svx/qa/uitest/table/tablecontroller.py | 38 +++++++++++++++++++++++++++++++++
svx/source/table/tablecontroller.cxx | 2 -
2 files changed, 39 insertions(+), 1 deletion(-)
New commits:
commit ece86ef173cbc070c76f180d02ac80c65e07fff9
Author: Miklos Vajna <vmik...@collabora.com>
AuthorDate: Mon May 3 20:49:08 2021 +0200
Commit: Miklos Vajna <vmik...@collabora.com>
CommitDate: Tue May 4 09:02:08 2021 +0200
tdf#139500 svx: fix crash on changing table properties during active text
edit
Regression from commit fdeb04f7c59cf8032fe17072ed779e70505cc6ab
(tdf#129961 svx: finish UI for table shadow as direct format,
2020-12-15), the problem was that the BegUndo() / EndUndo() pair can be
only used if we know that the text edit of a cell of a table shape is
not started or ended in-between.
The bugreport scenario was an active text edit, where setting attributes
on the shape ends the text edit:
#9 0x7f6dbb417121 in SdrEditView::EndTextEditAllViews() const
/svx/source/svdraw/svdedtv.cxx:1079:20
#10 0x7f6dbb466798 in SdrEditView::SetAttrToMarked(SfxItemSet const&,
bool) /svx/source/svdraw/svdedtv1.cxx:1095:9
#11 0x7f6dbc34b0af in
sdr::table::SvxTableController::SetAttrToSelectedShape(SfxItemSet const&)
/svx/source/table/tablecontroller.cxx:2738:12
Which also means that the underlying edit engine is deleted. But then
undo/redo would still reference that edit engine:
==31830==ERROR: AddressSanitizer: heap-use-after-free on address
0x60c0001fc300 at pc 0x7f6dd73a9cb9 bp 0x7fff788db4b0 sp 0x7fff788db4a8
READ of size 8 at 0x60c0001fc300 thread T0
#0 0x7f6dd73a9cb8 in EditUndo::GetComment() const
/editeng/source/editeng/editundo.cxx:147:34
Fix the problem by not grouping in case there is an active text edit,
that's not something I considered when I added the original grouping.
Change-Id: I4f3583e21a27f8380c35b3f4563ce496819bcb81
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/115049
Tested-by: Jenkins
Reviewed-by: Miklos Vajna <vmik...@collabora.com>
diff --git a/svx/qa/uitest/table/tablecontroller.py
b/svx/qa/uitest/table/tablecontroller.py
index afc5de807fde..607df44a3a4f 100644
--- a/svx/qa/uitest/table/tablecontroller.py
+++ b/svx/qa/uitest/table/tablecontroller.py
@@ -6,6 +6,7 @@
from uitest.framework import UITestCase
from uitest.uihelper.common import select_pos
+from libreoffice.uno.propertyvalue import mkPropertyValues
# Test for SvxTableController.
@@ -42,4 +43,41 @@ class SvxTableControllerTest(UITestCase):
# Close the document.
self.ui_test.close_doc()
+ def testUndoCrash(self):
+ # Given an Impress document with a single table in it:
+ self.ui_test.create_doc_in_start_center("impress")
+ template = self.xUITest.getTopFocusWindow()
+ self.ui_test.close_dialog_through_button(template.getChild("close"))
+ self.xUITest.executeCommand(".uno:SelectAll")
+ self.xUITest.executeCommand(".uno:Delete")
+
self.xUITest.executeCommand(".uno:InsertTable?Columns:short=3&Rows:short=3")
+ self.xUITest.executeCommand(".uno:SelectAll")
+
+ # When enabling shadow on the shape while text edit is active:
+ doc = self.xUITest.getTopFocusWindow()
+ impress = doc.getChild("impress_win")
+ impress.executeAction("TYPE", mkPropertyValues({"TEXT": "A1"}))
+ for i in range(6):
+ impress.executeAction("TYPE", mkPropertyValues({"KEYCODE":
"CTRL+TAB"}))
+ impress.executeAction("TYPE", mkPropertyValues({"TEXT": "A3"}))
+ self.xUITest.executeCommand(".uno:SelectAll")
+ self.ui_test.execute_dialog_through_command(".uno:TableDialog")
+ tableDialog = self.xUITest.getTopFocusWindow()
+ tabs = tableDialog.getChild("tabcontrol")
+ # Select "shadow".
+ select_pos(tabs, "4")
+ shadowCheckbox = tableDialog.getChild("TSB_SHOW_SHADOW")
+ shadowCheckbox.executeAction("CLICK", tuple())
+ self.ui_test.close_dialog_through_button(tableDialog.getChild("ok"))
+
+ # Then make sure we don't crash:
+ # Without the accompanying fix in place, this test would have failed
crashed due to a
+ # use-after-free: text edit ended but an undo action of the text edit
remained on the undo
+ # stack.
+ for i in range(2):
+ self.xUITest.executeCommand(".uno:Undo")
+
+ # Close the document.
+ self.ui_test.close_doc()
+
# vim: set shiftwidth=4 softtabstop=4 expandtab:
diff --git a/svx/source/table/tablecontroller.cxx
b/svx/source/table/tablecontroller.cxx
index a81756c0ffdc..cab8570871dc 100644
--- a/svx/source/table/tablecontroller.cxx
+++ b/svx/source/table/tablecontroller.cxx
@@ -984,7 +984,7 @@ void SvxTableController::onFormatTable(const SfxRequest&
rReq)
// Create a single undo action when applying the result of the
dialog.
SdrTableObj& rTableObject(*mxTableObj);
SdrModel& rSdrModel(rTableObject.getSdrModelFromSdrObject());
- bool bUndo = rSdrModel.IsUndoEnabled();
+ bool bUndo = rSdrModel.IsUndoEnabled() && !mrView.IsTextEdit();
if (bUndo)
{
rSdrModel.BegUndo(SvxResId(STR_TABLE_NUMFORMAT));
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
