From 6c096a5966abb942a6c8f8c9b665c211efa48853 Mon Sep 17 00:00:00 2001 From: Michael Stahl Date: Sat, 25 Apr 2015 21:25:00 +0200 Subject: [PATCH] rhbz#1205072: sw: resource mangement SNAFU caused by SwPaM copy ctor SwPaM copy ctor has the surprising habit of linking the new one into the old one's Ring. If you copy a shell cursor, *this* epic fail happens: ==948== Thread 6 SelectionManager: ==948== Invalid free() / delete / delete[] / realloc() ==948== at 0x4A07CE9: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==948== by 0x222F542B: SwPaM::operator delete(void*, unsigned long) (in /libreoffice-4-3/instdir/program/libswlo.so) ==948== by 0x2239E20E: SwPaM::~SwPaM() (pam.cxx:422) ==948== by 0x22368630: CheckRange(SwCursor*) (crsrsh.cxx:111) ==948== by 0x2236DECC: SwCrsrShell::UpdateCrsr(unsigned short, bool) (crsrsh.cxx:1397) ==948== by 0x22369113: SwCrsrShell::EndAction(bool) (crsrsh.cxx:290) ==948== by 0x2268971F: SwEditShell::EndAllAction() (edws.cxx:87) ==948== by 0x2262BEF3: SwBaseLink::DataChanged(rtl::OUString const&, com::sun::star::uno::Any const&) (swbaslnk.cxx:274) ==948== by 0x2262C78E: SwBaseLink::SwapIn(bool, bool) (swbaslnk.cxx:411) ==948== by 0x227102EC: SwGrfNode::SwapIn(bool) (ndgrf.cxx:539) ==948== by 0x227121BC: SwGrfNode::MakeCopy(SwDoc*, SwNodeIndex const&) const (ndgrf.cxx:999) ==948== by 0x22610E4D: SwNodes::_CopyNodes(SwNodeRange const&, SwNodeIndex const&, bool, bool) const (nodes.cxx:1862) ==948== by 0x225B98E0: SwDoc::CopyWithFlyInFly(SwNodeRange const&, int, SwNodeIndex const&, SwPaM const*, bool, bool, bool) const (ndcopy.cxx:1336) ==948== by 0x224AC1FF: SwDoc::CopyLayoutFmt(SwFrmFmt const&, SwFmtAnchor const&, bool, bool) (doclay.cxx:446) ==948== by 0x2294D2D4: SwTxtFlyCnt::CopyFlyFmt(SwDoc*) (atrflyin.cxx:130) ==948== by 0x229A5B96: MakeTxtAttr(SwDoc&, SfxPoolItem&, int, int, CopyOrNew_t, SwTxtNode*) (thints.cxx:1060) ==948== by 0x229A64E6: SwTxtNode::InsertItem(SfxPoolItem&, int, int, unsigned short) (thints.cxx:1224) ==948== by 0x2298E536: SwTxtNode::CopyText(SwTxtNode*, SwIndex const&, SwIndex const&, int, bool) (ndtxt.cxx:1773) ==948== by 0x2298DC08: SwTxtNode::CopyText(SwTxtNode*, SwIndex const&, int, bool) (ndtxt.cxx:1555) ==948== by 0x225B4C9D: SwTxtNode::MakeCopy(SwDoc*, SwNodeIndex const&) const (ndcopy.cxx:286) ==948== by 0x22610E4D: SwNodes::_CopyNodes(SwNodeRange const&, SwNodeIndex const&, bool, bool) const (nodes.cxx:1862) ==948== by 0x223EF3C2: SwNodes::_Copy(SwNodeRange const&, SwNodeIndex const&, bool) const (ndarr.hxx:182) ==948== by 0x225B5D8D: SwTableNode::MakeCopy(SwDoc*, SwNodeIndex const&) const (ndcopy.cxx:475) ==948== by 0x22610ACA: SwNodes::_CopyNodes(SwNodeRange const&, SwNodeIndex const&, bool, bool) const (nodes.cxx:1790) ==948== by 0x223EF3C2: SwNodes::_Copy(SwNodeRange const&, SwNodeIndex const&, bool) const (ndarr.hxx:182) ==948== by 0x225CA663: SwSectionNode::MakeCopy(SwDoc*, SwNodeIndex const&) const (ndsect.cxx:1270) ==948== by 0x22610BFC: SwNodes::_CopyNodes(SwNodeRange const&, SwNodeIndex const&, bool, bool) const (nodes.cxx:1817) ==948== by 0x223EF3C2: SwNodes::_Copy(SwNodeRange const&, SwNodeIndex const&, bool) const (ndarr.hxx:182) ==948== by 0x225CA663: SwSectionNode::MakeCopy(SwDoc*, SwNodeIndex const&) const (ndsect.cxx:1270) ==948== by 0x22610BFC: SwNodes::_CopyNodes(SwNodeRange const&, SwNodeIndex const&, bool, bool) const (nodes.cxx:1817) ==948== by 0x223EF3C2: SwNodes::_Copy(SwNodeRange const&, SwNodeIndex const&, bool) const (ndarr.hxx:182) ==948== by 0x225CA663: SwSectionNode::MakeCopy(SwDoc*, SwNodeIndex const&) const (ndsect.cxx:1270) ==948== by 0x22610BFC: SwNodes::_CopyNodes(SwNodeRange const&, SwNodeIndex const&, bool, bool) const (nodes.cxx:1817) ==948== by 0x225B98E0: SwDoc::CopyWithFlyInFly(SwNodeRange const&, int, SwNodeIndex const&, SwPaM const*, bool, bool, bool) const (ndcopy.cxx:1336) ==948== by 0x225B8F15: SwDoc::CopyImpl(SwPaM&, SwPosition&, bool, bool, SwPaM*) const (ndcopy.cxx:1239) ==948== by 0x225B6EE0: SwDoc::CopyRange(SwPaM&, SwPosition&, bool) const (ndcopy.cxx:707) ==948== by 0x22667E69: SwEditShell::_CopySelToDoc(SwDoc*, SwNodeIndex*) (edglss.cxx:244) ==948== by 0x226C8400: SwFEShell::Copy(SwDoc*, rtl::OUString const*) (fecopy.cxx:214) ==948== by 0x22DBF72B: (anonymous namespace)::lclOverWriteDoc(SwWrtShell&, SwDoc&) (swdtflvr.cxx:373) ==948== by 0x22DBFBC6: SwTransferable::GetData(com::sun::star::datatransfer::DataFlavor const&, rtl::OUString const&) (swdtflvr.cxx:439) ==948== by 0x7CB36C7: TransferableHelper::getTransferData2(com::sun::star::datatransfer::DataFlavor const&, rtl::OUString const&) (transfer.cxx:332) ==948== by 0x7CB34B5: TransferableHelper::getTransferData(com::sun::star::datatransfer::DataFlavor const&) (transfer.cxx:306) ==948== by 0x17A7E949: x11::SelectionManager::convertData(com::sun::star::uno::Reference const&, unsigned long, unsigned long, int&, com::sun::star::uno::Sequence&) (X11_selection.cxx:655) ==948== by 0x17A823CA: x11::SelectionManager::sendData(x11::SelectionAdaptor*, unsigned long, unsigned long, unsigned long, unsigned long) (X11_selection.cxx:1503) ==948== by 0x17A82E03: x11::SelectionManager::handleSelectionRequest(XSelectionRequestEvent&) (X11_selection.cxx:1729) ==948== by 0x17A8A08A: x11::SelectionManager::handleXEvent(_XEvent&) (X11_selection.cxx:3574) ==948== Address 0x21e31a60 is on thread 6's stack ==948== in frame #40, created by SwEditShell::_CopySelToDoc(SwDoc*, SwNodeIndex*) (edglss.cxx:158) (regression from 49505336a629a75f4fb48bbe0c532b402e857ed4) (cherry picked from commit c55599fd0e7198773087c6433031f7119aaaca36) Conflicts: sw/source/core/edit/edglss.cxx Reviewed-on: https://gerrit.libreoffice.org/15533 Reviewed-by: Miklos Vajna Tested-by: Miklos Vajna (cherry picked from commit 8f570028b0871dbaaaa99722cca76c0d1179e06c) Conflicts: sw/source/core/edit/edglss.cxx Change-Id: I3d0a288a83b4719dda7977b4898dea656ea67388 --- sw/source/core/edit/eddel.cxx | 6 ++++-- sw/source/core/edit/edglss.cxx | 5 ++++- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/sw/source/core/edit/eddel.cxx b/sw/source/core/edit/eddel.cxx index 7802643..88eca5f 100644 --- a/sw/source/core/edit/eddel.cxx +++ b/sw/source/core/edit/eddel.cxx @@ -33,6 +33,8 @@ #include #include +#include + void SwEditShell::DeleteSel( SwPaM& rPam, bool* pUndo ) { bool bSelectAll = StartsWithTable() && ExtendedSelectedAll(/*bFootnotes =*/ false); @@ -89,12 +91,12 @@ void SwEditShell::DeleteSel( SwPaM& rPam, bool* pUndo ) } else { - std::unique_ptr pNewPam; + boost::scoped_ptr pNewPam; SwPaM * pPam = &rPam; if (bSelectAll) { assert(dynamic_cast(&rPam)); // must be corrected pam - pNewPam.reset(new SwPaM(rPam)); + pNewPam.reset(new SwPaM(*rPam.GetMark(), *rPam.GetPoint())); // Selection starts at the first para of the first cell, but we // want to delete the table node before the first cell as well. pNewPam->Start()->nNode = pNewPam->Start()->nNode.GetNode().FindTableNode()->GetIndex(); diff --git a/sw/source/core/edit/edglss.cxx b/sw/source/core/edit/edglss.cxx index 7a17737..230fc83 100644 --- a/sw/source/core/edit/edglss.cxx +++ b/sw/source/core/edit/edglss.cxx @@ -235,12 +235,15 @@ bool SwEditShell::_CopySelToDoc( SwDoc* pInsDoc, SwNodeIndex* pSttNd ) // Make a copy, so that in case we need to adjust the selection // for the purpose of copying, our shell cursor is not touched. // (Otherwise we would have to restore it.) - SwPaM aPaM(*PCURCRSR); + SwPaM aPaM(*PCURCRSR->GetMark(), *PCURCRSR->GetPoint()); if (bSelectAll) + { // Selection starts at the first para of the first cell, // but we want to copy the table and the start node before // the first cell as well. aPaM.Start()->nNode = aPaM.Start()->nNode.GetNode().FindTableNode()->GetIndex(); + aPaM.Start()->nContent.Assign(0, 0); + } bRet = GetDoc()->CopyRange( aPaM, aPos, false ) || bRet; } -- 2.5.0