openoffice-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
Subject [Bug 118877] [From Symphony] Calc crashes when Redo refreshing data
Date Fri, 11 May 2012 07:21:33 GMT

Lei Debin <> changed:

           What    |Removed                     |Added
                 CC|                            |

--- Comment #1 from Lei Debin <> ---
The root cause is using an invalid pointer.
The source code is located at main\sc\source\core\data\table3.cxx
In void ScTable::SwapRow(SCROW nRow1, SCROW nRow2) method,
      const ScPatternAttr* pPat1 = GetPattern(nCol, nRow1);
      const ScPatternAttr* pPat2 = GetPattern(nCol, nRow2);
      if (pPat1 != pPat2)
    SetPattern(nCol, nRow1, *pPat2, TRUE);
    SetPattern(nCol, nRow2, *pPat1, TRUE);
sometimes, pPat1 will be deleted in SetPattern(nCol, nRow1, *pPat2, TRUE);(if
pPat2 point to the same content as pPat1) So when execute SetPattern(nCol,
nRow2, *pPat1, TRUE); it will use a deleted object, crashed !!!

The solution is to check the content refer by the pointer instead of the
pointer itself. The ScPatternAttr had a function ==
int __EXPORT ScPatternAttr::operator==( const SfxPoolItem& rCmp ) const
    // #i62090# Use quick comparison between ScPatternAttr's ItemSets

    return ( EqualPatternSets( GetItemSet(), static_cast<const
ScPatternAttr&>(rCmp).GetItemSet() ) &&
             StrCmp( GetStyleName(), static_cast<const
ScPatternAttr&>(rCmp).GetStyleName() ) );

You are receiving this mail because:
You are the assignee for the bug.

  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message