svx: fix crash with active text edit vs slide delete

The problem is that SdrObjEditView::HideSdrPage() may delete
SdrPaintView::mpPageView when it calls SdrGlueEditView::HideSdrPage().

But SdrObjEditView::pTextEditPV is a non-owning reference to that.

GetTextEditBackgroundColor() in svx/ calls
SdrObjEditView::GetTextEditPageView(), so in case
SdrObjEditView::pTextEditPV is not cleared, we would access a deleted
SdrPageView.

Change-Id: I948bae8e0e8d557e38aa8f243e9eea522b21a043
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/115324
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Tested-by: Jenkins

1 files changed, 6 insertions, 0 deletions

diff --git a/svx/source/svdraw/svdedxv.cxx b/svx/source/svdraw/svdedxv.cxx
index 95379012be54..bb56488428db 100644
--- a/svx/source/svdraw/svdedxv.cxx
+++ b/svx/source/svdraw/svdedxv.cxx
@@ -195,6 +195,12 @@ void SdrObjEditView::HideSdrPage()
 {
     lcl_RemoveTextEditOutlinerViews(this, GetSdrPageView(), GetFirstOutputDevice());
 
+    if (pTextEditPV == GetSdrPageView())
+    {
+        // HideSdrPage() will clear mpPageView, avoid a dangling pointer.
+        pTextEditPV = nullptr;
+    }
+
     SdrGlueEditView::HideSdrPage();
 }