[Libreoffice-bugs] [Bug 126226] CRASH: Adding comment to Track Change

[bugzilla-daemon at bugs.documentfoundation.org]

https://bugs.documentfoundation.org/show_bug.cgi?id=126226

--- Comment #9 from Caolán McNamara <caolanm at redhat.com> ---
here's the valgrind trace of where things go wrong...

==31190== Invalid read of size 8
==31190==    at 0x33D102CC: SwBaseShell::GetView() (basesh.hxx:57)
==31190==    by 0x33EAC8D1: SwTextShell::ExecField(SfxRequest&)
(textfld.cxx:549)
==31190==    by 0x33EB30A0: SfxStubSwTextShellExecField(SfxShell*, SfxRequest&)
(swslots.hxx:2999)
==31190==    by 0x7130EAF: SfxShell::CallExec(void (*)(SfxShell*, SfxRequest&),
SfxRequest&) (shell.hxx:197)
==31190==    by 0x7127F25: SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&,
SfxRequest&, bool) (dispatch.cxx:356)
==31190==    by 0x712B7CF:
SfxDispatcher::PostMsgHandler(std::unique_ptr<SfxRequest,
std::default_delete<SfxRequest> >) (dispatch.cxx:1093)
==31190==    by 0x71514E9: void std::__invoke_impl<void, void
(SfxDispatcher::*&)(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest>
>), SfxDispatcher*&, std::unique_ptr<SfxRequest,
std::default_delete<SfxRequest> > >(std::__invoke_memfun_deref, void
(SfxDispatcher::*&)(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest>
>), SfxDispatcher*&, std::unique_ptr<SfxRequest,
std::default_delete<SfxRequest> >&&) (invoke.h:73)
==31190==    by 0x714D7B8: std::__invoke_result<void
(SfxDispatcher::*&)(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest>
>), SfxDispatcher*&, std::unique_ptr<SfxRequest,
std::default_delete<SfxRequest> > >::type std::__invoke<void
(SfxDispatcher::*&)(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest>
>), SfxDispatcher*&, std::unique_ptr<SfxRequest,
std::default_delete<SfxRequest> > >(void
(SfxDispatcher::*&)(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest>
>), SfxDispatcher*&, std::unique_ptr<SfxRequest,
std::default_delete<SfxRequest> >&&) (invoke.h:95)
==31190==    by 0x71475D7: void std::_Bind<void
(SfxDispatcher::*(SfxDispatcher*,
std::_Placeholder<1>))(std::unique_ptr<SfxRequest,
std::default_delete<SfxRequest> >)>::__call<void, std::unique_ptr<SfxRequest,
std::default_delete<SfxRequest> >&&, 0ul,
1ul>(std::tuple<std::unique_ptr<SfxRequest, std::default_delete<SfxRequest>
>&&>&&, std::_Index_tuple<0ul, 1ul>) (functional:400)
==31190==    by 0x713EC45: void std::_Bind<void
(SfxDispatcher::*(SfxDispatcher*,
std::_Placeholder<1>))(std::unique_ptr<SfxRequest,
std::default_delete<SfxRequest> >)>::operator()<std::unique_ptr<SfxRequest,
std::default_delete<SfxRequest> >, void>(std::unique_ptr<SfxRequest,
std::default_delete<SfxRequest> >&&) (functional:484)
==31190==    by 0x7138105: std::_Function_handler<void
(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >),
std::_Bind<void (SfxDispatcher::*(SfxDispatcher*,
std::_Placeholder<1>))(std::unique_ptr<SfxRequest,
std::default_delete<SfxRequest> >)> >::_M_invoke(std::_Any_data const&,
std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >&&)
(std_function.h:300)
==31190==    by 0x74B0DE0: std::function<void (std::unique_ptr<SfxRequest,
std::default_delete<SfxRequest> >)>::operator()(std::unique_ptr<SfxRequest,
std::default_delete<SfxRequest> >) const (std_function.h:690)
==31190==  Address 0x2851fb68 is 40 bytes inside a block of size 136 free'd
==31190==    at 0x483A0D6: operator delete(void*, unsigned long)
(vg_replace_malloc.c:595)
==31190==    by 0x33EB6D8A: SwTextShell::~SwTextShell() (textsh.cxx:838)
==31190==    by 0x712DA15: SfxDispatcher::FlushImpl() (dispatch.cxx:1491)
==31190==    by 0x7127B39: SfxDispatcher::Flush() (dispatch.cxx:256)
==31190==    by 0x33F31D47: SwView::SelectShell() (view.cxx:469)
==31190==    by 0x33F323E7: SwView::AttrChangedNotify(LinkParamNone*)
(view.cxx:540)
==31190==    by 0x33F32166: SwView::LinkStubAttrChangedNotify(void*,
LinkParamNone*) (view.cxx:507)
==31190==    by 0x32E6E732: Link<LinkParamNone*, void>::Call(LinkParamNone*)
const (link.hxx:112)
==31190==    by 0x32E64E37: SwCursorShell::CallChgLnk() (crsrsh.cxx:2501)
==31190==    by 0x32E4D726: SwCallLink::~SwCallLink() (callnk.cxx:120)
==31190==    by 0x32E93C50: SwCursorShell::SelPrevRedline() (crstrvl.cxx:2211)
==31190==    by 0x33EAC7D5: SwTextShell::ExecField(SfxRequest&)
(textfld.cxx:533)

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/libreoffice-bugs/attachments/20191010/7abbdbbb/attachment.html>