toolkit/source/awt/vclxmenu.cxx | 1 +
1 file changed, 1 insertion(+)
New commits:
commit 7f6263c14bc062e858a3da3dd8c60ac8ddb1254e
Author: Stephan Bergmann <[email protected]>
AuthorDate: Fri Mar 25 15:07:39 2022 +0100
Commit: Stephan Bergmann <[email protected]>
CommitDate: Mon Mar 28 08:38:02 2022 +0200
Operate on VCL Menu with SolarMutex locked
...as such VCL code presumably expects to only be called when SolarMutex is
locked, but which is not necessarily the case here for the ~VCLXMenu UNO
object
destructor. (I ran into this with a tentative commit for tdf#147668 "Writer
crashes shortly after loading document with LanguageTool extension active",
which would have added DBG_TESTSOLARMUTEX() to some GtkSalMenu code
indirectly
called from within mpMenu.disposeAndClear() here, and where this VCLXMenu
object
was held by Java extension code, so the destructor call happened on some JVM
asynchronous finalizer thread, outside any SolarMutex lock.)
Change-Id: Ia2c3ebec837275cfdf1548f22cfa33f0752e8ef4
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132125
Tested-by: Jenkins
Reviewed-by: Stephan Bergmann <[email protected]>
diff --git a/toolkit/source/awt/vclxmenu.cxx b/toolkit/source/awt/vclxmenu.cxx
index cbeb1ef7f810..3eda26c81236 100644
--- a/toolkit/source/awt/vclxmenu.cxx
+++ b/toolkit/source/awt/vclxmenu.cxx
@@ -57,6 +57,7 @@ VCLXMenu::~VCLXMenu()
maPopupMenuRefs.clear();
if ( mpMenu )
{
+ SolarMutexGuard g;
mpMenu->RemoveEventListener( LINK( this, VCLXMenu, MenuEventListener )
);
mpMenu.disposeAndClear();
}
