Clear all m_pVCLMenu->pItemList->maItemList[i]->m_pSubMenu

...even if no correpsonding xPopupMenu proxy has been set up for some i (because
that sub-menu has never been opened by the user).  Otherwise, the Menu that
m_pVCLMenu->pItemList->maItemList[i]->m_pSubMenu points to will be deleted
(during a recursive xSubMenuManager->dispose call), and when later for some
sub-menu j > i that /has/ been opened by the user SetPopupMenu is called, that
can lead to

> Menu::GetPopupMenu(unsigned short) const at vcl/source/window/menu.cxx:835
> Menu::GetAccessible() at vcl/source/window/menu.cxx:1400
> OAccessibleMenuItemComponent::getAccessibleParent() at accessibility/source/standard/accessiblemenuitemcomponent.cxx:339
> non-virtual thunk to OAccessibleMenuItemComponent::getAccessibleParent() at accessibility/source/standard/accessiblemenuitemcomponent.cxx:335
> atk_object_wrapper_new(com::sun::star::uno::Reference<com::sun::star::accessibility::XAccessible> const&, AtkObject*) at vcl/unx/gtk3/a11y/../../gtk/a11y/atkwrapper.cxx:839
> atk_object_wrapper_ref(com::sun::star::uno::Reference<com::sun::star::accessibility::XAccessible> const&, bool) at vcl/unx/gtk3/a11y/../../gtk/a11y/atkwrapper.cxx:795
> AtkListener::handleChildAdded(com::sun::star::uno::Reference<com::sun::star::accessibility::XAccessibleContext> const&, com::sun::star::uno::Reference<com::sun::star::accessibility::XAccessible> const&) at vcl/unx/gtk3/a11y/../../gtk/a11y/atklistener.cxx:157
> AtkListener::notifyEvent(com::sun::star::accessibility::AccessibleEventObject const&) at vcl/unx/gtk3/a11y/../../gtk/a11y/atklistener.cxx:296
> comphelper::AccessibleEventNotifier::addEvent(unsigned int, com::sun::star::accessibility::AccessibleEventObject const&) at comphelper/source/misc/accessibleeventnotifier.cxx:281
> comphelper::OAccessibleContextHelper::NotifyAccessibleEvent(short, com::sun::star::uno::Any const&, com::sun::star::uno::Any const&) at comphelper/source/misc/accessiblecontexthelper.cxx:188
> OAccessibleMenuBaseComponent::InsertChild(int) at accessibility/source/standard/accessiblemenubasecomponent.cxx:436
> OAccessibleMenuBaseComponent::ProcessMenuEvent(VclMenuEvent const&) at accessibility/source/standard/accessiblemenubasecomponent.cxx:624
> OAccessibleMenuBaseComponent::MenuEventListener(VclMenuEvent&) at accessibility/source/standard/accessiblemenubasecomponent.cxx:572
> OAccessibleMenuBaseComponent::LinkStubMenuEventListener(void*, VclMenuEvent&) at accessibility/source/standard/accessiblemenubasecomponent.cxx:569
> Link<VclMenuEvent&, void>::Call(VclMenuEvent&) const at include/tools/link.hxx:84
> Menu::ImplCallEventListeners(unsigned long, unsigned short) at vcl/source/window/menu.cxx:355
> Menu::SetPopupMenu(unsigned short, PopupMenu*) at vcl/source/window/menu.cxx:825
> framework::MenuBarManager::RemoveListener() at framework/source/uielement/menubarmanager.cxx:556

looking at the dangling pSubMenu pointer (and even if the dangling pointer is
never dereferenced, UBSan will try to determine whether the static_cast in

return static_cast<PopupMenu*>(pData->pSubMenu);

in Menu::GetPopupMenu, vcl/source/window/menu.cxx, is fine and cause a crash).

Change-Id: I5e5f6dba266580e3c2e7693877ea79a07d80bb74

0 files changed, 0 insertions, 0 deletions