[Libreoffice-commits] core.git: svtools/source

[Michael Stahl]

 svtools/source/graphic/grfmgr2.cxx |   12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

New commits:
commit 790920befb242d4843d7a933c8a3b7af31d404f9
Author: Michael Stahl <mstahl at redhat.com>
Date:   Sun Aug 31 13:21:16 2014 +0200

    GraphicManager: fix crash when swapping out graphics
    
    GraphicManager::ImplCheckSizeOfSwappedInGraphics() may access a deleted
    GraphicObject because swapping out one GraphicObject may actually delete
    other ones, by deleting SdrGrafPrimitive2D instances via
    sdr::contact::ViewContactOfGraphic::flushGraphicObjects().
    
    (regression from 0ca0202a0994c0b7c99c366fd5cafd8a655df203)
    
    Change-Id: I94bd465d90afbfdd14da28e42de3ecdff3a9d9f9
    Reviewed-on: https://gerrit.libreoffice.org/11215
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Tested-by: Michael Stahl <mstahl at redhat.com>

diff --git a/svtools/source/graphic/grfmgr2.cxx b/svtools/source/graphic/grfmgr2.cxx
index 2571036..1c8e002 100644
--- a/svtools/source/graphic/grfmgr2.cxx
+++ b/svtools/source/graphic/grfmgr2.cxx
@@ -34,6 +34,7 @@
 #include "grfcache.hxx"
 #include <svtools/grfmgr.hxx>
 #include <boost/scoped_array.hpp>
+#include <boost/unordered_map.hpp>
 
 // - defines -
 
@@ -199,6 +200,7 @@ void GraphicManager::ImplCheckSizeOfSwappedInGraphics()
     sal_uLong nUsedSize(0);
     GraphicObject* pObj = 0;
     std::vector< GraphicObject* > aCandidates;
+    boost::unordered_map<GraphicObject *, size_t> sizes;
 
     for (size_t i = 0, n = maObjList.size(); i < n; ++i)
     {
@@ -206,7 +208,9 @@ void GraphicManager::ImplCheckSizeOfSwappedInGraphics()
         if (pObj->meType == GRAPHIC_BITMAP && !pObj->IsSwappedOut() && pObj->GetSizeBytes())
         {
             aCandidates.push_back(pObj);
-            nUsedSize += pObj->GetSizeBytes();
+            size_t const nSize = pObj->GetSizeBytes();
+            nUsedSize += nSize;
+            sizes.insert(std::make_pair(pObj, nSize));
         }
     }
 
@@ -236,6 +240,12 @@ void GraphicManager::ImplCheckSizeOfSwappedInGraphics()
             // swap out until we have no more or the goal to use less than nMaxCacheSize
             // is reached
             pObj = aCandidates[a];
+            if (std::find(maObjList.begin(), maObjList.end(), pObj) == maObjList.end())
+            {
+                // object has been deleted when swapping out another one
+                nUsedSize = (sizes[pObj] < nUsedSize) ? nUsedSize - sizes[pObj] : 0;
+                continue;
+            }
             const sal_uLong nSizeBytes(pObj->GetSizeBytes());
 
             // do not swap out when we have less than 16KB data objects