CS4 - Relink causes protective shutdown

Question

Hi,
I use the following code to relink items in CS4:
bool16 Relink(IDFile file) {
    IDataBase* db = ::GetDataBase(this);
    if(!db) {
        return false;
#if kMajorVersionNumber == 6
     PMString formatName;
     ErrorCode err = kFailure;
     URI linkURI;
     InterfacePtr<ILinkManager> iLinkManager(db, db->GetRootUID(), UseDefaultIID());         
     InterfacePtr<ILink> iLink(db, GetLinkUID(), UseDefaultIID()); //GetLinkUID is a function defined elsewhere
     UIDRef iLinkUIDRef = UIDRef(db, GetLinkUID());
     URI fileURI;
     Utils<IURIUtils>()->IDFileToURI(file, fileURI);
     UID newLinkUID;
     Utils<Facade::ILinkFacade>()->RelinkLink(iLinkUIDRef,fileURI,kSuppressUI,newLinkUID);
#else
     //CS3 code
#endif
    return true;
In most cases the code works perfectly, however once I encountered a crash on Mac, resulting in the following partial stack trace:
Thread 0 Crashed:
0   PublicLib.dylib                     0x014beb27 ProtectiveShutdown::~
ProtectiveShutdown() + 279
1   ...adobe.InDesign.AppFramework      0x1db851b9 0x1db6c000 + 102841
2   PublicLib.dylib                     0x01489b1b CmdUtils::ProcessCommand(ICommand*) + 59
3   com.adobe.InDesign.Links            0x228b7740 GetPlugIn + 102736
4   com.adobe.InDesign.Links            0x228ba2ba GetPlugIn + 113866
5   com.adobe.InDesign.Links            0x2287cb45 0x227ff000 + 514885
6   com.adobe.InDesign.MyPlugin              0x1f548e03 Relink(IDFile) + 339
How can i modify my code in the Relink function so that this cannot occur?
Why do the ProcessCommand cause a Protective Shutdown?
I really hope somebody can clarify this problem.
Thanks
Kind regards Toke

Answer 1

Yes, you should check the global error code after any operation which may fail. 
Typically you find out about these when they fail and you protective shutdown from not checking. 
However, any time you call an InDesign API, it *could* call a command, so you really ought to check all the time, but there's lots of simple routines which you shouldn't have to check.  Basically anything that returns an error code shouldn't set the global error code.
Note the key use of "shouldn't" there.
Jon