cppuhelper: WeakReference isn't thread-safe

... but its documentation claims that it is, which is partially
misleading, so fix both the documentation and the data race in
WeakReferenceHelper::clear().

This actually crashed in clear() in the multi-threaded ZipPackage code
on exporting the bugdoc from tdf#94212, presumably because clear()
races against OWeakRefListener::dispose().

Change-Id: I85665c11b8157e90d15e8263758e24e66efeb86c

1 files changed, 4 insertions, 7 deletions

diff --git a/cppuhelper/source/weak.cxx b/cppuhelper/source/weak.cxx
index b6abef5ebe56..ed1f77208249 100644
--- a/cppuhelper/source/weak.cxx
+++ b/cppuhelper/source/weak.cxx
@@ -34,6 +34,7 @@ namespace cppu
 {
 
 // due to static Reflection destruction from usr, there must be a mutex leak (#73272#)
+// this is used to lock all instances of OWeakConnectionPoint and OWeakRefListener as well as OWeakObject::m_pWeakConnectionPoint
 inline static Mutex & getWeakMutex()
 {
     static Mutex * s_pMutex = nullptr;
@@ -358,7 +359,7 @@ public:
 
     /// The reference counter.
     oslInterlockedCount         m_aRefCount;
-    /// The connection point of the weak object
+    /// The connection point of the weak object, guarded by getWeakMutex()
     Reference< XAdapter >       m_XWeakConnectionPoint;
 };
 
@@ -463,12 +464,7 @@ void WeakReferenceHelper::clear()
     {
         if (m_pImpl)
         {
-            if (m_pImpl->m_XWeakConnectionPoint.is())
-            {
-                m_pImpl->m_XWeakConnectionPoint->removeReference(
-                        static_cast<XReference*>(m_pImpl));
-                m_pImpl->m_XWeakConnectionPoint.clear();
-            }
+            m_pImpl->dispose();
             m_pImpl->release();
             m_pImpl = nullptr;
         }
@@ -513,6 +509,7 @@ Reference< XInterface > WeakReferenceHelper::get() const
     {
         Reference< XAdapter > xAdp;
         {
+            // must lock to access m_XWeakConnectionPoint
             MutexGuard guard(cppu::getWeakMutex());
             if( m_pImpl && m_pImpl->m_XWeakConnectionPoint.is() )
                 xAdp = m_pImpl->m_XWeakConnectionPoint;