[Libreoffice] sc_unoapi failure

[Kohei Yoshida]

On Mon, 2012-01-23 at 13:01 +0100, Eike Rathke wrote:
> Hi Stephan,
> 
> On Monday, 2012-01-23 11:44:43 +0100, Stephan Bergmann wrote:
> 
> > On 01/23/2012 11:38 AM, Stephan Bergmann wrote:
> > >The Linux-RHEL6-x86_64 at 14-with-check tinderbox is consistently failing
> > >with a crash in sc_unoapi in all the builds since the one whose failure
> > >mail is at the end of this mail. I made a valgrind run of sc_unoapi (on
> > >a different machine than the tinderbox), and it indeed indicates two
> > >problems:
> 
> Thanks for the pointers, I'm investigating.

One thing that comes to mind is our recent rework on ScColumn's cell
storage.  Especially in ScColumn::Delete(), before and after the rework
the logic of removing the cell from the array of cells may have changed.

The following part

            pNoteCell->Delete();
            --nCount;
            memmove( &pItems[nIndex], &pItems[nIndex + 1], (nCount - nIndex) * sizeof(ColEntry) );
            pItems[nCount].nRow = 0;
            pItems[nCount].pCell = NULL;

was what was in 3.5.  The following

            pNoteCell->Delete();
            maItems.erase(maItems.end() - 1);

is what we have on master.  Clearly it's not correct to always pop from
the last element on cell deletion...  I should've spotted this during
review.  This is a disadvantage of reviewing a large patch. :-/

Maybe that's what's causing the crash?

Kohei

-- 
Kohei Yoshida, LibreOffice hacker, Calc