when disposing popup menus, don't leave dangling pointers

Change-Id: Ia1b49937ba0693a567097367b99b75a3011666bf
Reviewed-on: https://gerrit.libreoffice.org/26960
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Michael Meeks <michael.meeks@collabora.com>
Tested-by: Michael Meeks <michael.meeks@collabora.com>

10 files changed, 18 insertions, 17 deletions

diff --git a/cui/source/tabpages/numpages.cxx b/cui/source/tabpages/numpages.cxx
index 4eafff907164..9f9deaf380c7 100644
--- a/cui/source/tabpages/numpages.cxx
+++ b/cui/source/tabpages/numpages.cxx
@@ -1258,8 +1258,7 @@ void SvxNumOptionsTabPage::dispose()
 {
     if (m_pBitmapMB)
     {
-        VclPtr<PopupMenu> p = m_pBitmapMB->GetPopupMenu()->GetPopupMenu(m_nGalleryId);
-        p.disposeAndClear(); // NoelG: dodgy, this leaves a dangling pointer
+        m_pBitmapMB->GetPopupMenu()->DisposePopupMenu(m_nGalleryId);
     }
     delete pActNum;
     pActNum = nullptr;
diff --git a/cui/source/tabpages/tpline.cxx b/cui/source/tabpages/tpline.cxx
index ca323ab469ea..99417a40dd9a 100644
--- a/cui/source/tabpages/tpline.cxx
+++ b/cui/source/tabpages/tpline.cxx
@@ -229,13 +229,11 @@ void SvxLineTabPage::dispose()
     // Symbols on a line (e.g. StarCharts), dtor new!
     if (m_pSymbolMB)
     {
-        VclPtr<PopupMenu> p = m_pSymbolMB->GetPopupMenu()->GetPopupMenu( MN_GALLERY );
-        p.disposeAndClear(); // NoelG: dodgy, this leaves a dangling pointer
+        m_pSymbolMB->GetPopupMenu()->DisposePopupMenu( MN_GALLERY );
 
         if(m_pSymbolList)
         {
-            VclPtr<PopupMenu> p2 = m_pSymbolMB->GetPopupMenu()->GetPopupMenu( MN_SYMBOLS );
-            p2.disposeAndClear(); // NoelG: dodgy, this leaves a dangling pointer
+            m_pSymbolMB->GetPopupMenu()->DisposePopupMenu( MN_SYMBOLS );
         }
         m_pSymbolMB = nullptr;
     }
diff --git a/dbaccess/source/ui/browser/sbagrid.cxx b/dbaccess/source/ui/browser/sbagrid.cxx
index 695a223b1fb2..5a7f4b952683 100644
--- a/dbaccess/source/ui/browser/sbagrid.cxx
+++ b/dbaccess/source/ui/browser/sbagrid.cxx
@@ -681,7 +681,7 @@ void SbaGridHeader::PreExecuteColumnContextMenu(sal_uInt16 nColId, PopupMenu& rM
     }
 }
 
-void SbaGridHeader::PostExecuteColumnContextMenu(sal_uInt16 nColId, const PopupMenu& rMenu, sal_uInt16 nExecutionResult)
+void SbaGridHeader::PostExecuteColumnContextMenu(sal_uInt16 nColId, PopupMenu& rMenu, sal_uInt16 nExecutionResult)
 {
     switch (nExecutionResult)
     {
diff --git a/dbaccess/source/ui/inc/sbagrid.hxx b/dbaccess/source/ui/inc/sbagrid.hxx
index 1972692121b5..6b292c79cfa8 100644
--- a/dbaccess/source/ui/inc/sbagrid.hxx
+++ b/dbaccess/source/ui/inc/sbagrid.hxx
@@ -176,7 +176,7 @@ namespace dbaui
 
         // FmGridHeader overridables
         virtual void    PreExecuteColumnContextMenu(sal_uInt16 nColId, PopupMenu& rMenu) override;
-        virtual void    PostExecuteColumnContextMenu(sal_uInt16 nColId, const PopupMenu& rMenu, sal_uInt16 nExecutionResult) override;
+        virtual void    PostExecuteColumnContextMenu(sal_uInt16 nColId, PopupMenu& rMenu, sal_uInt16 nExecutionResult) override;
 
     private:
         // DragSourceHelper overridables
diff --git a/include/svx/fmgridcl.hxx b/include/svx/fmgridcl.hxx
index c2b117360141..da2ca0dab4b9 100644
--- a/include/svx/fmgridcl.hxx
+++ b/include/svx/fmgridcl.hxx
@@ -66,7 +66,7 @@ protected:
     virtual void    PreExecuteColumnContextMenu(sal_uInt16 nColId, PopupMenu& rMenu);
     /** After executing the context menu for a column this method is called.
     */
-    virtual void    PostExecuteColumnContextMenu(sal_uInt16 nColId, const PopupMenu& rMenu, sal_uInt16 nExecutionResult);
+    virtual void    PostExecuteColumnContextMenu(sal_uInt16 nColId, PopupMenu& rMenu, sal_uInt16 nExecutionResult);
 
     // DropTargetHelper
     virtual sal_Int8    AcceptDrop( const AcceptDropEvent& rEvt ) override;
diff --git a/include/vcl/menu.hxx b/include/vcl/menu.hxx
index 81bb0c5c7a59..46c675ead879 100644
--- a/include/vcl/menu.hxx
+++ b/include/vcl/menu.hxx
@@ -284,6 +284,7 @@ public:
 
     void SetPopupMenu( sal_uInt16 nItemId, PopupMenu* pMenu );
     PopupMenu* GetPopupMenu( sal_uInt16 nItemId ) const;
+    void DisposePopupMenu( sal_uInt16 nItemId );
 
     void SetAccelKey( sal_uInt16 nItemId, const vcl::KeyCode& rKeyCode );
     vcl::KeyCode GetAccelKey( sal_uInt16 nItemId ) const;
diff --git a/svtools/source/contnr/svimpbox.cxx b/svtools/source/contnr/svimpbox.cxx
index 5a19237da730..ddd009e7948a 100644
--- a/svtools/source/contnr/svimpbox.cxx
+++ b/svtools/source/contnr/svimpbox.cxx
@@ -2921,9 +2921,7 @@ static void lcl_DeleteSubPopups(PopupMenu* pPopup)
         if(pSubPopup)
         {
             lcl_DeleteSubPopups(pSubPopup);
-            // NoelG: this looks very dodgy to me, we are attempting to delete this, but we leave a dangling pointer
-            // in the PopupMenu class?
-            pSubPopup.disposeAndClear();
+            pPopup->DisposePopupMenu( pPopup->GetItemId( i ));
         }
     }
 }
diff --git a/svx/source/fmcomp/fmgridcl.cxx b/svx/source/fmcomp/fmgridcl.cxx
index 9a1fa116638e..e397ec973169 100644
--- a/svx/source/fmcomp/fmgridcl.cxx
+++ b/svx/source/fmcomp/fmgridcl.cxx
@@ -776,14 +776,13 @@ void FmGridHeader::PreExecuteColumnContextMenu(sal_uInt16 nColId, PopupMenu& rMe
 
 enum InspectorAction { eOpenInspector, eCloseInspector, eUpdateInspector, eNone };
 
-void FmGridHeader::PostExecuteColumnContextMenu(sal_uInt16 nColId, const PopupMenu& rMenu, sal_uInt16 nExecutionResult)
+void FmGridHeader::PostExecuteColumnContextMenu(sal_uInt16 nColId, PopupMenu& rMenu, sal_uInt16 nExecutionResult)
 {
     Reference< css::container::XIndexContainer >  xCols(static_cast<FmGridControl*>(GetParent())->GetPeer()->getColumns());
     sal_uInt16 nPos = GetModelColumnPos(nColId);
 
     // remove and delete the menu we inserted in PreExecuteColumnContextMenu
-    VclPtr<PopupMenu> pControlMenu = rMenu.GetPopupMenu(SID_FM_CHANGECOL);
-    pControlMenu.disposeAndClear(); // NoelG: dodgy, this leaves a dangling pointer
+    rMenu.DisposePopupMenu(SID_FM_CHANGECOL);
 
     OUString aFieldType;
     bool    bReplace = false;
diff --git a/sw/source/uibase/ribbar/workctrl.cxx b/sw/source/uibase/ribbar/workctrl.cxx
index 5ff38fdd9273..02a0b42858a1 100644
--- a/sw/source/uibase/ribbar/workctrl.cxx
+++ b/sw/source/uibase/ribbar/workctrl.cxx
@@ -164,8 +164,7 @@ void SwTbxAutoTextCtrl::DelPopup()
     {
         for( sal_uInt16 i = 0; i < pPopup->GetItemCount(); i ++ )
         {
-            VclPtr<PopupMenu> pSubPopup = pPopup->GetPopupMenu(pPopup->GetItemId(i));
-            pSubPopup.disposeAndClear(); // NoelG: dodgy, this leaves a dangling pointer
+            pPopup->DisposePopupMenu(pPopup->GetItemId(i));
         }
         pPopup.disposeAndClear();
     }
diff --git a/vcl/source/window/menu.cxx b/vcl/source/window/menu.cxx
index c5e32f6118de..f146be47f48d 100644
--- a/vcl/source/window/menu.cxx
+++ b/vcl/source/window/menu.cxx
@@ -831,6 +831,13 @@ PopupMenu* Menu::GetPopupMenu( sal_uInt16 nItemId ) const
         return nullptr;
 }
 
+void Menu::DisposePopupMenu( sal_uInt16 nItemId )
+{
+    MenuItemData* pData = pItemList->GetData( nItemId );
+    if ( pData )
+        pData->pSubMenu.disposeAndClear();
+}
+
 void Menu::SetAccelKey( sal_uInt16 nItemId, const KeyCode& rKeyCode )
 {
     size_t          nPos;