Resolves: tdf#100574 Crash when selecting and applying border style...

when a first torn off instance was opened just before the second one
and then the second one sends focus back to the first when its popped
down.

The second one listens to losing the focus and disposes itself which leads to
dereferencing deleted stuff.

So add a reference count to the places these tear offs call popdown so its
still gets disposed but not deleted during the popdown and then protect against
members being disposed with a enough checks to get back to safely

Change-Id: Id5f8eb4771df36305e308a2a9a5035018948f121

1 files changed, 20 insertions, 5 deletions

diff --git a/svx/source/tbxctrls/tbcontrl.cxx b/svx/source/tbxctrls/tbcontrl.cxx
index 3c8164c6f201..55bcd10cefe7 100644
--- a/svx/source/tbxctrls/tbcontrl.cxx
+++ b/svx/source/tbxctrls/tbcontrl.cxx
@@ -1381,6 +1381,8 @@ void SvxColorWindow_Impl::KeyInput( const KeyEvent& rKEvt )
 
 IMPL_LINK_TYPED(SvxColorWindow_Impl, SelectHdl, ValueSet*, pColorSet, void)
 {
+    VclPtr<SvxColorWindow_Impl> xThis(this);
+
     Color aColor = pColorSet->GetItemColor( pColorSet->GetSelectItemId() );
     /*  #i33380# DR 2004-09-03 Moved the following line above the Dispatch() calls.
         This instance may be deleted in the meantime (i.e. when a dialog is opened
@@ -1412,6 +1414,8 @@ IMPL_LINK_NOARG_TYPED(SvxColorWindow_Impl, SelectPaletteHdl, ListBox&, void)
 
 IMPL_LINK_NOARG_TYPED(SvxColorWindow_Impl, AutoColorClickHdl, Button*, void)
 {
+    VclPtr<SvxColorWindow_Impl> xThis(this);
+
     Color aColor;
     switch ( theSlotId )
     {
@@ -1443,6 +1447,8 @@ IMPL_LINK_NOARG_TYPED(SvxColorWindow_Impl, AutoColorClickHdl, Button*, void)
 
 IMPL_LINK_NOARG_TYPED(SvxColorWindow_Impl, OpenPickerClickHdl, Button*, void)
 {
+    VclPtr<SvxColorWindow_Impl> xThis(this);
+
     if ( IsInPopupMode() )
         EndPopupMode();
     mrPaletteManager.PopupColorPicker(maCommand);
@@ -1685,6 +1691,8 @@ void SvxFrameWindow_Impl::DataChanged( const DataChangedEvent& rDCEvt )
 
 IMPL_LINK_NOARG_TYPED(SvxFrameWindow_Impl, SelectHdl, ValueSet*, void)
 {
+    VclPtr<SvxFrameWindow_Impl> xThis(this);
+
     SvxBoxItem          aBorderOuter( SID_ATTR_BORDER_OUTER );
     SvxBoxInfoItem      aBorderInner( SID_ATTR_BORDER_INNER );
     SvxBorderLine       theDefLine;
@@ -1784,10 +1792,13 @@ IMPL_LINK_NOARG_TYPED(SvxFrameWindow_Impl, SelectHdl, ValueSet*, void)
     aBorderInner.QueryValue( a );
     aArgs[1].Value = a;
 
-    /*  #i33380# DR 2004-09-03 Moved the following line above the Dispatch() call.
-        This instance may be deleted in the meantime (i.e. when a dialog is opened
-        while in Dispatch()), accessing members will crash in this case. */
-    aFrameSet->SetNoSelection();
+    if (aFrameSet)
+    {
+        /* #i33380# Moved the following line above the Dispatch() call.
+           This instance may be deleted in the meantime (i.e. when a dialog is opened
+           while in Dispatch()), accessing members will crash in this case. */
+        aFrameSet->SetNoSelection();
+    }
 
     SfxToolBoxControl::Dispatch( Reference< XDispatchProvider >( GetFrame()->getController(), UNO_QUERY ),
                                  ".uno:SetBorderStyle",
@@ -1973,6 +1984,8 @@ SvxLineWindow_Impl::SvxLineWindow_Impl( sal_uInt16 nId, const Reference< XFrame
 
 IMPL_LINK_NOARG_TYPED(SvxCurrencyList_Impl, SelectHdl, ListBox&, void)
 {
+    VclPtr<SvxCurrencyList_Impl> xThis(this);
+
     if ( IsInPopupMode() )
         EndPopupMode();
 
@@ -1987,6 +2000,8 @@ IMPL_LINK_NOARG_TYPED(SvxCurrencyList_Impl, SelectHdl, ListBox&, void)
 
 IMPL_LINK_NOARG_TYPED(SvxLineWindow_Impl, SelectHdl, ListBox&, void)
 {
+    VclPtr<SvxLineWindow_Impl> xThis(this);
+
     SvxLineItem     aLineItem( SID_FRAME_LINESTYLE );
     SvxBorderStyle  nStyle = SvxBorderStyle( m_aLineStyleLb->GetSelectEntryStyle() );
 
@@ -3140,4 +3155,4 @@ void SvxCurrencyToolBoxControl::GetCurrencySymbols( std::vector<OUString>& rList
     }
 }
 
-/* vim:set shiftwidth=4 softtabstop=4 expandtab: */
\ No newline at end of file
+/* vim:set shiftwidth=4 softtabstop=4 expandtab: */