Get SwFieldType after broadcast

A crash was reported in HasOnlyOneListener, with the following call stack:

ntdll.dll!KiUserExceptionDispatch()
swlo.dll!SwModify::HasOnlyOneListener() Line 204
swlo.dll!SwFormatField::~SwFormatField() Line 142
swlo.dll!SwHistorySetTextField::`scalar deleting destructor'(unsigned int)
swlo.dll!std::default_delete<SwHistoryHint>::operator()(SwHistoryHint *) Line 3090
swlo.dll!std::unique_ptr<SwHistoryHint,std::default_delete<SwHistoryHint>>::{dtor}() Line 3198
swlo.dll!std::destroy_at(std::unique_ptr<SwHistoryHint,std::default_delete<SwHistoryHint>> * const) Line 311
swlo.dll!std::_Default_allocator_traits<std::allocator<std::unique_ptr<SwHistoryHint,std::default_delete<SwHistoryHint>>>>::destroy(std::allocator<std::unique_ptr<SwHistoryHint,std::default_delete<SwHistoryHint>>> &) Line 688
swlo.dll!std::_Destroy_range(std::unique_ptr<SwHistoryHint,std::default_delete<SwHistoryHint>> * _First, std::unique_ptr<SwHistoryHint,std::default_delete<SwHistoryHint>> * const) Line 905
swlo.dll!std::vector<std::unique_ptr<SwHistoryHint,std::default_delete<SwHistoryHint>>,std::allocator<std::unique_ptr<SwHistoryHint,std::default_delete<SwHistoryHint>>>>::_Destroy(std::unique_ptr<SwHistoryHint,std::default_delete<SwHistoryHint>> * _Last, std::unique_ptr<SwHistoryHint,std::default_delete<SwHistoryHint>> *) Line 1667
swlo.dll!std::vector<std::unique_ptr<SwHistoryHint,std::default_delete<SwHistoryHint>>,std::allocator<std::unique_ptr<SwHistoryHint,std::default_delete<SwHistoryHint>>>>::_Tidy() Line 1751
swlo.dll!std::vector<std::unique_ptr<SwHistoryHint,std::default_delete<SwHistoryHint>>,std::allocator<std::unique_ptr<SwHistoryHint,std::default_delete<SwHistoryHint>>>>::~vector<std::unique_ptr<SwHistoryHint,std::default_delete<SwHistoryHint>>,std::allocator<std::unique_ptr<SwHistoryHint,std::default_delete<SwHistoryHint>>>>() Line 699
swlo.dll!SwUndoSaveContent::~SwUndoSaveContent() Line 740
swlo.dll!SwUndoDelete::~SwUndoDelete() Line 633
swlo.dll!SwUndoDelete::`scalar deleting destructor'(unsigned int)
svllo.dll!std::default_delete<SfxUndoAction>::operator()(SfxUndoAction *) Line 3090
svllo.dll!std::unique_ptr<SfxUndoAction,std::default_delete<SfxUndoAction>>::{dtor}() Line 3198
svllo.dll!std::destroy_at(MarkedUndoAction * const) Line 311
svllo.dll!std::_Default_allocator_traits<std::allocator<MarkedUndoAction>>::destroy(std::allocator<MarkedUndoAction> &) Line 688
svllo.dll!std::_Destroy_range(MarkedUndoAction * _First, MarkedUndoAction * const) Line 905
svllo.dll!std::vector<MarkedUndoAction,std::allocator<MarkedUndoAction>>::_Destroy(MarkedUndoAction * _Last, MarkedUndoAction *) Line 1667
svllo.dll!std::vector<MarkedUndoAction,std::allocator<MarkedUndoAction>>::_Tidy() Line 1751
svllo.dll!std::vector<MarkedUndoAction,std::allocator<MarkedUndoAction>>::~vector<MarkedUndoAction,std::allocator<MarkedUndoAction>>() Line 699
svllo.dll!SfxUndoArray::{dtor}() Line 1389
svllo.dll!SfxListUndoAction::~SfxListUndoAction() Line 1318
svllo.dll!SfxListUndoAction::`vector deleting destructor'(unsigned int)
svllo.dll!std::default_delete<SfxUndoAction>::operator()(SfxUndoAction *) Line 3090
svllo.dll!std::unique_ptr<SfxUndoAction,std::default_delete<SfxUndoAction>>::{dtor}() Line 3198
svllo.dll!std::destroy_at(MarkedUndoAction * const) Line 311
svllo.dll!std::_Default_allocator_traits<std::allocator<MarkedUndoAction>>::destroy(std::allocator<MarkedUndoAction> &) Line 688
svllo.dll!std::_Destroy_range(MarkedUndoAction * _First, MarkedUndoAction * const) Line 905
svllo.dll!std::vector<MarkedUndoAction,std::allocator<MarkedUndoAction>>::_Destroy(MarkedUndoAction * _Last, MarkedUndoAction *) Line 1667
svllo.dll!std::vector<MarkedUndoAction,std::allocator<MarkedUndoAction>>::_Tidy() Line 1751
svllo.dll!std::vector<MarkedUndoAction,std::allocator<MarkedUndoAction>>::~vector<MarkedUndoAction,std::allocator<MarkedUndoAction>>() Line 699
svllo.dll!SfxUndoArray::{dtor}() Line 1389
svllo.dll!SfxListUndoAction::~SfxListUndoAction() Line 1318
svllo.dll!SfxListUndoAction::`vector deleting destructor'(unsigned int)
svllo.dll!std::default_delete<SfxUndoAction>::operator()(SfxUndoAction *) Line 3090
svllo.dll!std::unique_ptr<SfxUndoAction,std::default_delete<SfxUndoAction>>::{dtor}() Line 3198
svllo.dll!std::destroy_at(std::unique_ptr<SfxUndoAction,std::default_delete<SfxUndoAction>> * const) Line 311
svllo.dll!std::_Default_allocator_traits<std::allocator<std::unique_ptr<SfxUndoAction,std::default_delete<SfxUndoAction>>>>::destroy(std::allocator<std::unique_ptr<SfxUndoAction,std::default_delete<SfxUndoAction>>> &) Line 688
svllo.dll!std::_Destroy_range(std::unique_ptr<SfxUndoAction,std::default_delete<SfxUndoAction>> * _First, std::unique_ptr<SfxUndoAction,std::default_delete<SfxUndoAction>> * const) Line 905
svllo.dll!std::vector<std::unique_ptr<SfxUndoAction,std::default_delete<SfxUndoAction>>,std::allocator<std::unique_ptr<SfxUndoAction,std::default_delete<SfxUndoAction>>>>::_Destroy(std::unique_ptr<SfxUndoAction,std::default_delete<SfxUndoAction>> * _Last, std::unique_ptr<SfxUndoAction,std::default_delete<SfxUndoAction>> *) Line 1667
svllo.dll!std::vector<std::unique_ptr<SfxUndoAction,std::default_delete<SfxUndoAction>>,std::allocator<std::unique_ptr<SfxUndoAction,std::default_delete<SfxUndoAction>>>>::clear() Line 1442
svllo.dll!svl::undo::impl::UndoManagerGuard::~UndoManagerGuard() Line 325
svllo.dll!SfxUndoManager::ImplClearRedo_NoLock(const bool i_currentLevel) Line 468
swlo.dll!sw::DocumentContentOperationsManager::InsertPoolItem(const SwPaM & rRg, const SfxPoolItem & rHt, const SetAttrMode nFlags, const SwRootFrame * pLayout, SwTextAttr * * ppNewTextAttr) Line 3694
swlo.dll!SwXTextField::attach(const com::sun::star::uno::Reference<com::sun::star::text::XTextRange> & xTextRange) Line 1972
swlo.dll!SwXText::insertTextContent(const com::sun::star::uno::Reference<com::sun::star::text::XTextRange> & xRange, const com::sun::star::uno::Reference<com::sun::star::text::XTextContent> & xContent, unsigned char bAbsorb) Line 606
mscx_uno.dll!`anonymous namespace'::cpp_call(bridges::cpp_uno::shared::UnoInterfaceProxy * pThis, bridges::cpp_uno::shared::VtableSlot aVtableSlot, _typelib_TypeDescriptionReference * pReturnTypeRef, long nParams, _typelib_MethodParameter * pParams, void * pUnoReturn, void * * pUnoArgs, _uno_Any * * ppUnoExc) Line 214
mscx_uno.dll!unoInterfaceProxyDispatch(_uno_Interface * pUnoI, const _typelib_TypeDescription * pMemberTD, void * pReturn, void * * pArgs, _uno_Any * * ppException) Line 430
binaryurplo.dll!binaryurp::IncomingRequest::execute_throw(binaryurp::BinaryAny * returnValue, std::vector<binaryurp::BinaryAny,std::allocator<binaryurp::BinaryAny>> * outArguments) Line 239
binaryurplo.dll!binaryurp::IncomingRequest::execute() Line 79
binaryurplo.dll!request(void * pThreadSpecificData) Line 84
cppu3.dll!cppu_threadpool::JobQueue::enter(const void * nDisposeId, bool bReturnWhenNoJob) Line 101
cppu3.dll!cppu_threadpool::ORequestThread::run() Line 169
cppu3.dll!threadFunc(void * param) Line 190
sal3.dll!oslWorkerWrapperFunction(void * pData) Line 67

I don't know why pType->Which() succeeded before the broadcast and reset,
and pType->HasOnlyOneListener() crashed; field destructors themselves do
not seem to destroy their types (except SwDBField, which is handled here
explicitly). My blind guess is, that a change could happen in broadcast.

Change-Id: I5c7f07da2e1283510bce3a3e3e80b6f8d849f38b
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/177854
Tested-by: Jenkins
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>
(cherry picked from commit a81c1e16516dccd0e4a37c4ea5d37e9c85b5a3d7)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/177877
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
(cherry picked from commit b0bb7044824f242fec51143a64754d88a6931c3a)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/178044
(cherry picked from commit c891e60b1fd936fe88d8d77e4de416abb7af58c5)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/178192
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
Tested-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>

1 files changed, 2 insertions, 2 deletions

diff --git a/sw/source/core/txtnode/atrfld.cxx b/sw/source/core/txtnode/atrfld.cxx
index c967a95ee22f..aa58ca7fd3f4 100644
--- a/sw/source/core/txtnode/atrfld.cxx
+++ b/sw/source/core/txtnode/atrfld.cxx
@@ -133,12 +133,12 @@ SwFormatField::SwFormatField( const SwFormatField& rAttr )
 
 SwFormatField::~SwFormatField()
 {
-    SwFieldType* pType = mpField ? mpField->GetTyp() : nullptr;
+    Broadcast( SwFormatFieldHint( this, SwFormatFieldHintWhich::REMOVED ) );
 
+    SwFieldType* pType = mpField ? mpField->GetTyp() : nullptr;
     if (pType && pType->Which() == SwFieldIds::Database)
         pType = nullptr;  // DB field types destroy themselves
 
-    Broadcast( SwFormatFieldHint( this, SwFormatFieldHintWhich::REMOVED ) );
     mpField.reset();
 
     // some fields need to delete their field type