Issue 123468

Summary: Inserting Equations into Bullet Lists
Product: Impress Reporter: Ben <agentroadkill04>
Component: codeAssignee: Armin Le Grand <Armin.Le.Grand>
Status: CLOSED FIXED QA Contact:
Severity: Major    
Priority: P3 CC: Armin.Le.Grand, awf.aoo,, elish, issues, rb.henschel
Version: 4.0.0Keywords: regression
Target Milestone: 4.1.0   
Hardware: All   
OS: All   
Issue Type: DEFECT Latest Confirmation in: ---
Developer Difficulty: ---

Description Ben 2013-10-12 03:49:44 UTC
Attempting to insert an equation into a bullet will cause an application crash, generating a recoverable document on the next open, but with a blank slide in place of the one that was being edited when the crash occurred. 

Work around:
Create empty bullet point, insert equation into its own text box, then drag into position. This does not allow to in-line editing or simple font changes.
Comment 1 Edwin Sharp 2013-10-14 19:44:51 UTC
Crash with

AOO401m5(Build:9714)  -  Rev. 1524958
2013-09-20 11:54 - Linux x86_64
Comment 2 Regina Henschel 2013-10-14 21:20:49 UTC
It does not only crash for Math objects but for charts and tables too. OOo3.4.1 leaves in this situation the edit mode and puts the object outside the presentation object.
LO4.2 crashes too and reports an error in Microsoft Visual C++ Runtime Library, R6025 "-pure virtual function call".
Comment 3 Andre 2014-02-13 09:51:37 UTC
How to reproduce:

1. Create a new Impress document.
2. In sidebar, Layouts panes, select 'Title, Content'
3. Click on 'Click to add text'
4. Via menu 'Insert->Object->Formula' insert a formula.

Crash in SdrObjEditView::SdrEndTextEdit(), main/svx/source/svdraw/svdedxv.cxx:856
Comment 4 Andre 2014-02-13 13:32:00 UTC
The root cause seems to be SdrEditView::ReplaceObjectAtView() which adds an undo object for replacing the text object which contains the bullet with the new OLE object.   Shortly after (still while processing the formula insertion) the text edit mode is left.  This triggers the deletion of all text change undo objects.  The replacement undo object is one of them, as is the corresponding redo object.  When the later is deleted, then also the replaced text object is deleted.  This text object is then one whose text edit mode is ended and therefore it is accessed after having been deleted => crash.

The question remains, what has changed, so that this error did not happen in earlier versions?
Comment 5 Andre 2014-02-13 13:47:34 UTC
Changes for issue 120498 may have caused this bug.
Comment 6 Andre 2014-02-13 13:48:17 UTC
Different syntax to provide a clickable link: bug 120498.
Comment 7 Armin Le Grand 2014-02-17 14:49:23 UTC
Tnaks Andre for the investigations. Problem is that the objects gets replaced while still in text edit. Text edit in its current form keeps (what is dangerous) various pointers to various objects, including the edited object, at various places, or in short: it's not secured in any way to shutdown automatically in cases like this, e.g. when the edited objects is to be replaced in the view/model. This needs to be done before that action is started, as in various other places where SdrEndTextEdit() is called.
Adding code to do that and also code to RplaceObjectAtView to assert in that case and to do a last minute shutdown of an evtl. active TextEdit...
Comment 8 Armin Le Grand 2014-02-17 15:44:36 UTC
Checked, both additions work as expected. Preparing commit...
Comment 9 SVN Robot 2014-02-17 15:48:55 UTC
"alg" committed SVN revision 1569029 into trunk:
i123468 Added SdrEndTextEdit before replacing EmptyPresObj, also secured Repl...
Comment 10 Armin Le Grand 2014-02-17 15:49:17 UTC
Okay, done.
Comment 11 Clarence GUO 2014-04-03 06:17:03 UTC
Verified on trunk build rev. 1582712, fixed.
ENV: Win7 64 bit professional SP1