListeners(unsigned long, unsigned short) at vcl/source/window/menu.cxx:355
> Menu::SetPopupMenu(unsigned short, PopupMenu*) at vcl/source/window/menu.cxx:825
> framework::MenuBarManager::RemoveListener() at framework/source/uielement/menubarmanager.cxx:556

looking at the dangling pSubMenu pointer (and even if the dangling pointer is
never dereferenced, UBSan will try to determine whether the static_cast in

  return static_cast<PopupMenu*>(pData->pSubMenu);

in Menu::GetPopupMenu, vcl/source/window/menu.cxx, is fine and cause a crash).

Change-Id: I5e5f6dba266580e3c2e7693877ea79a07d80bb74

1 files changed, 6 insertions, 5 deletions

diff --git a/framework/source/uielement/menubarmanager.cxx b/framework/source/uielement/menubarmanager.cxx
index 6f691c7cc2e4..137737009ba8 100644
--- a/framework/source/uielement/menubarmanager.cxx
+++ b/framework/source/uielement/menubarmanager.cxx
@@ -549,13 +549,14 @@ void MenuBarManager::RemoveListener()
             }
 
             pItemHandler->xMenuItemDispatch.clear();
+
+            // Remove popup menu from menu structure (regardless whether an
+            // xPopupMenu proxy has been set up for it; calling SetPopupMenu for
+            // a non-popup child will effectively do nothing:
+            m_pVCLMenu->SetPopupMenu( pItemHandler->nItemId, nullptr );
+
             if ( pItemHandler->xPopupMenu.is() )
             {
-                {
-                    // Remove popup menu from menu structure
-                    m_pVCLMenu->SetPopupMenu( pItemHandler->nItemId, nullptr );
-                }
-
                 Reference< css::lang::XEventListener > xEventListener( pItemHandler->xPopupMenuController, UNO_QUERY );
                 if ( xEventListener.is() )
                 {