[Libreoffice-commits] core.git: toolkit/source

[Stephan Bergmann (via logerrit)]

 toolkit/source/awt/vclxmenu.cxx |    1 +
 1 file changed, 1 insertion(+)

New commits:
commit 7f6263c14bc062e858a3da3dd8c60ac8ddb1254e
Author:     Stephan Bergmann <sberg...@redhat.com>
AuthorDate: Fri Mar 25 15:07:39 2022 +0100
Commit:     Stephan Bergmann <sberg...@redhat.com>
CommitDate: Mon Mar 28 08:38:02 2022 +0200

    Operate on VCL Menu with SolarMutex locked
    
    ...as such VCL code presumably expects to only be called when SolarMutex is
    locked, but which is not necessarily the case here for the ~VCLXMenu UNO 
object
    destructor.  (I ran into this with a tentative commit for tdf#147668 "Writer
    crashes shortly after loading document with LanguageTool extension active",
    which would have added DBG_TESTSOLARMUTEX() to some GtkSalMenu code 
indirectly
    called from within mpMenu.disposeAndClear() here, and where this VCLXMenu 
object
    was held by Java extension code, so the destructor call happened on some JVM
    asynchronous finalizer thread, outside any SolarMutex lock.)
    
    Change-Id: Ia2c3ebec837275cfdf1548f22cfa33f0752e8ef4
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132125
    Tested-by: Jenkins
    Reviewed-by: Stephan Bergmann <sberg...@redhat.com>

diff --git a/toolkit/source/awt/vclxmenu.cxx b/toolkit/source/awt/vclxmenu.cxx
index cbeb1ef7f810..3eda26c81236 100644
--- a/toolkit/source/awt/vclxmenu.cxx
+++ b/toolkit/source/awt/vclxmenu.cxx
@@ -57,6 +57,7 @@ VCLXMenu::~VCLXMenu()
     maPopupMenuRefs.clear();
     if ( mpMenu )
     {
+        SolarMutexGuard g;
         mpMenu->RemoveEventListener( LINK( this, VCLXMenu, MenuEventListener ) 
);
         mpMenu.disposeAndClear();
     }