tdf#150732 ReportBuilder: Moving fields from one section to another crashes

regression from
        commit 8611f6e259b807b4f19c8dc0eab86ca648891ce3
        Author: Noel Grandin <noel.grandin@collabora.co.uk>
        Date:   Thu May 27 10:27:46 2021 +0200
        ref-count SdrObject

Fixes 2 issues
(1) where I removed some code that we need
(2) where the OUnoObject constructor was deleting the object is was
constructing

Note that this only fixes the crash that Julien saw, not the underlying
problem that this tdf bug reports. That bug appears to predate my
commit.

Change-Id: I3878ef460dedc3c2a6c86b88fce9d155e79bc0b8
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139714
Tested-by: Julien Nabet <serval2412@yahoo.fr>
Reviewed-by: Julien Nabet <serval2412@yahoo.fr>
Tested-by: Jenkins
Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk>

2 files changed, 26 insertions, 6 deletions

diff --git a/reportdesign/source/core/sdr/RptObject.cxx b/reportdesign/source/core/sdr/RptObject.cxx
index dde0896855b2..e54db1ee3fe1 100644
--- a/reportdesign/source/core/sdr/RptObject.cxx
+++ b/reportdesign/source/core/sdr/RptObject.cxx
@@ -423,6 +423,7 @@ uno::Reference< drawing::XShape > OObjectBase::getUnoShapeOf( SdrObject& _rSdrOb
     if ( !xShape.is() )
         return xShape;
 
+    m_xKeepShapeAlive = xShape;
     return xShape;
 }
 
@@ -540,6 +541,7 @@ uno::Reference< drawing::XShape > OCustomShape::getUnoShape()
 void OCustomShape::setUnoShape( const uno::Reference< drawing::XShape >& rxUnoShape )
 {
     SdrObjCustomShape::setUnoShape( rxUnoShape );
+    releaseUnoShape();
     m_xReportComponent.clear();
 }
 
@@ -566,12 +568,16 @@ OUnoObject::OUnoObject(
     // tdf#119067
     ,m_bSetDefaultLabel(rSource.m_bSetDefaultLabel)
 {
-    if ( !rSource.getUnoControlModelTypeName().isEmpty() )
-        impl_initializeModel_nothrow();
-    Reference<XPropertySet> xSource(const_cast<OUnoObject&>(rSource).getUnoShape(), uno::UNO_QUERY);
-    Reference<XPropertySet> xDest(getUnoShape(), uno::UNO_QUERY);
-    if ( xSource.is() && xDest.is() )
-        comphelper::copyProperties(xSource, xDest);
+    osl_atomic_increment(&m_refCount); // getUnoShape will ref-count thiss
+    {
+        if ( !rSource.getUnoControlModelTypeName().isEmpty() )
+            impl_initializeModel_nothrow();
+        Reference<XPropertySet> xSource(const_cast<OUnoObject&>(rSource).getUnoShape(), uno::UNO_QUERY);
+        Reference<XPropertySet> xDest(getUnoShape(), uno::UNO_QUERY);
+        if ( xSource.is() && xDest.is() )
+            comphelper::copyProperties(xSource, xDest);
+    }
+    osl_atomic_decrement(&m_refCount);
 }
 
 OUnoObject::OUnoObject(
@@ -867,6 +873,12 @@ uno::Reference< drawing::XShape > OUnoObject::getUnoShape()
     return OObjectBase::getUnoShapeOf( *this );
 }
 
+void OUnoObject::setUnoShape( const uno::Reference< drawing::XShape >& rxUnoShape )
+{
+    SdrUnoObj::setUnoShape( rxUnoShape );
+    releaseUnoShape();
+}
+
 rtl::Reference<SdrObject> OUnoObject::CloneSdrObject(SdrModel& rTargetModel) const
 {
     return new OUnoObject(rTargetModel, *this);
@@ -1060,6 +1072,7 @@ uno::Reference< drawing::XShape > OOle2Obj::getUnoShape()
 void OOle2Obj::setUnoShape( const uno::Reference< drawing::XShape >& rxUnoShape )
 {
     SdrOle2Obj::setUnoShape( rxUnoShape );
+    releaseUnoShape();
     m_xReportComponent.clear();
 }
 
diff --git a/reportdesign/source/core/sdr/RptPage.cxx b/reportdesign/source/core/sdr/RptPage.cxx
index 0132ccf725a2..98b8ef8741bb 100644
--- a/reportdesign/source/core/sdr/RptPage.cxx
+++ b/reportdesign/source/core/sdr/RptPage.cxx
@@ -178,6 +178,13 @@ void OReportPage::NbcInsertObject(SdrObject* pObj, size_t nPos)
     reportdesign::OSection* pSection = comphelper::getFromUnoTunnel<reportdesign::OSection>(m_xSection);
     uno::Reference< drawing::XShape> xShape(pObj->getUnoShape(),uno::UNO_QUERY);
     pSection->notifyElementAdded(xShape);
+
+    // now that the shape is inserted into its structures, we can allow the OObjectBase
+    // to release the reference to it
+    OObjectBase* pObjectBase = dynamic_cast< OObjectBase* >( pObj );
+    OSL_ENSURE( pObjectBase, "OReportPage::NbcInsertObject: what is being inserted here?" );
+    if ( pObjectBase )
+        pObjectBase->releaseUnoShape();
 }
 
 } // rptui