https://bugs.documentfoundation.org/show_bug.cgi?id=152404
Bug ID: 152404
Summary: Crash in Writer when inserting a new comment while
there is uncommitted text
Product: LibreOffice
Version: 7.5.0.0 alpha1+
Hardware: All
OS: Windows (All)
Status: UNCONFIRMED
Severity: normal
Priority: medium
Component: Writer
Assignee: [email protected]
Reporter: [email protected]
Description:
After some debugging, I found that the crash occurs when the new comment grabs
focus, it invokes WinSalFrame::EndExtTextInput() which is supposed to commit
the uncommitted text. Unfortunately, Writer's input method handler commits the
text in two steps: first it deletes the uncommitted text, then it inserts the
committed text.
The crash occurs in the first step: when Writer deletes the uncommitted text,
it triggers Writer to remove the newly added comment and the comment's vcl
objects are all deleted.
Steps to Reproduce:
Steps to reproduce. Note: this crash occurs in Windows but not macOS since
macOS has not yet implemented SalFrame::EndExtTextInput():
1. Open a new Writer document
2. Change your keyboard entry to a Chinese, Japanese, or Korean input method (I
used Japanese Hiragana)
3. Type a few characters so that the text is in an uncommitted state (I typed
"aaa" on a US English physical keyboard which get converted to "あああ" by the
Japanese Hiragana input method)
4. Press the Control-Alt-C keys to create a new comment
5. Crash
Actual Results:
Application crashes due to use of a deleted pointer.
Expected Results:
Uncommitted text should be committed and the cursor moved to the new comment.
Reproducible: Always
User Profile Reset: Yes
Additional Info:
Version: 7.5.0.0.alpha1+ (X86_64) / LibreOffice Community
Build ID: c08e5db055c9d34d3f0b0b9d2a192d7ebdcd9576
CPU threads: 1; OS: Windows 10.0 Build 19045; UI render: Skia/Raster; VCL: win
Locale: en-US (en_US); UI: en-US
Calc: threaded
--
You are receiving this mail because:
You are the assignee for the bug.
