Apache OpenOffice (AOO) Bugzilla – Full Text Issue Listing
|Summary:||Inserting Equations into Bullet Lists|
|Component:||code||Assignee:||Armin Le Grand <Armin.Le.Grand>|
|Status:||CLOSED FIXED||QA Contact:|
|Priority:||P3||CC:||Armin.Le.Grand, awf.aoo, clarence.guo.bj, elish, issues, rb.henschel|
|Issue Type:||DEFECT||Latest Confirmation in:||---|
Description Ben 2013-10-12 03:49:44 UTC
Attempting to insert an equation into a bullet will cause an application crash, generating a recoverable document on the next open, but with a blank slide in place of the one that was being edited when the crash occurred. Work around: Create empty bullet point, insert equation into its own text box, then drag into position. This does not allow to in-line editing or simple font changes.
Comment 1 Edwin Sharp 2013-10-14 19:44:51 UTC
Crash with AOO401m5(Build:9714) - Rev. 1524958 2013-09-20 11:54 - Linux x86_64 Debian
Comment 2 Regina Henschel 2013-10-14 21:20:49 UTC
It does not only crash for Math objects but for charts and tables too. OOo3.4.1 leaves in this situation the edit mode and puts the object outside the presentation object. LO4.2 crashes too and reports an error in Microsoft Visual C++ Runtime Library, R6025 "-pure virtual function call".
Comment 3 Andre 2014-02-13 09:51:37 UTC
How to reproduce: 1. Create a new Impress document. 2. In sidebar, Layouts panes, select 'Title, Content' 3. Click on 'Click to add text' 4. Via menu 'Insert->Object->Formula' insert a formula. Crash in SdrObjEditView::SdrEndTextEdit(), main/svx/source/svdraw/svdedxv.cxx:856
Comment 4 Andre 2014-02-13 13:32:00 UTC
The root cause seems to be SdrEditView::ReplaceObjectAtView() which adds an undo object for replacing the text object which contains the bullet with the new OLE object. Shortly after (still while processing the formula insertion) the text edit mode is left. This triggers the deletion of all text change undo objects. The replacement undo object is one of them, as is the corresponding redo object. When the later is deleted, then also the replaced text object is deleted. This text object is then one whose text edit mode is ended and therefore it is accessed after having been deleted => crash. The question remains, what has changed, so that this error did not happen in earlier versions?
Comment 7 Armin Le Grand 2014-02-17 14:49:23 UTC
Tnaks Andre for the investigations. Problem is that the objects gets replaced while still in text edit. Text edit in its current form keeps (what is dangerous) various pointers to various objects, including the edited object, at various places, or in short: it's not secured in any way to shutdown automatically in cases like this, e.g. when the edited objects is to be replaced in the view/model. This needs to be done before that action is started, as in various other places where SdrEndTextEdit() is called. Adding code to do that and also code to RplaceObjectAtView to assert in that case and to do a last minute shutdown of an evtl. active TextEdit...
Comment 8 Armin Le Grand 2014-02-17 15:44:36 UTC
Checked, both additions work as expected. Preparing commit...
Comment 9 SVN Robot 2014-02-17 15:48:55 UTC
"alg" committed SVN revision 1569029 into trunk: i123468 Added SdrEndTextEdit before replacing EmptyPresObj, also secured Repl...
Comment 10 Armin Le Grand 2014-02-17 15:49:17 UTC
Comment 11 Clarence GUO 2014-04-03 06:17:03 UTC
Verified on trunk build rev. 1582712, fixed. ENV: Win7 64 bit professional SP1