https://bugs.documentfoundation.org/show_bug.cgi?id=117162
--- Comment #13 from Julien Nabet <[email protected]> --- (In reply to Julien Nabet from comment #12) > On pc Debian x86-64 with master sources updated today, the situation is > worse, the report doesn't load, it seems it entered in a never ending loop. > > Mike/Noel: any idea what could be wrong here? (there are quite a lot of > console logs). > I put tdf#117159 in cc since both may be related. Mike: I think there's a pb with https://cgit.freedesktop.org/libreoffice/core/commit/?id=6362c905cf19f2f6cb67bf634091b14c2a8e90ec tdf#143514: Avoid double-free in dbgutil code SdrObject::Free may start a chain of deletions, removing more than one object from maAllIncarnatedObjects. Trying to free them for the second time after that would lead to crash. Indeed, here what I did: - created a brand new odb file with by default embedded HSQL - with wizard, I created a new table - then using report wizard, I created a new report containing all the fields of the table, when clicking "Finish" button, it hangs here: // SdrObjectLifetimeWatchDog: if(!maAllIncarnatedObjects.empty()) { SAL_WARN("svx","SdrModel::~SdrModel: Not all incarnations of SdrObjects deleted, possible memory leak (!)"); // calling SdrObject::Free will change maAllIncarnatedObjects, and potentially remove more // than one - do not copy to another container, to not try to free already removed object. do { SdrObject* pCandidate(const_cast<SdrObject*>(*maAllIncarnatedObjects.begin())); SdrObject::Free(pCandidate); } while (!maAllIncarnatedObjects.empty()); } maAllIncarnatedObjects always contains 48 elements, it never decreases. See https://opengrok.libreoffice.org/xref/core/svx/source/svdraw/svdmodel.cxx?r=6362c905#199 After some gdb debug, I saw that LO always entered line 491 here: 473 void SdrObject::Free( SdrObject*& _rpObject ) 474 { 475 SdrObject* pObject = _rpObject; _rpObject = nullptr; 476 477 if(nullptr == pObject) 478 { 479 // nothing to do 480 return; 481 } 482 483 SvxShape* pShape(pObject->getSvxShape()); 484 485 if(pShape) 486 { 487 if(pShape->HasSdrObjectOwnership()) 488 { 489 // only the SvxShape is allowed to delete me, and will reset 490 // the ownership before doing so 491 return; 492 } 493 else 494 { 495 // not only delete pObject, but also need to dispose uno shape 496 try 497 { 498 pShape->InvalidateSdrObject(); 499 uno::Reference< lang::XComponent > xShapeComp( pObject->getWeakUnoShape(), uno::UNO_QUERY_THROW ); 500 xShapeComp->dispose(); 501 } 502 catch( const uno::Exception& ) 503 { 504 DBG_UNHANDLED_EXCEPTION("svx"); 505 } 506 } 507 } 508 509 delete pObject; 510 } (see https://opengrok.libreoffice.org/xref/core/svx/source/svdraw/svdobj.cxx?r=8c8d8786#491) -- You are receiving this mail because: You are the assignee for the bug.
