[Libreoffice-bugs] [Bug 117162] REPORTBUILDER - Chart isn't shown in report

[bugzilla-daemon at bugs.documentfoundation.org]

https://bugs.documentfoundation.org/show_bug.cgi?id=117162

--- Comment #13 from Julien Nabet <serval2412 at yahoo.fr> ---
(In reply to Julien Nabet from comment #12)
> On pc Debian x86-64 with master sources updated today, the situation is
> worse, the report doesn't load, it seems it entered in a never ending loop.
> 
> Mike/Noel: any idea what could be wrong here? (there are quite a lot of
> console logs).
> I put tdf#117159 in cc since both may be related.

Mike: I think there's a pb with
https://cgit.freedesktop.org/libreoffice/core/commit/?id=6362c905cf19f2f6cb67bf634091b14c2a8e90ec
tdf#143514: Avoid double-free in dbgutil code
SdrObject::Free may start a chain of deletions, removing more
than one object from maAllIncarnatedObjects. Trying to free
them for the second time after that would lead to crash.

Indeed, here what I did:
- created a brand new odb file with by default embedded HSQL
- with wizard, I created a new table
- then using report wizard, I created a new report containing all the fields of
the table, when clicking "Finish" button, it hangs here:
    // SdrObjectLifetimeWatchDog:
    if(!maAllIncarnatedObjects.empty())
    {
        SAL_WARN("svx","SdrModel::~SdrModel: Not all incarnations of SdrObjects
deleted, possible memory leak (!)");
        // calling SdrObject::Free will change maAllIncarnatedObjects, and
potentially remove more
        // than one - do not copy to another container, to not try to free
already removed object.
        do
        {
            SdrObject*
pCandidate(const_cast<SdrObject*>(*maAllIncarnatedObjects.begin()));
            SdrObject::Free(pCandidate);
        } while (!maAllIncarnatedObjects.empty());
    }

maAllIncarnatedObjects always contains 48 elements, it never decreases.
See
https://opengrok.libreoffice.org/xref/core/svx/source/svdraw/svdmodel.cxx?r=6362c905#199

After some gdb debug, I saw that LO always entered line 491 here:
    473 void SdrObject::Free( SdrObject*& _rpObject )
    474 {
    475     SdrObject* pObject = _rpObject; _rpObject = nullptr;
    476 
    477     if(nullptr == pObject)
    478     {
    479         // nothing to do
    480         return;
    481     }
    482 
    483     SvxShape* pShape(pObject->getSvxShape());
    484 
    485     if(pShape)
    486     {
    487         if(pShape->HasSdrObjectOwnership())
    488         {
    489             // only the SvxShape is allowed to delete me, and will
reset
    490             // the ownership before doing so
    491             return;
    492         }
    493         else
    494         {
    495             // not only delete pObject, but also need to dispose uno
shape
    496             try
    497             {
    498                 pShape->InvalidateSdrObject();
    499                 uno::Reference< lang::XComponent > xShapeComp(
pObject->getWeakUnoShape(), uno::UNO_QUERY_THROW );
    500                 xShapeComp->dispose();
    501             }
    502             catch( const uno::Exception& )
    503             {
    504                 DBG_UNHANDLED_EXCEPTION("svx");
    505             }
    506         }
    507     }
    508 
    509     delete pObject;
    510 }
(see
https://opengrok.libreoffice.org/xref/core/svx/source/svdraw/svdobj.cxx?r=8c8d8786#491)

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/libreoffice-bugs/attachments/20210819/3a5f1194/attachment.htm>