From e72e8dcd332474321439eb266528eb7e5fc8809f Mon Sep 17 00:00:00 2001
From: Michael Stahl <mstahl@redhat.com>
Date: Sat, 18 Feb 2012 00:06:42 +0100
Subject: [PATCH] AccessibleTreeNode: fix headless crash

On closing a document in headless mode, the
accessibility::AccessibleTreeNode::WindowEventListener will access a deleted
mrTreeNode member and crash; don't do anything in the listener if the
AccessibleTreeNode has been disposed.

#0  0x0000000000000000 in ?? ()
#1  0x00007f99842d6887 in accessibility::AccessibleTreeNode::UpdateStateSet (this=0x27a99f80) at sd/source/ui/accessibility/AccessibleTreeNode.cxx:285
#2  0x00007f99842d803e in accessibility::AccessibleTreeNode::WindowEventListener (this=0x27a99f80, pEvent=0x7f997fd64f40) at sd/source/ui/accessibility/AccessibleTreeNode.cxx:694
#3  0x00007f99842d7f3d in accessibility::AccessibleTreeNode::LinkStubWindowEventListener (pThis=0x27a99f80, pCaller=0x7f997fd64f40) at sd/source/ui/accessibility/AccessibleTreeNode.cxx:670
#4  0x00007f99b88a1442 in Link::Call (this=0x279f94e0, pCaller=0x7f997fd64f40) at solver/unxlngx6/inc/tools/link.hxx:140
#5  0x00007f99b88cdecf in VclEventListeners::Call (this=0x27a946f0, pEvent=0x7f997fd64f40) at vcl/source/app/vclevent.cxx:72
#6  0x00007f99b8d2e76e in Window::CallEventListeners (this=0x27a98280, nEvent=1009, pData=0x0) at vcl/source/window/window.cxx:5188
#7  0x00007f99b8d2e6cf in Window::ImplCallEventListeners (this=0x27a98280, nEvent=1009, pData=0x0) at vcl/source/window/window.cxx:5171
#8  0x00007f99b8d2df63 in Window::PreNotify (this=0x27a98280, rNEvt=...) at vcl/source/window/window.cxx:5037
#9  0x00007f99b8d4aa0c in ImplCallPreNotify (rEvt=...) at vcl/source/window/winproc.cxx:86
#10 0x00007f99b8d2910e in Window::ImplGrabFocus (this=0x2703d230, nFlags=0) at vcl/source/window/window.cxx:4033
#11 0x00007f99b8d3749f in Window::GrabFocus (this=0x2703d230) at vcl/source/window/window.cxx:7493
#12 0x00007f99b8d2b624 in Window::~Window (this=0x27a98280, __in_chrg=<optimized out>) at vcl/source/window/window.cxx:4493
#13 0x00007f99b88fa514 in Control::~Control (this=0x27a98280, __in_chrg=<optimized out>) at vcl/source/control/ctrl.cxx:88
#14 0x00007f99845521e4 in sd::toolpanel::ScrollPanel::~ScrollPanel (this=0x27a98280, __in_chrg=<optimized out>) at sd/source/ui/toolpanel/ScrollPanel.cxx:91
#15 0x00007f99845522e8 in sd::toolpanel::ScrollPanel::~ScrollPanel (this=0x27a98280, __in_chrg=<optimized out>) at sd/source/ui/toolpanel/ScrollPanel.cxx:112
#16 0x00007f9984565d76 in std::auto_ptr<sd::toolpanel::TreeNode>::reset (this=0x27a94970, __p=0x0)
---
 sd/source/ui/accessibility/AccessibleTreeNode.cxx | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sd/source/ui/accessibility/AccessibleTreeNode.cxx b/sd/source/ui/accessibility/AccessibleTreeNode.cxx
index 554c73d501bc..283189511ff8 100644
--- a/sd/source/ui/accessibility/AccessibleTreeNode.cxx
+++ b/sd/source/ui/accessibility/AccessibleTreeNode.cxx
@@ -637,6 +637,9 @@ sal_Bool AccessibleTreeNode::IsDisposed (void)
 
 IMPL_LINK(AccessibleTreeNode, StateChangeListener, TreeNodeStateChangeEvent*, pEvent)
 {
+    if (rBHelper.bDisposed || rBHelper.bInDispose)
+        return 1; // mrTreeNode is probably dead
+
     OSL_ASSERT(pEvent!=NULL);
     OSL_ASSERT(&pEvent->mrSource==&mrTreeNode);
 
@@ -669,6 +672,9 @@ IMPL_LINK(AccessibleTreeNode, StateChangeListener, TreeNodeStateChangeEvent*, pE
 
 IMPL_LINK(AccessibleTreeNode, WindowEventListener, VclWindowEvent*, pEvent)
 {
+    if (rBHelper.bDisposed || rBHelper.bInDispose)
+        return 1; // mrTreeNode is probably dead
+
     switch (pEvent->GetId())
     {
         case VCLEVENT_WINDOW_HIDE: