[Libreoffice-commits] .: 5 commits - pyuno/source sd/source sw/source xmlsecurity/source

Michael Stahl mst at kemper.freedesktop.org
Fri Feb 17 15:09:51 PST 2012


 pyuno/source/module/pyuno_gc.cxx                  |    5 +
 sd/source/ui/accessibility/AccessibleTreeNode.cxx |    6 +
 sd/source/ui/toolpanel/ScrollPanel.cxx            |    2 
 sw/source/core/layout/ftnfrm.cxx                  |    2 
 sw/source/core/layout/newfrm.cxx                  |    2 
 xmlsecurity/source/helper/xsecverify.cxx          |   86 ++++++++++++++++++----
 6 files changed, 87 insertions(+), 16 deletions(-)

New commits:
commit e72e8dcd332474321439eb266528eb7e5fc8809f
Author: Michael Stahl <mstahl at redhat.com>
Date:   Sat Feb 18 00:06:42 2012 +0100

    AccessibleTreeNode: fix headless crash
    
    On closing a document in headless mode, the
    accessibility::AccessibleTreeNode::WindowEventListener will access a deleted
    mrTreeNode member and crash; don't do anything in the listener if the
    AccessibleTreeNode has been disposed.
    
    #0  0x0000000000000000 in ?? ()
    #1  0x00007f99842d6887 in accessibility::AccessibleTreeNode::UpdateStateSet (this=0x27a99f80) at sd/source/ui/accessibility/AccessibleTreeNode.cxx:285
    #2  0x00007f99842d803e in accessibility::AccessibleTreeNode::WindowEventListener (this=0x27a99f80, pEvent=0x7f997fd64f40) at sd/source/ui/accessibility/AccessibleTreeNode.cxx:694
    #3  0x00007f99842d7f3d in accessibility::AccessibleTreeNode::LinkStubWindowEventListener (pThis=0x27a99f80, pCaller=0x7f997fd64f40) at sd/source/ui/accessibility/AccessibleTreeNode.cxx:670
    #4  0x00007f99b88a1442 in Link::Call (this=0x279f94e0, pCaller=0x7f997fd64f40) at solver/unxlngx6/inc/tools/link.hxx:140
    #5  0x00007f99b88cdecf in VclEventListeners::Call (this=0x27a946f0, pEvent=0x7f997fd64f40) at vcl/source/app/vclevent.cxx:72
    #6  0x00007f99b8d2e76e in Window::CallEventListeners (this=0x27a98280, nEvent=1009, pData=0x0) at vcl/source/window/window.cxx:5188
    #7  0x00007f99b8d2e6cf in Window::ImplCallEventListeners (this=0x27a98280, nEvent=1009, pData=0x0) at vcl/source/window/window.cxx:5171
    #8  0x00007f99b8d2df63 in Window::PreNotify (this=0x27a98280, rNEvt=...) at vcl/source/window/window.cxx:5037
    #9  0x00007f99b8d4aa0c in ImplCallPreNotify (rEvt=...) at vcl/source/window/winproc.cxx:86
    #10 0x00007f99b8d2910e in Window::ImplGrabFocus (this=0x2703d230, nFlags=0) at vcl/source/window/window.cxx:4033
    #11 0x00007f99b8d3749f in Window::GrabFocus (this=0x2703d230) at vcl/source/window/window.cxx:7493
    #12 0x00007f99b8d2b624 in Window::~Window (this=0x27a98280, __in_chrg=<optimized out>) at vcl/source/window/window.cxx:4493
    #13 0x00007f99b88fa514 in Control::~Control (this=0x27a98280, __in_chrg=<optimized out>) at vcl/source/control/ctrl.cxx:88
    #14 0x00007f99845521e4 in sd::toolpanel::ScrollPanel::~ScrollPanel (this=0x27a98280, __in_chrg=<optimized out>) at sd/source/ui/toolpanel/ScrollPanel.cxx:91
    #15 0x00007f99845522e8 in sd::toolpanel::ScrollPanel::~ScrollPanel (this=0x27a98280, __in_chrg=<optimized out>) at sd/source/ui/toolpanel/ScrollPanel.cxx:112
    #16 0x00007f9984565d76 in std::auto_ptr<sd::toolpanel::TreeNode>::reset (this=0x27a94970, __p=0x0)

diff --git a/sd/source/ui/accessibility/AccessibleTreeNode.cxx b/sd/source/ui/accessibility/AccessibleTreeNode.cxx
index 554c73d..2831895 100644
--- a/sd/source/ui/accessibility/AccessibleTreeNode.cxx
+++ b/sd/source/ui/accessibility/AccessibleTreeNode.cxx
@@ -637,6 +637,9 @@ sal_Bool AccessibleTreeNode::IsDisposed (void)
 
 IMPL_LINK(AccessibleTreeNode, StateChangeListener, TreeNodeStateChangeEvent*, pEvent)
 {
+    if (rBHelper.bDisposed || rBHelper.bInDispose)
+        return 1; // mrTreeNode is probably dead
+
     OSL_ASSERT(pEvent!=NULL);
     OSL_ASSERT(&pEvent->mrSource==&mrTreeNode);
 
@@ -669,6 +672,9 @@ IMPL_LINK(AccessibleTreeNode, StateChangeListener, TreeNodeStateChangeEvent*, pE
 
 IMPL_LINK(AccessibleTreeNode, WindowEventListener, VclWindowEvent*, pEvent)
 {
+    if (rBHelper.bDisposed || rBHelper.bInDispose)
+        return 1; // mrTreeNode is probably dead
+
     switch (pEvent->GetId())
     {
         case VCLEVENT_WINDOW_HIDE:
commit cdfa3bd5e4c62dc88158a4c6c4908404baf1f529
Author: Michael Stahl <mstahl at redhat.com>
Date:   Sat Feb 18 00:06:41 2012 +0100

    sd::toolpanel::ScrollPanel::~ScrollPanel: bogus static_cast

diff --git a/sd/source/ui/toolpanel/ScrollPanel.cxx b/sd/source/ui/toolpanel/ScrollPanel.cxx
index 0a84e75..7c43aa4 100644
--- a/sd/source/ui/toolpanel/ScrollPanel.cxx
+++ b/sd/source/ui/toolpanel/ScrollPanel.cxx
@@ -97,7 +97,7 @@ ScrollPanel::~ScrollPanel (void)
         TreeNode* pControl = pNode;
         // When the node has been created as TitledControl then use its
         // control instead of pNode directly.
-        TitledControl* pTitledControl = static_cast<TitledControl*>(pNode);
+        TitledControl* pTitledControl = dynamic_cast<TitledControl*>(pNode);
         if (pTitledControl != NULL)
             pControl = pTitledControl->GetControl();
 
commit 29177b1d04b845e8e6bf8edc8beb34b76a95d9c3
Author: Michael Stahl <mstahl at redhat.com>
Date:   Sat Feb 18 00:06:41 2012 +0100

    pyuno: decreaseRefCount: valgrind warning:
    
    Apparently the thread spawned in decreaseRefCount runs and deletes
    itself before the "m_hThread != 0" from osl::Thread::create is executed;
    try a lame workaround for that.
    
    ==1877== Invalid read of size 8
    ==1877==    at 0x2A70E546: osl::Thread::create() (in pyuno/unxlngx6/lib/libpyuno.so)
    ==1877==    by 0x2A70E351: pyuno::decreaseRefCount(_is*, _object*) (in pyuno/unxlngx6/lib/libpyuno.so)
    ==1877==    by 0x2A7092B4: pyuno::Adapter::~Adapter() (in pyuno/unxlngx6/lib/libpyuno.so)
    ==1877==    by 0x2A709393: pyuno::Adapter::~Adapter() (in pyuno/unxlngx6/lib/libpyuno.so)
    ==1877==    by 0x5EF2F64: cppu::OWeakObject::release() (weak.cxx:213)
    ==1877==    by 0x2A70DE69:
    ==1877==  Address 0x1ee30818 is 8 bytes inside a block of size 32 free'd
    ==1877==    at 0x4A0662E: free (vg_replace_malloc.c:366)
    ==1877==    by 0x4C44B62: rtl_freeMemory_SYSTEM(void*) (alloc_global.cxx:285)
    ==1877==    by 0x4C44DC7: rtl_freeMemory (alloc_global.cxx:355)
    ==1877==    by 0x2A70E41E: osl::Thread::operator delete(void*) (in pyuno/unxlngx6/lib/libpyuno.so)
    ==1877==    by 0x2A70E6EF: pyuno::GCThread::~GCThread() (in pyuno/unxlngx6/lib/libpyuno.so)
    ==1877==    by 0x2A70E303: pyuno::GCThread::onTerminated() (in pyuno/unxlngx6/lib/libpyuno.so)
    ==1877==    by 0x2A70E671: threadFunc (in pyuno/unxlngx6/lib/libpyuno.so)
    ==1877==    by 0x4C2E242: osl_thread_start_Impl (thread.c:292)
    ==1877==    by 0x3C26607D8F: start_thread (pthread_create.c:309)
    ==1877==    by 0x3C262EF48C: clone (clone.S:115)

diff --git a/pyuno/source/module/pyuno_gc.cxx b/pyuno/source/module/pyuno_gc.cxx
index 61eaaba..6ee657e 100644
--- a/pyuno/source/module/pyuno_gc.cxx
+++ b/pyuno/source/module/pyuno_gc.cxx
@@ -112,7 +112,10 @@ void decreaseRefCount( PyInterpreterState *interpreter, PyObject *object )
     // interpreter lock is held or not
     // TODO: Look for a more efficient solution
     osl::Thread *t = new GCThread( interpreter, object );
-    t->create();
+    // don't call create() because Valgrind complains about invalid read in
+    // the rather bizarre GCThread::onTerminated; try a lame workaround:
+    t->createSuspended();
+    t->resume();
 }
 
 }
commit 962d0500c4debaef43e5f146e47e08c66d851562
Author: Michael Stahl <mstahl at redhat.com>
Date:   Sat Feb 18 00:06:33 2012 +0100

    fdo#39510: fix yet more layout crashes in ~SwRootFrm:
    
    Call SwRootFrm::RemoveFtns with the proper boolean to also eliminate
    EndNotes, and fix a faulty while loop in RemoveFtns that's been preventing
    removal of footnotes in certain sections since the dawn of CVS history.
    (regression from CWS swlayoutrefactoring, crashes on bugdoc from i#101776)

diff --git a/sw/source/core/layout/ftnfrm.cxx b/sw/source/core/layout/ftnfrm.cxx
index 7d3ea83..940bc11 100644
--- a/sw/source/core/layout/ftnfrm.cxx
+++ b/sw/source/core/layout/ftnfrm.cxx
@@ -1000,7 +1000,7 @@ void lcl_RemoveFtns( SwFtnBossFrm* pBoss, sal_Bool bPageOnly, sal_Bool bEndNotes
             if( pBody && pBody->Lower() )
             {
                 SwFrm* pLow = pBody->Lower();
-                while( pLow->GetNext() )
+                while (pLow)
                 {
                     if( pLow->IsSctFrm() && ( !pLow->GetNext() ||
                         ((SwSectionFrm*)pLow)->IsAnyNoteAtEnd() ) &&
diff --git a/sw/source/core/layout/newfrm.cxx b/sw/source/core/layout/newfrm.cxx
index 1e9b0e8..5f12ef5 100644
--- a/sw/source/core/layout/newfrm.cxx
+++ b/sw/source/core/layout/newfrm.cxx
@@ -610,7 +610,7 @@ SwRootFrm::~SwRootFrm()
     // also searches backwards to find the master of footnotes, they must be
     // considered to be owned by the SwRootFrm and also be destroyed here,
     // before tearing down the (now footnote free) rest of the layout.
-    AllRemoveFtns();
+    RemoveFtns(0, false, true);
 
     if(pBlink)
         pBlink->FrmDelete( this );
commit 67c396fb66a9c21c9eafaf4bcc3654706f643df0
Author: Michael Stahl <mstahl at redhat.com>
Date:   Sat Feb 18 00:03:39 2012 +0100

    fdo#39657: fix crash when parsing XML signatures

diff --git a/xmlsecurity/source/helper/xsecverify.cxx b/xmlsecurity/source/helper/xsecverify.cxx
index a61eb6e..0f22599 100644
--- a/xmlsecurity/source/helper/xsecverify.cxx
+++ b/xmlsecurity/source/helper/xsecverify.cxx
@@ -121,7 +121,12 @@ void XSecController::addSignature()
 
 void XSecController::addReference( const rtl::OUString& ouUri)
 {
-    InternalSignatureInformation &isi = m_vInternalSignatureInformations[m_vInternalSignatureInformations.size()-1];
+    if (m_vInternalSignatureInformations.empty())
+    {
+        OSL_TRACE("XSecController::addReference: no signature");
+        return;
+    }
+    InternalSignatureInformation &isi = m_vInternalSignatureInformations.back();
     isi.addReference(TYPE_SAMEDOCUMENT_REFERENCE,ouUri, -1 );
 }
 
@@ -131,7 +136,12 @@ void XSecController::addStreamReference(
 {
         sal_Int32 type = (isBinary?TYPE_BINARYSTREAM_REFERENCE:TYPE_XMLSTREAM_REFERENCE);
 
-    InternalSignatureInformation &isi = m_vInternalSignatureInformations[m_vInternalSignatureInformations.size()-1];
+    if (m_vInternalSignatureInformations.empty())
+    {
+        OSL_TRACE("XSecController::addStreamReference: no signature");
+        return;
+    }
+    InternalSignatureInformation &isi = m_vInternalSignatureInformations.back();
 
     if ( isi.xReferenceResolvedListener.is() )
     {
@@ -154,7 +164,13 @@ void XSecController::addStreamReference(
 
 void XSecController::setReferenceCount() const
 {
-    const InternalSignatureInformation &isi = m_vInternalSignatureInformations[m_vInternalSignatureInformations.size()-1];
+    if (m_vInternalSignatureInformations.empty())
+    {
+        OSL_TRACE("XSecController::setReferenceCount: no signature");
+        return;
+    }
+    const InternalSignatureInformation &isi =
+        m_vInternalSignatureInformations.back();
 
     if ( isi.xReferenceResolvedListener.is() )
     {
@@ -182,51 +198,97 @@ void XSecController::setReferenceCount() const
 
 void XSecController::setX509IssuerName( rtl::OUString& ouX509IssuerName )
 {
-    InternalSignatureInformation &isi = m_vInternalSignatureInformations[m_vInternalSignatureInformations.size()-1];
+    if (m_vInternalSignatureInformations.empty())
+    {
+        OSL_TRACE("XSecController::setX509IssuerName: no signature");
+        return;
+    }
+    InternalSignatureInformation &isi = m_vInternalSignatureInformations.back();
     isi.signatureInfor.ouX509IssuerName = ouX509IssuerName;
 }
 
 void XSecController::setX509SerialNumber( rtl::OUString& ouX509SerialNumber )
 {
-    InternalSignatureInformation &isi = m_vInternalSignatureInformations[m_vInternalSignatureInformations.size()-1];
+    if (m_vInternalSignatureInformations.empty())
+    {
+        OSL_TRACE("XSecController::setX509SerialNumber: no signature");
+        return;
+    }
+    InternalSignatureInformation &isi = m_vInternalSignatureInformations.back();
     isi.signatureInfor.ouX509SerialNumber = ouX509SerialNumber;
 }
 
 void XSecController::setX509Certificate( rtl::OUString& ouX509Certificate )
 {
-    InternalSignatureInformation &isi = m_vInternalSignatureInformations[m_vInternalSignatureInformations.size()-1];
+    if (m_vInternalSignatureInformations.empty())
+    {
+        OSL_TRACE("XSecController::setX509Certificate: no signature");
+        return;
+    }
+    InternalSignatureInformation &isi = m_vInternalSignatureInformations.back();
     isi.signatureInfor.ouX509Certificate = ouX509Certificate;
 }
 
 void XSecController::setSignatureValue( rtl::OUString& ouSignatureValue )
 {
-    InternalSignatureInformation &isi = m_vInternalSignatureInformations[m_vInternalSignatureInformations.size()-1];
+    if (m_vInternalSignatureInformations.empty())
+    {
+        OSL_TRACE("XSecController::setSignatureValue: no signature");
+        return;
+    }
+    InternalSignatureInformation &isi = m_vInternalSignatureInformations.back();
     isi.signatureInfor.ouSignatureValue = ouSignatureValue;
 }
 
 void XSecController::setDigestValue( rtl::OUString& ouDigestValue )
 {
-    SignatureInformation &si = m_vInternalSignatureInformations[m_vInternalSignatureInformations.size()-1].signatureInfor;
-    SignatureReferenceInformation &reference = si.vSignatureReferenceInfors[si.vSignatureReferenceInfors.size()-1];
+    if (m_vInternalSignatureInformations.empty())
+    {
+        OSL_TRACE("XSecController::setDigestValue: no signature");
+        return;
+    }
+    InternalSignatureInformation &isi = m_vInternalSignatureInformations.back();
+    if (isi.signatureInfor.vSignatureReferenceInfors.empty())
+    {
+        OSL_TRACE("XSecController::setDigestValue: no signature reference");
+        return;
+    }
+    SignatureReferenceInformation &reference =
+        isi.signatureInfor.vSignatureReferenceInfors.back();
     reference.ouDigestValue = ouDigestValue;
 }
 
 void XSecController::setDate( rtl::OUString& ouDate )
 {
-    InternalSignatureInformation &isi = m_vInternalSignatureInformations[m_vInternalSignatureInformations.size()-1];
+    if (m_vInternalSignatureInformations.empty())
+    {
+        OSL_TRACE("XSecController::setDate: no signature");
+        return;
+    }
+    InternalSignatureInformation &isi = m_vInternalSignatureInformations.back();
     convertDateTime( isi.signatureInfor.stDateTime, ouDate );
     isi.signatureInfor.ouDateTime = ouDate;
 }
 
 void XSecController::setId( rtl::OUString& ouId )
 {
-    InternalSignatureInformation &isi = m_vInternalSignatureInformations[m_vInternalSignatureInformations.size()-1];
+    if (m_vInternalSignatureInformations.empty())
+    {
+        OSL_TRACE("XSecController::setId: no signature");
+        return;
+    }
+    InternalSignatureInformation &isi = m_vInternalSignatureInformations.back();
     isi.signatureInfor.ouSignatureId = ouId;
 }
 
 void XSecController::setPropertyId( rtl::OUString& ouPropertyId )
 {
-    InternalSignatureInformation &isi = m_vInternalSignatureInformations[m_vInternalSignatureInformations.size()-1];
+    if (m_vInternalSignatureInformations.empty())
+    {
+        OSL_TRACE("XSecController::setPropertyId: no signature");
+        return;
+    }
+    InternalSignatureInformation &isi = m_vInternalSignatureInformations.back();
     isi.signatureInfor.ouPropertyId = ouPropertyId;
 }
 


More information about the Libreoffice-commits mailing list