On 03/21/07 13:26, Frank Meies - Sun Germany - Development - Software
Engineer wrote:
On 03/20/07 17:14, Matthias B. wrote:
We have a custom Java component that constructs letterheads by mixing
several files and other
data via UNO.
We have encountered several cases where OOo's internal data structures
seem to become
corrupted during the process.
One such issue is the following:
An SwIndexReg (sw/source/core/bastyp/index.cxx) gets destroyed even
though there
are still SwIndexes in it. Later, when these SwIndexes are destroyed,
their destructors
call SwIndex::Remove() in an attempt to deregister from the
SwIndexReg. Because the SwIndexReg
has been destroyed, Remove() writes to an invalid memory location,
we traced this bug to the call to SwDoc::DelFullPara(). Looks like a
SwUnoCrsr is inconsistent after this call. To be continued ...
The problem can be reproduced using a little macro:
1. New document with two paragraphs: A and B
1. Create a cursor in a paragraph A
2. Call removeTextContent( A )
After this, the nContent part of the SwUnoCrsr object points to a node
in the undo array.
3. Do a couple of other operations to paragraph B (> 100 because 100 is
the default size of the undo stack).
This will remove paragraph A from the undo array, the destructor of A
triggeres the Assertion "Es sind noch Indizes angemeldet". When finally
the macro finishes, the SwUnoCursor is deleted. The destructor ~SwIndex
accesses the previously deleted paragraph A in order to remove itself
from the list of registered indices.
*But* I did not manage to have this crash the Writer, since there is a
fixed mempool for SwTxtNode object, which basically reserves some memory
for the paragraphs. Therefore most probably you won't get any access
violations.
Regards,
Frank
--
Frank Meies (fme) - OpenOffice.org Writer
OpenOffice.org Engineering at Sun: http://blogs.sun.com/GullFOSS
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
