From 4e145eadc6793570ec3c6acb264bc82ed04fa276 Mon Sep 17 00:00:00 2001
From: Augustin Cavalier <waddlesplash@gmail.com>
Date: Thu, 24 Aug 2023 19:14:19 -0400
Subject: [PATCH] BMenu: Lock the looper before calling _AddItem().

Otherwise, we could wind up in a state where the
list of items is being concurrently accessed,
which is invalid.

Hopefully fixes #18256.
---
 src/kits/interface/Menu.cpp | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/src/kits/interface/Menu.cpp b/src/kits/interface/Menu.cpp
index 2489be72bb..235cc12501 100644
--- a/src/kits/interface/Menu.cpp
+++ b/src/kits/interface/Menu.cpp
@@ -726,11 +726,19 @@ BMenu::AddItem(BMenuItem* item, int32 index)
 			"be called if the menu layout is not B_ITEMS_IN_MATRIX");
 	}
 
-	if (item == NULL || !_AddItem(item, index))
+	if (item == NULL)
 		return false;
 
+	const bool locked = LockLooper();
+
+	if (!_AddItem(item, index)) {
+		if (locked)
+			UnlockLooper();
+		return false;
+	}
+
 	InvalidateLayout();
-	if (LockLooper()) {
+	if (locked) {
 		if (!Window()->IsHidden()) {
 			_LayoutItems(index);
 			_UpdateWindowViewSize(false);
@@ -754,13 +762,18 @@ BMenu::AddItem(BMenuItem* item, BRect frame)
 	if (item == NULL)
 		return false;
 
+	const bool locked = LockLooper();
+
 	item->fBounds = frame;
 
 	int32 index = CountItems();
-	if (!_AddItem(item, index))
+	if (!_AddItem(item, index)) {
+		if (locked)
+			UnlockLooper();
 		return false;
+	}
 
-	if (LockLooper()) {
+	if (locked) {
 		if (!Window()->IsHidden()) {
 			_LayoutItems(index);
 			Invalidate();