To comment on the following update, log in, then open the issue: http://www.openoffice.org/issues/show_bug.cgi?id=73201 Issue #|73201 Summary|a11y: crash on loading a particular document Component|Word processor Version|OOo 2.2 Platform|All URL| OS/Version|All Status|NEW Status whiteboard| Keywords| Resolution| Issue type|PATCH Priority|P3 Subcomponent|code Assigned to|od Reported by|cmc
------- Additional comments from [EMAIL PROTECTED] Sat Jan 6 07:00:28 -0800 2007 ------- patch follows... i.e. a report at https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=221491 of a stacktrace of https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=144899 Didn't crash for me, but valgrind shows a problem in the same place as the stacktrace, valgrind output of https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=144970 i.e. ==9575== Invalid read of size 1 ==9575== at 0x13B76E6E: SwFrm::IsPageFrm() const (frame.hxx:1198) ==9575== by 0x13B80184: SwFrmOrObj::GetBox() const (accfrmobj.hxx:214) ==9575== by 0x13B7CFA4: SwAccessibleContext::InvalidateChildPosOrSize(SwFrmOrObj const&, SwRect const&) (accc ==9575== by 0x13B9121D: SwAccessibleMap::FireEvent(SwAccessibleEvent_Impl const&) (accmap.cxx:704) ==9575== by 0x13B913B4: SwAccessibleMap::FireEvents() (accmap.cxx:2121) ==9575== by 0x13C1EB88: SwViewImp::FireAccessibleEvents() (viewimp.cxx:571) ==9575== by 0x13D61EC8: SwLayIdle::SwLayIdle(SwRootFrm*, SwViewImp*) (layact.cxx:2928) ==9575== by 0x13C24033: ViewShell::LayoutIdle() (viewsh.cxx:752) ==9575== by 0x13E9FB8A: SwDoc::DoIdleJobs(Timer*) (doclay.cxx:1951) ==9575== by 0x13E9FDBA: SwDoc::LinkStubDoIdleJobs(void*, void*) (doclay.cxx:1926) ==9575== by 0x369E4D21BF: Timer::ImplTimerCallbackProc() (timer.cxx:173) ==9575== by 0x825244F: GtkXLib::timeoutFn(void*) (gtkdata.cxx:595) ==9575== Address 0x16EC2261 is 145 bytes inside a block of size 376 free'd ==9575== at 0x4A0541E: free (vg_replace_malloc.c:233) ==9575== by 0x36A344EEAB: operator delete(void*) (in /usr/lib64/openoffice.org2.1/program/libsoffice.so) ==9575== by 0x13D39375: SwFlyAtCntFrm::~SwFlyAtCntFrm() (flyfrms.hxx:150) ==9575== by 0x13D9C47C: SwLayoutFrm::~SwLayoutFrm() (ssfrm.cxx:584) ==9575== by 0x13D58658: SwHeadFootFrm::~SwHeadFootFrm() (hffrm.hxx:46) ==9575== by 0x13D58744: SwFooterFrm::~SwFooterFrm() (hffrm.hxx:69) ==9575== by 0x13D9C57E: SwLayoutFrm::~SwLayoutFrm() (ssfrm.cxx:608) ==9575== by 0x13D75878: SwFtnBossFrm::~SwFtnBossFrm() (ftnboss.hxx:64) ==9575== by 0x13D728E9: SwPageFrm::~SwPageFrm() (pagechg.cxx:334) ==9575== by 0x13D7434C: SwFrm::InsertPage(SwPageFrm*, unsigned char) (pagechg.cxx:1478) ==9575== by 0x13D26F03: SwFrm::GetNextLeaf(MakePageType) (flowfrm.cxx:1096) ==9575== by 0x13D2713C: SwFrm::GetLeaf(MakePageType, unsigned char) (flowfrm.cxx:910) where the delete line is... delete pAnchoredObj; and the line in SwAccessibleContext::InvalidateChildPosOrSize is any usage of rChildFrmOrObj e.g. rChildFrmOrObj.GetBox looks like the object is deleted but a reference to it still exists in a yet to be processed accessibility event queue. A simple (too simple?) patch attached to process outstanding event in that queue before deleting the pAnchoredObj. --------------------------------------------------------------------- Please do not reply to this automatically generated notification from Issue Tracker. Please log onto the website and enter your comments. http://qa.openoffice.org/issue_handling/project_issues.html#notification --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
