Resolves: tdf#114427 crash when basic used to dispose shape

Change-Id: Ia078a0f4262fbe18b6cf463dbff33df1d4fd0a95
Reviewed-on: https://gerrit.libreoffice.org/59036
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

1 files changed, 13 insertions, 9 deletions

diff --git a/svx/source/unodraw/unoshape.cxx b/svx/source/unodraw/unoshape.cxx
index 6ee4b2e9d97b..aea443acb6fa 100644
--- a/svx/source/unodraw/unoshape.cxx
+++ b/svx/source/unodraw/unoshape.cxx
@@ -1357,39 +1357,43 @@ void SAL_CALL SvxShape::dispose()
     mpImpl->maDisposeListeners.disposeAndClear(aEvt);
     mpImpl->maPropertyNotifier.disposing();
 
+    bool bFreeSdrObject = false;
     if ( HasSdrObject() )
     {
-        EndListening( GetSdrObject()->getSdrModelFromSdrObject() );
-        bool bFreeSdrObject = false;
-
-        if ( GetSdrObject()->IsInserted() && GetSdrObject()->getSdrPageFromSdrObject() )
+        SdrObject* pObject = GetSdrObject();
+        EndListening( pObject->getSdrModelFromSdrObject() );
+        if ( pObject->IsInserted() && pObject->getSdrPageFromSdrObject() )
         {
             OSL_ENSURE( HasSdrObjectOwnership(), "SvxShape::dispose: is the below code correct?" );
                 // normally, we are allowed to free the SdrObject only if we have its ownership.
                 // Why isn't this checked here?
 
-            SdrPage* pPage = GetSdrObject()->getSdrPageFromSdrObject();
+            SdrPage* pPage = pObject->getSdrPageFromSdrObject();
             // delete the SdrObject from the page
             const size_t nCount = pPage->GetObjCount();
             for ( size_t nNum = 0; nNum < nCount; ++nNum )
             {
-                if ( pPage->GetObj( nNum ) == GetSdrObject() )
+                if ( pPage->GetObj( nNum ) == pObject )
                 {
-                    OSL_VERIFY( pPage->RemoveObject( nNum ) == GetSdrObject() );
+                    OSL_VERIFY( pPage->RemoveObject( nNum ) == pObject );
                     bFreeSdrObject = true;
                     break;
                 }
             }
         }
+    }
 
-        GetSdrObject()->setUnoShape(nullptr);
+    if ( HasSdrObject() ) //tdf#114427 refetch SdrObject in light of RemoveObject
+    {
+        SdrObject* pObject = GetSdrObject();
+
+        pObject->setUnoShape(nullptr);
 
         if ( bFreeSdrObject )
         {
             // in case we have the ownership of the SdrObject, a Free
             // would do nothing. So ensure the ownership is reset.
             mpImpl->mbHasSdrObjectOwnership = false;
-            SdrObject* pObject = GetSdrObject();
             SdrObject::Free( pObject );
         }
     }