This crash is caused by the test script itself.  In the
graphics/level1/inc/global/g_format.inc script in the tiFormat3D_Effekte
function there is a MenuSelect(0) statement that is a workaround for issue 68585
to close context menus on Solaris.

This slot 0 is an invalid slot id.  Normally this is not a big problem because
nobody uses slot 0 (it is invalid).  In this case, however, there are the new
shells for the left and right pane.  They do no use any slots at all, but to
tell the SFX2 that, they provide a slot map with exactly one entry.  This entry
has the, supposedly, dummy slot id 0.

When now the MenuSelect(0) call is made there are two shells on the shell stack
which claim to support slot 0.  Therefore slot 0 is dispatched to one of the
side panes.  These, however, can not properly manage this slot (they procide a
zero callback pointer) and crash.

Other shells, like that of font work tool bar, use such a dummy slot map, too,
and would cause the same crash, were they active and on the shell stack at the
time the MenuSelect(0) is called.

I set the resolution to INVALID, because this crash is directly caused by the
test script, which tries to workaround issue 68585 by dispatching a slot that
normally would not be dispatched.  I talked with fredrikh about this and he
agreed to modify the test script so, that this workaround is not, or at least
not on Linux and Solaris, used anymore.

Please verify.

Does not occure anymore.

Closed.

Target changed.

It happens again in CWS components1.

One possible solution to this is to not call the tiFormat3D_Effekte test for all
platforms.  At the moment the test is called for all platforms except Solaris SPARC.

Please have a look.

*** Issue 75420 has been marked as a duplicate of this issue. ***

MenuSelect(0) is used to close an opened Contextmenu. 
(after for instance opening it to see what entries it contains)

And since this is the only official way to close an opened context-menu, 
without calling any slots in it, I reassign this issue to GH. 

Add myself to the cc-list.

Changed target to that of components1 cws.

andre if you can tell me a different way to close an open context menu (in C++
using VCL) I will be glad to implement it.
Originally the method to use MenuSelect(0) was recomended by mba, but that of
corse was pre framework (it is framework isn't it) So now we will have to change
something here.

I just talked with CD about this.  He said that calling slot 0 never was a good
idea.  When that does not crash it closes the context menu as side effect that
may or may not be present tomorrow.

A better alternative is the simulation of pressing the ESC key.

An even better one would use the API to directly access the currently open
context menu and tell it to close.

cc'ing JSI

cd: Set on CC.

cd->gh: Please contact me so we can discuss this issue in detail.

We will fix this crash in SFX by (largely) ignoring the slot 0 call. 

The crash has its origin in the SfxDispatcher::GetShellAndSlot_Impl() method.
There the slot data for slot 0 is looked up.  This yields a valid structure with
NULL pointers for the Exec function.  That would be OK but missing Exec function
causes a call to GetRealSlot() at the interface which returns a NULL pointer as
slot data.  This pointer is not checked and GetShellAndSlot_Impl() returns
sal_True wich is interpreted by the calling function that the slot data is valid.

The fix will be to add the missing check of the final slot data and return
sal_False when that is NULL.

Checking the proposed fix.

Fixed as described above.

Modified file is sfx2/source/control/dispatch    rev. 1.46.120.1

Please verify.

Verified in CWS.

Tested in master m208. Closed.

changing title