<html> <head> <base href="https://bugs.documentfoundation.org/"> </head> <body> <div> <a class="bz_bug_link bz_status_NEW " title="NEW - FORMATTING: When undo and redo, custom styles and formatting lost, or full crash." href="https://bugs.documentfoundation.org/show_bug.cgi?id=88555#c18">Comment # 18</a> on <a class="bz_bug_link bz_status_NEW " title="NEW - FORMATTING: When undo and redo, custom styles and formatting lost, or full crash." href="https://bugs.documentfoundation.org/show_bug.cgi?id=88555">bug 88555</a> from <a class="email" href="mailto:mstahl@redhat.com" title="Michael Stahl <mstahl@redhat.com>"> Michael Stahl</a> <pre>regarding the crash, it is because commit 0f98299f7aa44bbb55c1bfeddca7799f727d14b0 inserted a dynamic_cast in the Contains function. Undo of the style creation deletes the SwFormat: #0 0x00007f08164adf1b in SwFormat::~SwFormat() (this=0x3d63770, __in_chrg=<optimized out>) at /work/lo/libreoffice-5-3/sw/source/core/attr/format.cxx:214 #1 0x00007f0816614874 in SwFormatColl::~SwFormatColl() (this=0x3d63770, __in_chrg=<optimized out>) at /work/lo/libreoffice-5-3/sw/inc/fmtcol.hxx:33 #2 0x00007f0816746f16 in SwTextFormatColl::~SwTextFormatColl() (this=0x3d63770, __in_chrg=<optimized out>) at /work/lo/libreoffice-5-3/sw/inc/fmtcol.hxx:54 #3 0x00007f0816746f32 in SwTextFormatColl::~SwTextFormatColl() (this=0x3d63770, __in_chrg=<optimized out>) at /work/lo/libreoffice-5-3/sw/inc/fmtcol.hxx:54 #4 0x00007f081660e8f5 in SwDoc::DelTextFormatColl(unsigned long, bool) (this=0x36cb7e0, nFormatColl=7, bBroadcast=true) at /work/lo/libreoffice-5-3/sw/source/core/doc/docfmt.cxx:991 #5 0x00007f081660ea11 in SwDoc::DelTextFormatColl(SwTextFormatColl*, bool) (this=0x36cb7e0, pColl=0x3d63770, bBroadcast=true) at /work/lo/libreoffice-5-3/sw/source/core/doc/docfmt.cxx:999 #6 0x00007f0816c98836 in SwUndoTextFormatCollCreate::Delete() (this=0x3d4f130) at /work/lo/libreoffice-5-3/sw/source/core/undo/SwUndoFmt.cxx:206 #7 0x00007f0816c97f77 in SwUndoFormatCreate::UndoImpl(sw::UndoRedoContext&) (this=0x3d4f130) at /work/lo/libreoffice-5-3/sw/source/core/undo/SwUndoFmt.cxx:63 the call to SwFormatsModifyBase::Contains effectively wants to check if the SwFormat has been deleted; i think every SwFormat is in some SwDoc member array for as long as it is alive. of course with the dynamic_cast in Contains, the check if it's still alive turns into use-after-free crash. the patch in commit #17 should fix this crash but every other call to Contains probably either crashes or is pointless because it will always return true.</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are the assignee for the bug.</li> </ul> </body> </html>