fdo#56617: Fix crash on closing beanshell dialog and the macro window.

When removing an entry from the tree list, we need to

1) first remove the entry from the list,
2) broadcast its removal with the entry instance, then
3) finally delete the entry itself at the very end.

in this exact order, or else interesting stuff would ensue.

Change-Id: If42b141921ffe4ed36dce31f93a4a084204815bf

1 files changed, 8 insertions, 5 deletions

diff --git a/svtools/source/contnr/treelist.cxx b/svtools/source/contnr/treelist.cxx
index ea451b6178d9..675c01958291 100644
--- a/svtools/source/contnr/treelist.cxx
+++ b/svtools/source/contnr/treelist.cxx
@@ -1232,7 +1232,9 @@ bool SvTreeList::Remove( const SvTreeListEntry* pEntry )
     SvTreeListEntries& rList = pParent->maChildren;
     bool bLastEntry = false;
 
-    Broadcast(LISTACTION_REMOVED, const_cast<SvTreeListEntry*>(pEntry));
+    // Since we need the live instance of SvTreeListEntry for broadcasting,
+    // we first need to pop it from the container, broadcast it, then delete
+    // the instance manually at the end.
 
     if ( pEntry->HasChildListPos() )
     {
@@ -1240,22 +1242,23 @@ bool SvTreeList::Remove( const SvTreeListEntry* pEntry )
         bLastEntry = (nListPos == (rList.size()-1)) ? true : false;
         SvTreeListEntries::iterator it = rList.begin();
         std::advance(it, nListPos);
-        rList.erase(it);
+        rList.release(it).release();
     }
     else
     {
         SvTreeListEntries::iterator it =
             std::find_if(rList.begin(), rList.end(), FindByPointer(pEntry));
         if (it != rList.end())
-            rList.erase(it);
+            rList.release(it).release();
     }
 
-    // moved to end of method because it is used later with Broadcast
-
     if (!rList.empty() && !bLastEntry)
         SetListPositions(rList);
 
     nEntryCount -= nRemoved;
+    Broadcast(LISTACTION_REMOVED, const_cast<SvTreeListEntry*>(pEntry));
+    delete pEntry;
+
     return true;
 }