In LazyDelete'd SearchDialog::dispose, SfxHelpTextWindow_Impl is already gone

Came across this in a UBSan build via menu "Help - LibreOffice Help" ->
"LibreOffice Help" window: "Find on this Page..." icon -> "Find on this Page"
dialog: "Close" button, then close help window:

> sfx2/source/appl/newhelp.cxx:2291:1: runtime error: member call on address 0x618001188880 which does not point to an object of type 'SfxHelpTextWindow_Impl'
> 0x618001188880: note: object has a possibly invalid vptr: abs(offset to top) too big
>  81 04 00 13  0e 07 00 08 5e 7f 00 00  00 00 00 00 00 00 00 00  60 62 9a 51 5e 7f 00 00  00 00 00 00
>               ^~~~~~~~~~~~~~~~~~~~~~~
>               possibly invalid vptr
>     #0 0x7f5e4700f276 in SfxHelpTextWindow_Impl::LinkStubCloseHdl(void*, sfx2::SearchDialog*) sfx2/source/appl/newhelp.cxx:2291:1
>     #1 0x7f5e47f6d13a in Link<sfx2::SearchDialog*, void>::Call(sfx2::SearchDialog*) const include/tools/link.hxx:84:45
>     #2 0x7f5e47f66c5f in sfx2::SearchDialog::dispose() sfx2/source/dialog/srchdlg.cxx:70:17
>     #3 0x7f5e209af22c in VclReferenceBase::disposeOnce() vcl/source/outdev/vclreferencebase.cxx:42:5
>     #4 0x7f5e1edb81b9 in VclPtr<vcl::Window>::disposeAndClear() include/vcl/vclptr.hxx:239:19
>     #5 0x7f5e1fc47199 in vcl::LazyDeletor::~LazyDeletor() include/vcl/lazydelete.hxx:148:36
>     #6 0x7f5e1fc473af in vcl::LazyDeletor::~LazyDeletor() include/vcl/lazydelete.hxx:122:9
>     #7 0x7f5e21dfdb50 in vcl::LazyDelete::flush() vcl/source/helper/lazydelete.cxx:52:9
>     #8 0x7f5e21fa552f in ImplYield(bool, bool, unsigned long) vcl/source/app/svapp.cxx:513:9
>     #9 0x7f5e21f7fdc3 in Application::Yield() vcl/source/app/svapp.cxx:558:5
>     #10 0x7f5e21f7fb06 in Application::Execute() vcl/source/app/svapp.cxx:458:9
>     #11 0x7f5e5cbd18d4 in desktop::Desktop::DoExecute() desktop/source/app/app.cxx:1359:5
>     #12 0x7f5e5cbd9e06 in desktop::Desktop::Main() desktop/source/app/app.cxx:1679:17
>     #13 0x7f5e21ffb0cb in ImplSVMain() vcl/source/app/svmain.cxx:191:35
>     #14 0x7f5e220085f1 in SVMain() vcl/source/app/svmain.cxx:229:16
>     #15 0x7f5e5cdfec4b in soffice_main desktop/source/app/sofficemain.cxx:166:12
>     #16 0x511c69 in sal_main desktop/source/app/main.c:48:15
>     #17 0x511c13 in main desktop/source/app/main.c:47:1
>     #18 0x7f5e5b37d400 in __libc_start_main /usr/src/debug/glibc-2.24-33-ge9e69e4/csu/../csu/libc-start.c:289
>     #19 0x419e59 in _start (instdir/program/soffice.bin+0x419e59)

indicating that the SfxHelpTextWindow_Impl target of the m_aCloseHdl.Call is
already dead.  Looks like there is no good reason for that call from dipose()
anyway, which also means the Call's argument is unused.

Change-Id: Ifc33e74e346902dc0208350f5bac79bec182ef12

4 files changed, 5 insertions, 6 deletions

diff --git a/sfx2/inc/srchdlg.hxx b/sfx2/inc/srchdlg.hxx
index 0210ed23436b..b6e8d2ae7588 100644
--- a/sfx2/inc/srchdlg.hxx
+++ b/sfx2/inc/srchdlg.hxx
@@ -43,7 +43,7 @@ private:
     VclPtr<PushButton>         m_pFindBtn;
 
     Link<SearchDialog&,void>   m_aFindHdl;
-    Link<SearchDialog*,void>   m_aCloseHdl;
+    Link<LinkParamNone*,void>  m_aCloseHdl;
 
     OUString            m_sConfigName;
     OString             m_sWinState;
@@ -61,7 +61,7 @@ public:
     virtual void dispose() override;
 
     void         SetFindHdl( const Link<SearchDialog&,void>& rLink ) { m_aFindHdl = rLink; }
-    void         SetCloseHdl( const Link<SearchDialog*,void>& rLink ) { m_aCloseHdl = rLink; }
+    void         SetCloseHdl( const Link<LinkParamNone*,void>& rLink ) { m_aCloseHdl = rLink; }
 
     OUString     GetSearchText() const { return m_pSearchEdit->GetText(); }
     void         SetSearchText( const OUString& _rText ) { m_pSearchEdit->SetText( _rText ); }
diff --git a/sfx2/source/appl/newhelp.cxx b/sfx2/source/appl/newhelp.cxx
index 7af2a0c7f604..4a67b06ef6ff 100644
--- a/sfx2/source/appl/newhelp.cxx
+++ b/sfx2/source/appl/newhelp.cxx
@@ -2288,7 +2288,7 @@ void SfxHelpTextWindow_Impl::FindHdl(sfx2::SearchDialog* pDlg)
 }
 
 
-IMPL_LINK_NOARG( SfxHelpTextWindow_Impl, CloseHdl, sfx2::SearchDialog*, void )
+IMPL_LINK_NOARG( SfxHelpTextWindow_Impl, CloseHdl, LinkParamNone*, void )
 {
     pSrchDlg.clear();
 }
diff --git a/sfx2/source/appl/newhelp.hxx b/sfx2/source/appl/newhelp.hxx
index 499d8072e7fc..74de410b71e3 100644
--- a/sfx2/source/appl/newhelp.hxx
+++ b/sfx2/source/appl/newhelp.hxx
@@ -457,7 +457,7 @@ private:
     DECL_LINK(        SelectHdl, Timer *, void);
     DECL_LINK(        NotifyHdl, LinkParamNone*, void );
     DECL_LINK(        FindHdl, sfx2::SearchDialog&, void );
-    DECL_LINK(        CloseHdl, sfx2::SearchDialog*, void );
+    DECL_LINK(        CloseHdl, LinkParamNone*, void );
     DECL_LINK(        CheckHdl, Button*, void );
     void                    FindHdl(sfx2::SearchDialog*);
 
diff --git a/sfx2/source/dialog/srchdlg.cxx b/sfx2/source/dialog/srchdlg.cxx
index fcc11b39f9bd..757df710d019 100644
--- a/sfx2/source/dialog/srchdlg.cxx
+++ b/sfx2/source/dialog/srchdlg.cxx
@@ -67,7 +67,6 @@ SearchDialog::~SearchDialog()
 void SearchDialog::dispose()
 {
     SaveConfig();
-    m_aCloseHdl.Call( nullptr );
     m_pSearchEdit.clear();
     m_pWholeWordsBox.clear();
     m_pMatchCaseBox.clear();
@@ -151,7 +150,7 @@ void SearchDialog::SetFocusOnEdit()
 bool SearchDialog::Close()
 {
     bool bRet = ModelessDialog::Close();
-    m_aCloseHdl.Call( this );
+    m_aCloseHdl.Call( nullptr );
     return bRet;
 }