incubator-ooo-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From bugzi...@apache.org
Subject [Bug 113608] animations: All animation nodes are leaked
Date Wed, 13 Jun 2012 05:29:39 GMT
https://issues.apache.org/ooo/show_bug.cgi?id=113608

--- Comment #5 from zhang jianfang <zhangjf@apache.org> ---
Created attachment 78277
  --> https://issues.apache.org/ooo/attachment.cgi?id=78277&action=edit
patch to fix the animation leak problem, but there still is other problem

I have a patch for animation memory leak problem, but unfortunately it exposes
another serious crash problem. I think the crash problem exists before too, but
it shows up when AnimationNode objects are correctly released.

The crash happens when closing the sd documents and releasing the SdPage
objects. The crash call stack is,

     svxcore.dll!SvxShape::HasSdrObjectOwnership()  Line 299 + 0x6 bytes    C++
     svxcore.dll!SdrObject::Free(SdrObject * & _rpObject=0x00000000)  Line 489
+ 0xe bytes    C++
     svxcore.dll!SdrObjList::Clear()  Line 271 + 0x9 bytes    C++
     svxcore.dll!SdrObjList::~SdrObjList()  Line 144    C++
     svxcore.dll!SdrPage::~SdrPage()  Line 1424 + 0x6c bytes    C++
     svxcore.dll!FmFormPage::~FmFormPage()  Line 123 + 0x22 bytes    C++
     sd.dll!SdPage::~SdPage()  Line 161 + 0x149 bytes    C++
     sd.dll!SdPage::`vector deleting destructor'()  + 0x50 bytes    C++
     svxcore.dll!SdrModel::DeletePage()  + 0x18 bytes    C++
     sd.dll!SdDrawDocument::DeletePage()  + 0xf bytes    C++
     svxcore.dll!SdrModel::ClearModel()  + 0x2a bytes    C++
     sd.dll!SdDrawDocument::~SdDrawDocument()  + 0xa5 bytes    C++

The exception shows SdrObject::Free() still tries to access SvxShape object
after it is deleted. The code snap is,

void SdrObject::Free( SdrObject*& _rpObject )
{
    SdrObject* pObject = _rpObject; _rpObject = NULL;
    if ( pObject == NULL )
        // nothing to do
        return;

    SvxShape* pShape = pObject->getSvxShape();
  if ( pShape && pShape->HasSdrObjectOwnership() )
        // only the shape is allowed to delete me, and will reset the ownership
before doing so
        return;

    delete pObject;
}

And as my check, there has already had protect code in SvxShape destructor api,
it will try to reset the reference from SdrObject object by calling
mpObj->setUnoShape( NULL, SdrObject::GrantXShapeAccess() ).

SvxShape::~SvxShape() throw()
{
   ...
    if ( mpObj.is() )
        mpObj->setUnoShape( NULL, SdrObject::GrantXShapeAccess() );

    if( HasSdrObjectOwnership() && mpObj.is() )
    {
        mpImpl->mbHasSdrObjectOwnership = false;
        SdrObject* pObject = mpObj.get();
        SdrObject::Free( pObject );
    }

  ...
}

Currently the root cause of this problem is still unclear.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

Mime
View raw message