Issue 83888 - Second time click hyperlink button,the presentation crash.
Summary: Second time click hyperlink button,the presentation crash.
Status: CLOSED FIXED
Alias: None
Product: Impress
Classification: Application
Component: code (show other issues)
Version: OOo 2.3
Hardware: All Windows XP
: P2 Trivial (vote)
Target Milestone: OOo 3.0
Assignee: wolframgarten
QA Contact: issues@graphics
URL:
Keywords:
Depends on:
Blocks: 84405
  Show dependency tree
 
Reported: 2007-11-23 03:57 UTC by wavelsb
Modified: 2008-07-07 12:10 UTC (History)
3 users (show)

See Also:
Issue Type: DEFECT
Latest Confirmation in: ---
Developer Difficulty: ---

Attachments
BugDoc with two pages, one button on page0 which goes to page1. (9.96 KB, text/plain)
2008-02-12 16:03 UTC, Armin Le Grand 		no flags Details
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this issue.
Description wavelsb 2007-11-23 03:57:01 UTC 
1.Create a presentation.
2.Insert-hyperlink,
   hyperlink dilog box parameters:
   document,select slide 4 in traget in document dilog box,form:button.
3.click the Hyperlind button.and click it again.
result:the presentation crash.
Comment 1 christian.guenther 2007-11-23 10:21:54 UTC 
Set to new and change the target.
Comment 2 christian.guenther 2007-11-23 10:22:57 UTC 
I can reproduce the bug in src680m236.
Please have also a look to the crash report rmk8kn
Comment 3 clippka 2007-12-07 08:47:20 UTC 
changing target
Comment 4 clippka 2008-01-11 15:35:42 UTC 
you have to leave design mode so the button comes active. It must target another
slide and the crash happens if you click it once, go back to the slide with the
button and click it again.

cl->aw: one for you.

>	svx680mi.dll!sdr::contact::ViewObjectContactList::GetLastObjectAndRemove() 
Line 105 + 0x6 bytes	C++
 	svx680mi.dll!sdr::contact::ObjectContact::PrepareDelete()  Line 111 + 0xb
bytes	C++
 	svx680mi.dll!SdrPageWindow::ResetObjectContact()  Line 616	C++
 	svx680mi.dll!SdrPageWindow::~SdrPageWindow()  Line 199	C++
 	svx680mi.dll!SdrPageView::ClearPageWindows()  Line 185 + 0x1c bytes	C++
 	svx680mi.dll!SdrPageView::Hide()  Line 357	C++
 	svx680mi.dll!SdrPaintView::HideSdrPage()  Line 692	C++
 	svx680mi.dll!SdrMarkView::HideSdrPage()  Line 365	C++
 	svx680mi.dll!FmFormView::HideSdrPage()  Line 509	C++
 	sd680mi.dll!sd::DrawView::HideSdrPage()  Line 704	C++
 	sd680mi.dll!sd::DrawViewShell::SwitchPage(unsigned short nSelectedPage=3) 
Line 1128	C++
Comment 5 Armin Le Grand 2008-02-12 14:30:33 UTC 
AW: Has probably to do with FormControls as VCL Windows. These seem not to be
correctly destroyed. Taking a look...
Comment 6 Armin Le Grand 2008-02-12 16:02:01 UTC 
AW->AF: As discussed, i set this to You first and add the stack and a BugDoc.
The basic problem is that inside the first sd::DrawViewShell::SwitchPage() the
deletion of the FormControl which is a living VCl-Window probably loses focus
and VCL tries to set the focus on the remaining application window. This again
leads to a sd::DrawViewShell::Activate() which again starts a
DrawViewShell::SwitchPage() while the first one is still running (!).

This is probably a Framework problem, eventually comment and forward.

The stack is as follows:

 	svx680mi.dll!sdr::contact::ObjectContact::PrepareDelete()  Line 112	C++
 	svx680mi.dll!SdrPageWindow::ResetObjectContact()  Line 616	C++
 	svx680mi.dll!SdrPageWindow::~SdrPageWindow()  Line 199	C++
 	svx680mi.dll!SdrPageView::ClearPageWindows()  Line 185 + 0x21 bytes	C++
 	svx680mi.dll!SdrPageView::~SdrPageView()  Line 272	C++
 	svx680mi.dll!SdrPageView::`vector deleting destructor'()  + 0x50 bytes	C++
 	svx680mi.dll!SdrPaintView::HideSdrPage()  Line 693 + 0x24 bytes	C++
 	svx680mi.dll!SdrMarkView::HideSdrPage()  Line 365	C++
 	svx680mi.dll!FmFormView::HideSdrPage()  Line 507	C++
 	sd680mi.dll!sd::DrawView::HideSdrPage()  Line 704	C++
 	sd680mi.dll!sd::DrawViewShell::SwitchPage(unsigned short nSelectedPage=0) 
Line 1128	C++
 	sd680mi.dll!sd::DrawViewShell::ReadFrameViewData(sd::FrameView *
pView=0x0a3f3418)  Line 383	C++
 	sd680mi.dll!sd::ViewShell::Activate(unsigned char bIsMDIActivate='')  Line
415	C++
 	sd680mi.dll!sd::DrawViewShell::Activate(unsigned char bIsMDIActivate='') 
Line 183	C++
 	sfx680mi.dll!06210f94() 	
 	[Frames below may be incorrect and/or missing, no symbols loaded for
sfx680mi.dll]	
 	sfx680mi.dll!061c1df2() 	
 	sfx680mi.dll!061bdc28() 	
 	sfx680mi.dll!061f4015() 	
>	sd680mi.dll!sd::ViewShellManager::Implementation::UpdateShellStack()  Line
1129	C++
 	sd680mi.dll!sd::ViewShellManager::Implementation::UnlockUpdate()  Line 1044	C++
 	sd680mi.dll!sd::ViewShellManager::Implementation::MoveToTop(const SfxShell &
rShell={...})  Line 912	C++
 
sd680mi.dll!sd::ViewShellManager::Implementation::WindowEventHandler(VclWindowEvent
* pEvent=0x00f0d0d0)  Line 1327	C++
 
sd680mi.dll!sd::ViewShellManager::Implementation::LinkStubWindowEventHandler(void
* pThis=0x0a555988, void * pCaller=0x00f0d0d0)  Line 1309 + 0xf bytes	C++
 	tl680mi.dll!002c6a82() 	
 	vcl680mi.dll!10004391() 	
 	vcl680mi.dll!10051e22() 	
 	vcl680mi.dll!100557e9() 	
 	vcl680mi.dll!10106051() 	
 	vcl680mi.dll!1005537c() 	
 	vcl680mi.dll!10055e91() 	
 	vcl680mi.dll!10059b35() 	
 	vcl680mi.dll!1006a3dd() 	
 	msvcr80d.dll!00f13db4() 	
 	vcl680mi.dll!10156d67() 	
 	vcl680mi.dll!100742ae() 	
 	vcl680mi.dll!100743f2() 	
 	tk680mi.dll!01eae2dc() 	
 	tk680mi.dll!01ee42f3() 	
 	tk680mi.dll!01eeb4b5() 	
 	tk680mi.dll!01edae32() 	
 	tk680mi.dll!01eb7bcf() 	
 	tk680mi.dll!01ec5570() 	
 	tk680mi.dll!01ec568d() 	
 	frm680mi.dll!0f66bd9f() 	
 	frm680mi.dll!0f69e95a() 	
 	frm680mi.dll!0f63ca97() 	
 	cppuhelper3MSC.dll!016e8042() 	
 
svx680mi.dll!sdr::contact::UnoControlContactHelper::disposeAndClearControl_nothrow(com::sun::star::uno::Reference<com::sun::star::awt::XControl>
& _rxControl={...})  Line 294 + 0x14 bytes	C++
 
svx680mi.dll!sdr::contact::ViewObjectContactOfUnoControl_Impl::impl_dispose_nothrow(bool
_bAlsoDisposeControl=true)  Line 890 + 0xc bytes	C++
 	svx680mi.dll!sdr::contact::ViewObjectContactOfUnoControl_Impl::dispose() 
Line 905	C++
 
svx680mi.dll!sdr::contact::ViewObjectContactOfUnoControl::~ViewObjectContactOfUnoControl()
 Line 1613	C++
 	svx680mi.dll!sdr::contact::UnoControlWindowContact::~UnoControlWindowContact()
 Line 1803 + 0x33 bytes	C++
 	svx680mi.dll!sdr::contact::UnoControlWindowContact::`scalar deleting
destructor'()  + 0xf bytes	C++
 	svx680mi.dll!sdr::contact::ObjectContact::PrepareDelete()  Line 126 + 0x20
bytes	C++
 	svx680mi.dll!SdrPageWindow::ResetObjectContact()  Line 616	C++
 	svx680mi.dll!SdrPageWindow::~SdrPageWindow()  Line 199	C++
 	svx680mi.dll!SdrPageView::ClearPageWindows()  Line 185 + 0x21 bytes	C++
 	svx680mi.dll!SdrPageView::Hide()  Line 357	C++
 	svx680mi.dll!SdrPaintView::HideSdrPage()  Line 693	C++
 	svx680mi.dll!SdrMarkView::HideSdrPage()  Line 365	C++
 	svx680mi.dll!FmFormView::HideSdrPage()  Line 507	C++
 	sd680mi.dll!sd::DrawView::HideSdrPage()  Line 704	C++
 	sd680mi.dll!sd::DrawViewShell::SwitchPage(unsigned short nSelectedPage=1) 
Line 1128	C++
 	sd680mi.dll!sd::SdUnoDrawView::setCurrentPage(const
com::sun::star::uno::Reference<com::sun::star::drawing::XDrawPage> &
xPage={...})  Line 613	C++
 	sd680mi.dll!sd::DrawController::setCurrentPage(const
com::sun::star::uno::Reference<com::sun::star::drawing::XDrawPage> &
xPage={...})  Line 417 + 0x4e bytes	C++
 	sd680mi.dll!sd::DrawDocShell::GotoBookmark(const String & rBookmark={...}) 
Line 920 + 0x21 bytes	C++
 	sd680mi.dll!sd::DrawViewShell::GotoBookmark(const String & rBookmark={...}) 
Line 99 + 0xc bytes	C++
 	sd680mi.dll!sd::DrawViewShell::ExecCtrl(SfxRequest & rReq={...})  Line 523	C++
 	sd680mi.dll!SfxStubDrawViewShellExecCtrl(SfxShell * pShell=0x0a438e58,
SfxRequest & rReq={...})  Line 1057 + 0xf bytes	C++

BugDoc follows...
Comment 7 Armin Le Grand 2008-02-12 16:03:16 UTC 
Created attachment 51478 [details]
BugDoc with two pages, one button on page0 which goes to page1.
Comment 8 Armin Le Grand 2008-02-12 16:05:10 UTC 
AW: BugDoc added. To reproduce:
- load bugdoc
- press button
- go back to page 0
- press again -> GPF.
To get the stack, set Breakpoint at svx/source/sdr/contact/objectcontact.cxx:112.
Comment 9 Armin Le Grand 2008-02-12 16:05:46 UTC 
AW: Added myself and FS to CC.
Comment 10 groucho266 2008-06-04 14:33:57 UTC 
Yes, the crash is caused by a re-entrance problem of SwitchPage().

That in turn is caused by activating the edit view from withing SwitchPage():
switching view shells involves deativation and activation.  This then calls
ReadFrameViewData() which tries to set the current page that was stored
previously.  The current SwitchPage(), however, has up to this point not yet
completely set the current page to the new page. Therefore the second, nested,
call to SwitchPage() can not detect that there is nothing to do and tries again
to switch the page.
Comment 11 groucho266 2008-06-05 08:45:10 UTC 
There are three possible fixes:

1) Activate the edit view when the form control is clicked but before the page
is switched.  Found no easy way to do that.

2) Set the current slide early in SwitchPage() so that in the nested call there
is nothing to do and the call exits without doing any harm.  The problem with
this approach is that the current slide is stored in at least three different
ways (the mpActualPage pointer, in the maTabControl, in the page view) and
probably more.  Therefore the fix would be fragile and might lead to further bugs.

3) Introduce a new flag to DrawViewShell and use that to prevent nested calls of
SwitchPage().  Did that because it is robust and prevents nested calls to
SwitchPage() when they originite from other scenarios.

Modified files are:
/sd/source/ui/inc/DrawViewShell.hxx    rev. 1.26.40.1
/sd/source/ui/view/drviews1.cxx    rev. 1.79.40.1
/sd/source/ui/view/drviewsa.cxx    rev. 1.49.40.1
Comment 12 groucho266 2008-06-10 08:50:04 UTC 
Please verify.
Comment 13 wolframgarten 2008-06-10 10:03:39 UTC 
Verified in CWS.
Comment 14 liushibo_redflag 2008-06-10 10:13:38 UTC 
Thanks.
Comment 15 wolframgarten 2008-07-07 12:10:19 UTC 
Tested in DEV300_m23.