From 2ad679b7f6b0b57fb52d4f94f5707765e9a5807e Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Tue, 10 Apr 2018 10:09:06 +0100
Subject: crashtesting: failure on loading ooo38880-1.doc
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ever since

commit e0bc1ab9d8fd9247c60324f596faafd7e42540f4
Date:   Mon Oct 4 16:54:47 2004 +0000

    INTEGRATION: CWS mav09 (1.42.58); FILE MERGED

SdrOle2Obj::SetObjRef calls mpImpl->mxObjRef.Clear();
so SdrOle2Obj::Disconnect_Impl cannot removeobj the
object from the olecache, i.e.

if ( mpImpl->mxObjRef.is() && mpImpl->mxLightClient.is() )
    ...
    GetSdrGlobalData().GetOLEObjCache().RemoveObj(this);
    ...

so the object remains in the cache and later on is dereferenced
with the usual sad results.

So, this band-aid ensures that if we get to the dtor and are still in the cache
we get removed.

Change-Id: Icf519e4db3eadf1c0d9acb7751dbea9cc04ca382
Reviewed-on: https://gerrit.libreoffice.org/52667
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
---
 svx/source/svdraw/svdoole2.cxx | 26 +++++++++++++++++++++++---
 1 file changed, 23 insertions(+), 3 deletions(-)

diff --git a/svx/source/svdraw/svdoole2.cxx b/svx/source/svdraw/svdoole2.cxx
index c1a9553b7cf8..a0af361797a1 100644
--- a/svx/source/svdraw/svdoole2.cxx
+++ b/svx/source/svdraw/svdoole2.cxx
@@ -118,6 +118,7 @@ class SdrLightEmbeddedClient_Impl : public ::cppu::WeakImplHelper
 
 public:
     explicit SdrLightEmbeddedClient_Impl( SdrOle2Obj* pObj );
+    virtual ~SdrLightEmbeddedClient_Impl() override;
 
     void SetSizeScale( const Fraction& aScaleWidth, const Fraction& aScaleHeight )
     {
@@ -130,7 +131,9 @@ public:
 
     void setWindow(const uno::Reference< awt::XWindow >& _xWindow);
 
+    void disconnect();
 private:
+
     tools::Rectangle impl_getScaledRect_nothrow() const;
     // XStateChangeListener
     virtual void SAL_CALL changingState( const css::lang::EventObject& aEvent, ::sal_Int32 nOldState, ::sal_Int32 nNewState ) override;
@@ -169,6 +172,10 @@ SdrLightEmbeddedClient_Impl::SdrLightEmbeddedClient_Impl( SdrOle2Obj* pObj )
 : mpObj( pObj )
 {
 }
+SdrLightEmbeddedClient_Impl::~SdrLightEmbeddedClient_Impl()
+{
+    assert(!mpObj);
+}
 tools::Rectangle SdrLightEmbeddedClient_Impl::impl_getScaledRect_nothrow() const
 {
     tools::Rectangle aLogicRect( mpObj->GetLogicRect() );
@@ -197,11 +204,18 @@ void SAL_CALL SdrLightEmbeddedClient_Impl::stateChanged( const css::lang::EventO
     }
 }
 
-void SAL_CALL SdrLightEmbeddedClient_Impl::disposing( const css::lang::EventObject& /*aEvent*/ )
+void SdrLightEmbeddedClient_Impl::disconnect()
 {
     SolarMutexGuard aGuard;
-
+    if (!mpObj)
+        return;
     GetSdrGlobalData().GetOLEObjCache().RemoveObj(mpObj);
+    mpObj = nullptr;
+}
+
+void SAL_CALL SdrLightEmbeddedClient_Impl::disposing( const css::lang::EventObject& /*aEvent*/ )
+{
+    disconnect();
 }
 
 void SAL_CALL SdrLightEmbeddedClient_Impl::notifyEvent( const document::EventObject& aEvent )
@@ -729,7 +743,11 @@ SdrOle2Obj::~SdrOle2Obj()
 
     DisconnectFileLink_Impl();
 
-    mpImpl->mxLightClient.clear();
+    if (mpImpl->mxLightClient)
+    {
+        mpImpl->mxLightClient->disconnect();
+        mpImpl->mxLightClient.clear();
+    }
 }
 
 void SdrOle2Obj::SetAspect( sal_Int64 nAspect )
@@ -1808,8 +1826,10 @@ void SdrOle2Obj::GetObjRef_Impl()
     }
 
     if ( mpImpl->mbConnected )
+    {
         // move object to first position in cache
         GetSdrGlobalData().GetOLEObjCache().InsertObj(this);
+    }
 }
 
 uno::Reference < embed::XEmbeddedObject > const & SdrOle2Obj::GetObjRef() const
-- 
cgit