https://bugs.freedesktop.org/show_bug.cgi?id=55496
Priority: medium
Bug ID: 55496
Assignee: [email protected]
Summary: Cancel of Mail Merge Wizard causes access to already
deleted SfxItemPool
Severity: normal
Classification: Unclassified
OS: All
Reporter: [email protected]
Hardware: All
Status: UNCONFIRMED
Version: 3.7.0.0.alpha0+ Master
Component: Writer
Product: LibreOffice
At least with recent unxlngx6 master, soffice --writer, "Tools - Mail Merge
Wizard...", proceed to step "8. Save, print or send", then "Cancel":
Invalid read of size 8
at 0x6941920: SfxItemPool::GetFrozenIdRanges() const
(/svl/source/items/itempool.cxx:919)
by 0x69544DD: SfxItemSet::~SfxItemSet() (/svl/source/items/itemset.cxx:330)
by 0x69545A8: SfxItemSet::~SfxItemSet() (/svl/source/items/itemset.cxx:336)
by 0x6533960: SfxPrinter::~SfxPrinter() (/sfx2/source/view/printer.cxx:188)
by 0x65339C8: SfxPrinter::~SfxPrinter() (/sfx2/source/view/printer.cxx:190)
by 0x2B415782: SwMailMergeOutputPage::~SwMailMergeOutputPage()
(/sw/source/ui/dbui/mmoutputpage.cxx:386)
by 0x2B415D98: SwMailMergeOutputPage::~SwMailMergeOutputPage()
(/sw/source/ui/dbui/mmoutputpage.cxx:387)
by 0x6F10A17: svt::OWizardMachine::~OWizardMachine()
(/svtools/source/dialogs/wizardmachine.cxx:231)
by 0x2B3F3938: SwMailMergeWizard::~SwMailMergeWizard()
(/sw/source/ui/dbui/mailmergewizard.cxx:114)
by 0x88B1C07: vcl::LazyDeletor<Window>::~LazyDeletor()
(/solver/unxlngx6/inc/vcl/lazydelete.hxx:171)
by 0x88B2158: vcl::LazyDeletor<Window>::~LazyDeletor()
(/solver/unxlngx6/inc/vcl/lazydelete.hxx:173)
by 0x87BFBE4: vcl::LazyDelete::flush() (/vcl/source/helper/lazydelete.cxx:54)
by 0x84FFCA4: Application::Yield(bool) (/vcl/source/app/svapp.cxx:439)
by 0x84FFCE6: Application::Execute() (/vcl/source/app/svapp.cxx:413)
by 0x4EACD8F: desktop::Desktop::Main() (/desktop/source/app/app.cxx:1712)
by 0x8509340: ImplSVMain() (/vcl/source/app/svmain.cxx:173)
by 0x85093F4: SVMain() (/vcl/source/app/svmain.cxx:210)
by 0x4EE4074: soffice_main (/desktop/source/app/sofficemain.cxx:83)
by 0x4007CA: main (/desktop/source/app/main.c:25)
Address 0x19af5f00 is 16 bytes inside a block of size 32 free'd
at 0x4A0614C: operator delete(void*)
(/home/sbergman/valgrind/src/trunk/coregrind/m_replacemalloc/vg_replace_malloc.c:477)
by 0x6946D60: SfxItemPool::Free(SfxItemPool*)
(/svl/source/items/itempool.cxx:366)
by 0x221404BD: SwDoc::~SwDoc() (/sw/source/core/doc/docnew.cxx:717)
by 0x22141938: SwDoc::~SwDoc() (/sw/source/core/doc/docnew.cxx:718)
by 0x2284A731: SwDocShell::RemoveLink() (/sw/source/ui/app/docshini.cxx:512)
by 0x2284A859: SwDocShell::~SwDocShell() (/sw/source/ui/app/docshini.cxx:420)
by 0x2284A9D8: SwDocShell::~SwDocShell() (/sw/source/ui/app/docshini.cxx:428)
by 0x653FB15: SfxViewFrame::ReleaseObjectShell_Impl()
(/solver/unxlngx6/inc/tools/ref.hxx:188)
by 0x6544E41: SfxViewFrame::~SfxViewFrame()
(/sfx2/source/view/viewfrm.cxx:1473)
by 0x6545388: SfxViewFrame::~SfxViewFrame()
(/sfx2/source/view/viewfrm.cxx:1494)
by 0x6540891: SfxViewFrame::Close() (/sfx2/source/view/viewfrm.cxx:1133)
by 0x6510097: SfxFrame::DoClose_Impl() (/sfx2/source/view/frame.cxx:175)
by 0x653B173: SfxBaseController::dispose()
(/sfx2/source/view/sfxbasecontroller.cxx:1041)
by 0x1BDDAE24:
framework::Frame::setComponent(com::sun::star::uno::Reference<com::sun::star::awt::XWindow>
const&, com::sun::star::uno::Reference<com::sun::star::frame::XController>
const&) (/framework/source/services/frame.cxx:1380)
by 0x1BDD8039: framework::Frame::close(unsigned char)
(/framework/source/services/frame.cxx:1633)
by 0x6511ED7: SfxFrame::DoClose() (/sfx2/source/view/frame.cxx:140)
by 0x228318CB: (anonymous
namespace)::SwMailMergeWizardExecutor::LinkStubCancelHdl(void*, void*)
(/sw/source/ui/app/apphdl.cxx:568)
by 0x88B6F3B: ImplWindowFrameProc(Window*, SalFrame*, unsigned short, void
const*) (/solver/unxlngx6/inc/tools/link.hxx:123)
by 0x88C6305: SalGenericDisplay::DispatchInternalEvent()
(/vcl/inc/salframe.hxx:278)
by 0x16465135: GtkData::userEventFn(void*) (/vcl/unx/gtk/app/gtkdata.cxx:954)
by 0x164651A8: call_userEventFn (/vcl/unx/gtk/app/gtkdata.cxx:964)
by 0x3575647694: g_main_context_dispatch
(/usr/src/debug/glib-2.32.4/glib/gmain.c:2539)
by 0x35756479C7: g_main_context_iterate.isra.23
(/usr/src/debug/glib-2.32.4/glib/gmain.c:3146)
by 0x3575647A83: g_main_context_iteration
(/usr/src/debug/glib-2.32.4/glib/gmain.c:3207)
by 0x16464E90: GtkData::Yield(bool, bool) (/vcl/unx/gtk/app/gtkdata.cxx:591)
by 0x84FFC43: Application::Yield(bool) (/vcl/source/app/svapp.cxx:434)
by 0x84FFCE6: Application::Execute() (/vcl/source/app/svapp.cxx:413)
by 0x4EACD8F: desktop::Desktop::Main() (/desktop/source/app/app.cxx:1712)
by 0x8509340: ImplSVMain() (/vcl/source/app/svmain.cxx:173)
by 0x85093F4: SVMain() (/vcl/source/app/svmain.cxx:210)
by 0x4EE4074: soffice_main (/desktop/source/app/sofficemain.cxx:83)
by 0x4007CA: main (/desktop/source/app/main.c:25)
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
Libreoffice-bugs mailing list
[email protected]
http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs
