[Libreoffice-bugs] [Bug 134551] CRASH: Deleting module in macro editor

[bugzilla-daemon at bugs.documentfoundation.org]

https://bugs.documentfoundation.org/show_bug.cgi?id=134551

--- Comment #3 from Caolán McNamara <caolanm at redhat.com> ---
doesn't crash for me, but a valgrind trace confirms the suspicious "Cannot
access memory at address 0x999999999999999d" hint in the bt. On removing the
last module the ModulWindow is destroyed and the m_aName which was passed by
reference is now junk, but we continue to use it

==1097527==    at 0xB40A23C: rtl::OUString::getStr() const (ustring.hxx:700)
==1097527==    by 0xB422FBD: INetURLObject::encodeText(rtl::OUString const&,
INetURLObject::Part, INetURLObject::EncodeMechanism, unsigned short, bool)
(urlobj.hxx:1133)
==1097527==    by 0xB41AA17: INetURLObject::insertName(rtl::OUString const&,
bool, int, INetURLObject::EncodeMechanism, unsigned short) (urlobj.cxx:3277)
==1097527==    by 0x735BD18:
basic::SfxLibrary::impl_removeWithoutChecks(rtl::OUString const&)
(namecont.cxx:3074)
==1097527==    by 0x735BF75: basic::SfxLibrary::removeByName(rtl::OUString
const&) (namecont.cxx:3097)
==1097527==    by 0x4291B57E:
basctl::ScriptDocument::Impl::removeModuleOrDialog(basctl::LibraryContainerType,
rtl::OUString const&, rtl::OUString const&) (scriptdocument.cxx:519)
==1097527==    by 0x429212D1:
basctl::ScriptDocument::removeModule(rtl::OUString const&, rtl::OUString
const&) const (scriptdocument.cxx:1295)
==1097527==    by 0x4283FD48: basctl::ModulWindow::ExecuteCommand(SfxRequest&)
(baside2.cxx:1012)
==1097527==    by 0x42863CD0: basctl::Shell::ExecuteCurrent(SfxRequest&)
(basides1.cxx:263)
==1097527==    by 0x4287AB54: SfxStubbasctl_ShellExecuteCurrent(SfxShell*,
SfxRequest&) (basslots.hxx:153)
==1097527==    by 0x7924091: SfxShell::CallExec(void (*)(SfxShell*,
SfxRequest&), SfxRequest&) (shell.hxx:197)
==1097527==    by 0x790DC88: SfxDispatcher::Call_Impl(SfxShell&, SfxSlot
const&, SfxRequest&, bool) (dispatch.cxx:252)
==1097527==  Address 0x39de77a0 is 640 bytes inside a block of size 736 free'd
==1097527==    at 0x483AEFC: operator delete(void*) (vg_replace_malloc.c:584)
==1097527==    by 0x4283B027: basctl::ModulWindow::~ModulWindow()
(baside2.cxx:233)
==1097527==    by 0x427CEC04: VclReferenceBase::release() const
(vclreferencebase.hxx:40)
==1097527==    by 0x4284BF86: rtl::Reference<basctl::ModulWindow>::~Reference()
(ref.hxx:113)
==1097527==    by 0x42846508: VclPtr<basctl::ModulWindow>::~VclPtr()
(vclptr.hxx:111)
==1097527==    by 0x42882EAC:
basctl::ContainerListenerImpl::elementRemoved(com::sun::star::container::ContainerEvent
const&) (basidesh.cxx:136)
==1097527==    by 0x7367DB3:
comphelper::OInterfaceContainerHelper2::NotifySingleListener<com::sun::star::container::XContainerListener,
com::sun::star::container::ContainerEvent>::operator()(com::sun::star::uno::Reference<com::sun::star::container::XContainerListener>
const&) const (interfacecontainer2.hxx:253)
==1097527==    by 0x7367B5E: void
comphelper::OInterfaceContainerHelper2::forEach<com::sun::star::container::XContainerListener,
comphelper::OInterfaceContainerHelper2::NotifySingleListener<com::sun::star::container::XContainerListener,
com::sun::star::container::ContainerEvent>
>(comphelper::OInterfaceContainerHelper2::NotifySingleListener<com::sun::star::container::XContainerListener,
com::sun::star::container::ContainerEvent> const&)
(interfacecontainer2.hxx:266)
==1097527==    by 0x735E486: void
comphelper::OInterfaceContainerHelper2::notifyEach<com::sun::star::container::XContainerListener,
com::sun::star::container::ContainerEvent>(void
(com::sun::star::container::XContainerListener::*)(com::sun::star::container::ContainerEvent
const&), com::sun::star::container::ContainerEvent const&)
(interfacecontainer2.hxx:279)
==1097527==    by 0x73462FD: basic::NameContainer::removeByName(rtl::OUString
const&) (namecont.cxx:268)
==1097527==    by 0x735BC75:
basic::SfxLibrary::impl_removeWithoutChecks(rtl::OUString const&)
(namecont.cxx:3066)
==1097527==    by 0x735BF75: basic::SfxLibrary::removeByName(rtl::OUString
const&) (namecont.cxx:3097)

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/libreoffice-bugs/attachments/20200706/13aacbdd/attachment.htm>