Issue 65784 - Writer: memory corruption when deleting a shape
Summary: Writer: memory corruption when deleting a shape
Status: CLOSED FIXED
Alias: None
Product: Writer
Classification: Application
Component: code (show other issues)
Version: current
Hardware: All All
: P2 Trivial (vote)
Target Milestone: ---
Assignee: frank.meies
QA Contact: issues@sw
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2006-05-26 09:46 UTC by thomas.lange
Modified: 2013-08-07 14:43 UTC (History)
1 user (show)

See Also:
Issue Type: DEFECT
Latest Confirmation in: ---
Developer Difficulty: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this issue.
Description thomas.lange 2006-05-26 09:46:20 UTC 
Insert a shape via UI and select.
When removing it now with the delete button windbg reports a memory corruption.
It states that a previously freed part of memory gets modified.

TL: when trying to find the root cause with valgrind the problem was not found.
Comment 1 thomas.lange 2006-05-26 10:08:19 UTC 
The stack when the problem is reported by windbg looks like this:

WARNING: Stack unwind information not available. Following frames may be wrong.
ntdll!DbgBreakPoint
ntdll!RtlpNtEnumerateSubKey+0x5d07
ntdll!RtlSizeHeap+0xb9b
ntdll!RtlAllocateHeap+0xe44
MSVCR71!_crtLCMapStringA+0x305
MSVCR71! crtLCMa Strin A+0x32d
svl680mi!SfxItemSet::SfxItemSet+0x2b 
o:\src680\src\svtools\source\items1\itemset.cxx @ 276
sw680mi!SwAttrSet::SwAttrSet+0x12
[o:\src680\src\sw\source\core\attr\swatrset.cxx @ 113]
sw680mi!SwFmt::SetAttr+0x56 [o:\src680\src\sw\source\core\attr\format.cxx @ 498]
sw680mi!lcl_SaveAnchor+0x15f [o:\src680\src\sw\source\core\undo\undraw.cxx @ 224]
sw680mi!SwUndoDrawDelete::AddObj+0x46
[o:\src680\src\sw\source\core\undo\undraw.cxx @ 629]
sw680mi!SwDoc::DeleteSelection+0x1a9
[o:\src680\src\sw\source\core\doc\docdraw.cxx @ 570]
sw680mi!SwDrawView::DeleteMarked+0x79
[o:\src680\src\sw\source\core\draw\dview.cxx @ 1009]
sw680mi!SwFEShell::DelSelectedObj+0x1f
[o:\src680\src\sw\source\core\frmedt\feshview.cxx @ 2202]
sw680mi!SwDrawBaseShell::Execute+0xf5c
[o:\src680\src\sw\source\ui\shells\drwbassh.cxx @ 519]
sw680mi!SfxStubSwDrawBaseShellExecute+0xe
[o:\src680\src\sw\wntmsci10.pro\inc\swslots.hxx @ 6475]
sfx680mi!SfxDispatcher::Call_Impl+0x3bc
[o:\src680\src\sfx2\source\control\dispatch.cxx @ 342]
sfx680mi!SfxDispatcher::_Execute+0x1a5
[o:\src680\src\sfx2\source\control\dispatch.cxx @ 1073]
sfx680mi!SfxBindings::Execute_Impl+0x402
[o:\src680\src\sfx2\source\control\bindings.cxx @ 1750]
sfx680mi!SfxDispatchController_Impl::dispatch+0xba9
[o:\src680\src\sfx2\source\control\unoctitm.cxx @ 828]
Comment 2 thomas.lange 2006-05-29 09:30:33 UTC 
It seems the stack is not always the same. 
Another run gave:

WARNING: Stack unwind information not available. Following frames may be wrong.
ntdll!DbgBreakPoint
ntdll!RtlpNtEnumerateSubKey+0x5d07
ntdll!RtlSizeHeap+0xb9b
ntdll!RtlAllocateHea +0xe44
MSVCR71! crtLCMa Strin A+0x305
MSVCR71!_crtLCMapStringA+0x32d
vcl680mi!Region::Region+0xe [o:\src680\src\vcl\source\gdi\region.cxx @ 807]
vcl680mi!Window::ImplInvalidate+0x103
[o:\src680\src\vcl\source\window\window.cxx @ 2692]
vcl680mi!Window::Invalidate+0x60 [o:\src680\src\vcl\source\window\window.cxx @ 7329]
svx680mi!SdrPageViewWindow::Invalidate+0x3d
[z:\cws03\tl21\src680\src.m168\svx\source\svdraw\svdpagv.cxx @ 8
svx680mi!sdr::contact::ViewObjectContact::ActionChanged+0x2c
[z:\cws03\tl21\src680\src.m168\svx\source\sdr\c
svx680mi!sdr::contact::ViewObjectContact::PrepareDelete+0x8
[z:\cws03\tl21\src680\src.m168\svx\source\sdr\co
svx680mi!sdr::contact::ViewContact::ActionRemoved+0x1d
[z:\cws03\tl21\src680\src.m168\svx\source\sdr\contact
svx680mi!SdrObjList::RemoveObject+0x26
[z:\cws03\tl21\src680\src.m168\svx\source\svdraw\svdpage.cxx @ 457]
svx680mi!FmFormPage::RemoveObject+0xf
[z:\cws03\tl21\src680\src.m168\svx\source\form\fmpage.cxx @ 340]
svx680mi!SdrEditView::DeleteMarked+0x9a
[z:\cws03\tl21\src680\src.m168\svx\source\svdraw\svdedtv.cxx @ 728]
svx680mi!SdrEditView::DeleteMarkedObj+0x78
[z:\cws03\tl21\src680\src.m168\svx\source\svdraw\svdedtv.cxx @ 74
svx680mi!SdrView::DeleteMarked+0x89
[z:\cws03\tl21\src680\src.m168\svx\source\svdraw\svdview.cxx @ 1312]
sw680mi!SwDrawView::DeleteMarked+0x85
[d:\tl21\src680\sw\source\core\draw\dview.cxx @ 1012]
sw680mi!SwFEShell::DelSelectedObj+0x1f
[d:\tl21\src680\sw\source\core\frmedt\feshview.cxx @ 2202]
Comment 3 thomas.lange 2006-05-29 09:48:49 UTC 
TL->FME: Please take over. Thanks!
Comment 4 frank.meies 2006-07-12 13:52:05 UTC 
FME: Fixed in sw/source/core/draw/dcontact.cxx rev. 1.49.152.1
Comment 5 frank.meies 2006-07-18 13:02:50 UTC 
FME: Prio changed to P2.
Comment 6 frank.meies 2006-07-18 13:56:36 UTC 
FME: Nothing to do for QA. Verified.
Comment 7 Mathias_Bauer 2007-02-05 13:59:45 UTC 
closing ancient issues