incubator-ooo-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From bugzi...@apache.org
Subject [Bug 113608] animations: All animation nodes are leaked
Date Fri, 15 Jun 2012 02:26:05 GMT
https://issues.apache.org/ooo/show_bug.cgi?id=113608

--- Comment #8 from zhang jianfang <zhangjf@apache.org> ---
(In reply to comment #6)
> Created attachment 78326 [details]
> Guard against missing SvxShape::mpImle
> 
> I got one step closer.  SvxShape::HasSdrObjectOwnership() did not check that
> its implementation object mpImpl was still valid before accessing it.
> 
> But this reveals yet another crash.

Here the actual problem is the SvxShape object has already been deleted before
accessing, not just because SvShape->mpImpl is null.

If I change SdrObject::getSvxShape() in below way, the crash problem also
disappears.

SvxShape* SdrObject::getSvxShape() const
{
    DBG_TESTSOLARMUTEX();
        // retrieving the impl pointer and subsequently using it is not
thread-safe, of course, so it needs to be
        // guarded by the SolarMutex

#if OSL_DEBUG_LEVE > 0
    uno::Reference< uno::XInterface > xShape( maWeakUnoShape );
    OSL_ENSURE( !( !xShapeGuard.is() && mpSvxShape ),
        "SdrObject::getSvxShape: still having IMPL-Pointer to dead object!" );
#endif
    uno::Reference< uno::XInterface > xShape( maWeakUnoShape );  // zhangjf
    if (!xShape.is()&& mpSvxShape)                               // zhangjf
        return NULL;                                         // zhangjf

    return mpSvxShape;
}

In normal case, mpSvxShape and maWeakUnoShape should refer to a same SvxShape
object. So it means when accessing mpSvxShape in that case, the referred
SvxShape object is an invalid object already. 

If adding tag to the deleted SvxShape object, we can also observe that the
referred SvxShape object has the deleted tag.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

Mime
View raw message