pyuno/source/module/pyuno_gc.cxx | 5 + sd/source/ui/accessibility/AccessibleTreeNode.cxx | 6 + sd/source/ui/toolpanel/ScrollPanel.cxx | 2 sw/source/core/layout/ftnfrm.cxx | 2 sw/source/core/layout/newfrm.cxx | 2 xmlsecurity/source/helper/xsecverify.cxx | 86 ++++++++++++++++++---- 6 files changed, 87 insertions(+), 16 deletions(-)
New commits: commit e72e8dcd332474321439eb266528eb7e5fc8809f Author: Michael Stahl <mst...@redhat.com> Date: Sat Feb 18 00:06:42 2012 +0100 AccessibleTreeNode: fix headless crash On closing a document in headless mode, the accessibility::AccessibleTreeNode::WindowEventListener will access a deleted mrTreeNode member and crash; don't do anything in the listener if the AccessibleTreeNode has been disposed. #0 0x0000000000000000 in ?? () #1 0x00007f99842d6887 in accessibility::AccessibleTreeNode::UpdateStateSet (this=0x27a99f80) at sd/source/ui/accessibility/AccessibleTreeNode.cxx:285 #2 0x00007f99842d803e in accessibility::AccessibleTreeNode::WindowEventListener (this=0x27a99f80, pEvent=0x7f997fd64f40) at sd/source/ui/accessibility/AccessibleTreeNode.cxx:694 #3 0x00007f99842d7f3d in accessibility::AccessibleTreeNode::LinkStubWindowEventListener (pThis=0x27a99f80, pCaller=0x7f997fd64f40) at sd/source/ui/accessibility/AccessibleTreeNode.cxx:670 #4 0x00007f99b88a1442 in Link::Call (this=0x279f94e0, pCaller=0x7f997fd64f40) at solver/unxlngx6/inc/tools/link.hxx:140 #5 0x00007f99b88cdecf in VclEventListeners::Call (this=0x27a946f0, pEvent=0x7f997fd64f40) at vcl/source/app/vclevent.cxx:72 #6 0x00007f99b8d2e76e in Window::CallEventListeners (this=0x27a98280, nEvent=1009, pData=0x0) at vcl/source/window/window.cxx:5188 #7 0x00007f99b8d2e6cf in Window::ImplCallEventListeners (this=0x27a98280, nEvent=1009, pData=0x0) at vcl/source/window/window.cxx:5171 #8 0x00007f99b8d2df63 in Window::PreNotify (this=0x27a98280, rNEvt=...) at vcl/source/window/window.cxx:5037 #9 0x00007f99b8d4aa0c in ImplCallPreNotify (rEvt=...) at vcl/source/window/winproc.cxx:86 #10 0x00007f99b8d2910e in Window::ImplGrabFocus (this=0x2703d230, nFlags=0) at vcl/source/window/window.cxx:4033 #11 0x00007f99b8d3749f in Window::GrabFocus (this=0x2703d230) at vcl/source/window/window.cxx:7493 #12 0x00007f99b8d2b624 in Window::~Window (this=0x27a98280, __in_chrg=<optimized out>) at vcl/source/window/window.cxx:4493 #13 0x00007f99b88fa514 in Control::~Control (this=0x27a98280, __in_chrg=<optimized out>) at vcl/source/control/ctrl.cxx:88 #14 0x00007f99845521e4 in sd::toolpanel::ScrollPanel::~ScrollPanel (this=0x27a98280, __in_chrg=<optimized out>) at sd/source/ui/toolpanel/ScrollPanel.cxx:91 #15 0x00007f99845522e8 in sd::toolpanel::ScrollPanel::~ScrollPanel (this=0x27a98280, __in_chrg=<optimized out>) at sd/source/ui/toolpanel/ScrollPanel.cxx:112 #16 0x00007f9984565d76 in std::auto_ptr<sd::toolpanel::TreeNode>::reset (this=0x27a94970, __p=0x0) diff --git a/sd/source/ui/accessibility/AccessibleTreeNode.cxx b/sd/source/ui/accessibility/AccessibleTreeNode.cxx index 554c73d..2831895 100644 --- a/sd/source/ui/accessibility/AccessibleTreeNode.cxx +++ b/sd/source/ui/accessibility/AccessibleTreeNode.cxx @@ -637,6 +637,9 @@ sal_Bool AccessibleTreeNode::IsDisposed (void) IMPL_LINK(AccessibleTreeNode, StateChangeListener, TreeNodeStateChangeEvent*, pEvent) { + if (rBHelper.bDisposed || rBHelper.bInDispose) + return 1; // mrTreeNode is probably dead + OSL_ASSERT(pEvent!=NULL); OSL_ASSERT(&pEvent->mrSource==&mrTreeNode); @@ -669,6 +672,9 @@ IMPL_LINK(AccessibleTreeNode, StateChangeListener, TreeNodeStateChangeEvent*, pE IMPL_LINK(AccessibleTreeNode, WindowEventListener, VclWindowEvent*, pEvent) { + if (rBHelper.bDisposed || rBHelper.bInDispose) + return 1; // mrTreeNode is probably dead + switch (pEvent->GetId()) { case VCLEVENT_WINDOW_HIDE: commit cdfa3bd5e4c62dc88158a4c6c4908404baf1f529 Author: Michael Stahl <mst...@redhat.com> Date: Sat Feb 18 00:06:41 2012 +0100 sd::toolpanel::ScrollPanel::~ScrollPanel: bogus static_cast diff --git a/sd/source/ui/toolpanel/ScrollPanel.cxx b/sd/source/ui/toolpanel/ScrollPanel.cxx index 0a84e75..7c43aa4 100644 --- a/sd/source/ui/toolpanel/ScrollPanel.cxx +++ b/sd/source/ui/toolpanel/ScrollPanel.cxx @@ -97,7 +97,7 @@ ScrollPanel::~ScrollPanel (void) TreeNode* pControl = pNode; // When the node has been created as TitledControl then use its // control instead of pNode directly. - TitledControl* pTitledControl = static_cast<TitledControl*>(pNode); + TitledControl* pTitledControl = dynamic_cast<TitledControl*>(pNode); if (pTitledControl != NULL) pControl = pTitledControl->GetControl(); commit 29177b1d04b845e8e6bf8edc8beb34b76a95d9c3 Author: Michael Stahl <mst...@redhat.com> Date: Sat Feb 18 00:06:41 2012 +0100 pyuno: decreaseRefCount: valgrind warning: Apparently the thread spawned in decreaseRefCount runs and deletes itself before the "m_hThread != 0" from osl::Thread::create is executed; try a lame workaround for that. ==1877== Invalid read of size 8 ==1877== at 0x2A70E546: osl::Thread::create() (in pyuno/unxlngx6/lib/libpyuno.so) ==1877== by 0x2A70E351: pyuno::decreaseRefCount(_is*, _object*) (in pyuno/unxlngx6/lib/libpyuno.so) ==1877== by 0x2A7092B4: pyuno::Adapter::~Adapter() (in pyuno/unxlngx6/lib/libpyuno.so) ==1877== by 0x2A709393: pyuno::Adapter::~Adapter() (in pyuno/unxlngx6/lib/libpyuno.so) ==1877== by 0x5EF2F64: cppu::OWeakObject::release() (weak.cxx:213) ==1877== by 0x2A70DE69: ==1877== Address 0x1ee30818 is 8 bytes inside a block of size 32 free'd ==1877== at 0x4A0662E: free (vg_replace_malloc.c:366) ==1877== by 0x4C44B62: rtl_freeMemory_SYSTEM(void*) (alloc_global.cxx:285) ==1877== by 0x4C44DC7: rtl_freeMemory (alloc_global.cxx:355) ==1877== by 0x2A70E41E: osl::Thread::operator delete(void*) (in pyuno/unxlngx6/lib/libpyuno.so) ==1877== by 0x2A70E6EF: pyuno::GCThread::~GCThread() (in pyuno/unxlngx6/lib/libpyuno.so) ==1877== by 0x2A70E303: pyuno::GCThread::onTerminated() (in pyuno/unxlngx6/lib/libpyuno.so) ==1877== by 0x2A70E671: threadFunc (in pyuno/unxlngx6/lib/libpyuno.so) ==1877== by 0x4C2E242: osl_thread_start_Impl (thread.c:292) ==1877== by 0x3C26607D8F: start_thread (pthread_create.c:309) ==1877== by 0x3C262EF48C: clone (clone.S:115) diff --git a/pyuno/source/module/pyuno_gc.cxx b/pyuno/source/module/pyuno_gc.cxx index 61eaaba..6ee657e 100644 --- a/pyuno/source/module/pyuno_gc.cxx +++ b/pyuno/source/module/pyuno_gc.cxx @@ -112,7 +112,10 @@ void decreaseRefCount( PyInterpreterState *interpreter, PyObject *object ) // interpreter lock is held or not // TODO: Look for a more efficient solution osl::Thread *t = new GCThread( interpreter, object ); - t->create(); + // don't call create() because Valgrind complains about invalid read in + // the rather bizarre GCThread::onTerminated; try a lame workaround: + t->createSuspended(); + t->resume(); } } commit 962d0500c4debaef43e5f146e47e08c66d851562 Author: Michael Stahl <mst...@redhat.com> Date: Sat Feb 18 00:06:33 2012 +0100 fdo#39510: fix yet more layout crashes in ~SwRootFrm: Call SwRootFrm::RemoveFtns with the proper boolean to also eliminate EndNotes, and fix a faulty while loop in RemoveFtns that's been preventing removal of footnotes in certain sections since the dawn of CVS history. (regression from CWS swlayoutrefactoring, crashes on bugdoc from i#101776) diff --git a/sw/source/core/layout/ftnfrm.cxx b/sw/source/core/layout/ftnfrm.cxx index 7d3ea83..940bc11 100644 --- a/sw/source/core/layout/ftnfrm.cxx +++ b/sw/source/core/layout/ftnfrm.cxx @@ -1000,7 +1000,7 @@ void lcl_RemoveFtns( SwFtnBossFrm* pBoss, sal_Bool bPageOnly, sal_Bool bEndNotes if( pBody && pBody->Lower() ) { SwFrm* pLow = pBody->Lower(); - while( pLow->GetNext() ) + while (pLow) { if( pLow->IsSctFrm() && ( !pLow->GetNext() || ((SwSectionFrm*)pLow)->IsAnyNoteAtEnd() ) && diff --git a/sw/source/core/layout/newfrm.cxx b/sw/source/core/layout/newfrm.cxx index 1e9b0e8..5f12ef5 100644 --- a/sw/source/core/layout/newfrm.cxx +++ b/sw/source/core/layout/newfrm.cxx @@ -610,7 +610,7 @@ SwRootFrm::~SwRootFrm() // also searches backwards to find the master of footnotes, they must be // considered to be owned by the SwRootFrm and also be destroyed here, // before tearing down the (now footnote free) rest of the layout. - AllRemoveFtns(); + RemoveFtns(0, false, true); if(pBlink) pBlink->FrmDelete( this ); commit 67c396fb66a9c21c9eafaf4bcc3654706f643df0 Author: Michael Stahl <mst...@redhat.com> Date: Sat Feb 18 00:03:39 2012 +0100 fdo#39657: fix crash when parsing XML signatures diff --git a/xmlsecurity/source/helper/xsecverify.cxx b/xmlsecurity/source/helper/xsecverify.cxx index a61eb6e..0f22599 100644 --- a/xmlsecurity/source/helper/xsecverify.cxx +++ b/xmlsecurity/source/helper/xsecverify.cxx @@ -121,7 +121,12 @@ void XSecController::addSignature() void XSecController::addReference( const rtl::OUString& ouUri) { - InternalSignatureInformation &isi = m_vInternalSignatureInformations[m_vInternalSignatureInformations.size()-1]; + if (m_vInternalSignatureInformations.empty()) + { + OSL_TRACE("XSecController::addReference: no signature"); + return; + } + InternalSignatureInformation &isi = m_vInternalSignatureInformations.back(); isi.addReference(TYPE_SAMEDOCUMENT_REFERENCE,ouUri, -1 ); } @@ -131,7 +136,12 @@ void XSecController::addStreamReference( { sal_Int32 type = (isBinary?TYPE_BINARYSTREAM_REFERENCE:TYPE_XMLSTREAM_REFERENCE); - InternalSignatureInformation &isi = m_vInternalSignatureInformations[m_vInternalSignatureInformations.size()-1]; + if (m_vInternalSignatureInformations.empty()) + { + OSL_TRACE("XSecController::addStreamReference: no signature"); + return; + } + InternalSignatureInformation &isi = m_vInternalSignatureInformations.back(); if ( isi.xReferenceResolvedListener.is() ) { @@ -154,7 +164,13 @@ void XSecController::addStreamReference( void XSecController::setReferenceCount() const { - const InternalSignatureInformation &isi = m_vInternalSignatureInformations[m_vInternalSignatureInformations.size()-1]; + if (m_vInternalSignatureInformations.empty()) + { + OSL_TRACE("XSecController::setReferenceCount: no signature"); + return; + } + const InternalSignatureInformation &isi = + m_vInternalSignatureInformations.back(); if ( isi.xReferenceResolvedListener.is() ) { @@ -182,51 +198,97 @@ void XSecController::setReferenceCount() const void XSecController::setX509IssuerName( rtl::OUString& ouX509IssuerName ) { - InternalSignatureInformation &isi = m_vInternalSignatureInformations[m_vInternalSignatureInformations.size()-1]; + if (m_vInternalSignatureInformations.empty()) + { + OSL_TRACE("XSecController::setX509IssuerName: no signature"); + return; + } + InternalSignatureInformation &isi = m_vInternalSignatureInformations.back(); isi.signatureInfor.ouX509IssuerName = ouX509IssuerName; } void XSecController::setX509SerialNumber( rtl::OUString& ouX509SerialNumber ) { - InternalSignatureInformation &isi = m_vInternalSignatureInformations[m_vInternalSignatureInformations.size()-1]; + if (m_vInternalSignatureInformations.empty()) + { + OSL_TRACE("XSecController::setX509SerialNumber: no signature"); + return; + } + InternalSignatureInformation &isi = m_vInternalSignatureInformations.back(); isi.signatureInfor.ouX509SerialNumber = ouX509SerialNumber; } void XSecController::setX509Certificate( rtl::OUString& ouX509Certificate ) { - InternalSignatureInformation &isi = m_vInternalSignatureInformations[m_vInternalSignatureInformations.size()-1]; + if (m_vInternalSignatureInformations.empty()) + { + OSL_TRACE("XSecController::setX509Certificate: no signature"); + return; + } + InternalSignatureInformation &isi = m_vInternalSignatureInformations.back(); isi.signatureInfor.ouX509Certificate = ouX509Certificate; } void XSecController::setSignatureValue( rtl::OUString& ouSignatureValue ) { - InternalSignatureInformation &isi = m_vInternalSignatureInformations[m_vInternalSignatureInformations.size()-1]; + if (m_vInternalSignatureInformations.empty()) + { + OSL_TRACE("XSecController::setSignatureValue: no signature"); + return; + } + InternalSignatureInformation &isi = m_vInternalSignatureInformations.back(); isi.signatureInfor.ouSignatureValue = ouSignatureValue; } void XSecController::setDigestValue( rtl::OUString& ouDigestValue ) { - SignatureInformation &si = m_vInternalSignatureInformations[m_vInternalSignatureInformations.size()-1].signatureInfor; - SignatureReferenceInformation &reference = si.vSignatureReferenceInfors[si.vSignatureReferenceInfors.size()-1]; + if (m_vInternalSignatureInformations.empty()) + { + OSL_TRACE("XSecController::setDigestValue: no signature"); + return; + } + InternalSignatureInformation &isi = m_vInternalSignatureInformations.back(); + if (isi.signatureInfor.vSignatureReferenceInfors.empty()) + { + OSL_TRACE("XSecController::setDigestValue: no signature reference"); + return; + } + SignatureReferenceInformation &reference = + isi.signatureInfor.vSignatureReferenceInfors.back(); reference.ouDigestValue = ouDigestValue; } void XSecController::setDate( rtl::OUString& ouDate ) { - InternalSignatureInformation &isi = m_vInternalSignatureInformations[m_vInternalSignatureInformations.size()-1]; + if (m_vInternalSignatureInformations.empty()) + { + OSL_TRACE("XSecController::setDate: no signature"); + return; + } + InternalSignatureInformation &isi = m_vInternalSignatureInformations.back(); convertDateTime( isi.signatureInfor.stDateTime, ouDate ); isi.signatureInfor.ouDateTime = ouDate; } void XSecController::setId( rtl::OUString& ouId ) { - InternalSignatureInformation &isi = m_vInternalSignatureInformations[m_vInternalSignatureInformations.size()-1]; + if (m_vInternalSignatureInformations.empty()) + { + OSL_TRACE("XSecController::setId: no signature"); + return; + } + InternalSignatureInformation &isi = m_vInternalSignatureInformations.back(); isi.signatureInfor.ouSignatureId = ouId; } void XSecController::setPropertyId( rtl::OUString& ouPropertyId ) { - InternalSignatureInformation &isi = m_vInternalSignatureInformations[m_vInternalSignatureInformations.size()-1]; + if (m_vInternalSignatureInformations.empty()) + { + OSL_TRACE("XSecController::setPropertyId: no signature"); + return; + } + InternalSignatureInformation &isi = m_vInternalSignatureInformations.back(); isi.signatureInfor.ouPropertyId = ouPropertyId; } _______________________________________________ Libreoffice-commits mailing list Libreoffice-commits@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits