incubator-ooo-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From bugzi...@apache.org
Subject [Bug 118878] [From Symphony] Writer crash after modify properties of new Frame
Date Wed, 23 May 2012 02:31:01 GMT
https://issues.apache.org/ooo/show_bug.cgi?id=118878

--- Comment #4 from yuanlin <yuanlin.ibm@gmail.com> ---
I found the root cause. 
The issue is caused by that if the user change width value and column value
together, In SwFmt::SetFmtAttr(), it will update all the modified value first.
Then in SwFlyFrm::Modify(), it will enumerate all the changed items one by one
and call SwFlyFrm::_UpdateAttr() to handle the value changed for each item.

In this case, frame size value changed item will be handled first, it will call
SwFlyFrm::FrmSizeChg() to handle it. In that function, it will call
SwLayoutFrm::AdjustColumns() to re-calculate the column size in the frame. When
enumerate the columns in the frame, it use the new column number value set in
SwFmt::SetFmtAttr(). However, the real column object in frame is not updated.
That work will be done in column number value changed handler in
SwFlyFrm::_UpdateAttr() later. So if the new column value is larger than
previous, in SwLayoutFrm::AdjustColumns(), it will enumerate a null column
object. So crash will happen.

According to my investigation, the crash should happen on all kinds of
platforms.

-- 
You are receiving this mail because:
You are the assignee for the bug.

Mime
View raw message