Hi all,
Thanks to Alexandre's help I was able to reproduce these problems on my machine and, after much digging around in the code, was able to find a solution that fixes the bugs on my system.
I have uploaded a library here for you to test:
http://people.debian.org/~halls/openoffice/test/libpsp645li.so.bz2
Please bunzip into /usr/lib/openoffice/program, replacing the existing library there.
For the record, here is a short explaination of the problem: When reproducing the crasher in impress->format->character->change tab, valgrind reports that memory is being read that has already been deleted:
Address 0x1CC6F654 is 20 bytes inside a block of size 92 free'd
[...]
by 0x8086B16: operator delete(void*) (in soffice.bin)
by 0x21811850: SdDrawDocShell::SetPrinter(SfxPrinter*) (in libsd645li.so)
by 0x216FD206: SdWindow::DataChanged(DataChangedEvent const&) (in libsd645li.so)
The SetPrinter event is triggered by a SALEVENT_PRINTERCHANGED event which is generated whenever CUPSManager::checkPrintersChanged is called, which does not appear to be correct. Since the 1.1 code does not seem to have been tested with such dynamic printer updates, I have disabled them, and now printer queues are only enumerated on startup.
I have tested the library using ooimpress and indeed it fixes the bug related to selecting a single word for changing the color.
I would like to point out, that, as suggested from the beginning :
1) the two bugs (crash using character menu, and single word color modification) are indeed correlated,
2) are due to the new enhanced cups printer server code,
Anyway thanks a lot for the time dedicated to fixing this bug. I will be able to remove my non debian binary copy of OpenOffice.
Keep up the good work,
-- eric
-- __ / ` Eric Valette /-- __ o _. 6 rue Paul Le Flem (___, / (_(_(__ 35740 Pace
Tel: +33 (0)2 99 85 26 76 Fax: +33 (0)2 99 85 26 76 E-mail: [EMAIL PROTECTED]
-- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
