Attachment 159556 Details for Bug 122894 – First valgrind block accessing freed memory

First valgrind block accessing freed memory

valgrind-crash.log (text/plain), 16.82 KB, created by Jan-Marek Glogowski on 2020-04-14 13:17:43 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jan-Marek Glogowski

Created: 2020-04-14 13:17:43 UTC

Size: 16.82 KB

patch

obsolete

>==9631== Invalid read of size 1
>==9631==    at 0x2938A17D: SwObjectFormatterTextFrame::FormatAnchorFrameAndItsPrevs(SwTextFrame&) (flowfrm.hxx:140)
>==9631==    by 0x2938A8A0: SwObjectFormatterTextFrame::DoFormatObjs() (objectformattertxtfrm.cxx:781)
>
>==9631==    by 0x29388B6A: SwObjectFormatter::FormatObjsAtFrame(SwFrame&, SwPageFrame const&, SwLayAction*) (objectformatter.cxx:159)
>==9631==    by 0x29374E24: SwFootnoteBossFrame::MoveFootnotes_(std::vector<SwFootnoteFrame*, std::allocator<SwFootnoteFrame*> >&, bool) (ftnfrm.cxx:2034)
>==9631==    by 0x29379173: SwLayoutFrame::MoveLowerFootnotes(SwContentFrame*, SwFootnoteBossFrame*, SwFootnoteBossFrame*, bool) (ftnfrm.cxx:2705)
>==9631==    by 0x29350456: SwFlowFrame::MoveFwd(bool, bool, bool) (flowfrm.cxx:1949)
>==9631==    by 0x29341221: SwContentFrame::MakeAll(OutputDevice*) (calcmove.cxx:1339)
>==9631==    by 0x2933E862: SwFrame::PrepareMake(OutputDevice*) (calcmove.cxx:281)
>==9631==    by 0x29432741: SwTextFrame::CalcFollow(o3tl::strong_int<int, Tag_TextFrameIndex>) (frmform.cxx:279)
>==9631==    by 0x29432BE2: SwTextFrame::AdjustFollow_(SwTextFormatter&, o3tl::strong_int<int, Tag_TextFrameIndex>, o3tl::strong_int<int, Tag_TextFrameIndex>, unsigned char) (frmform.cxx:611)
>==9631==    by 0x29433004: SwTextFrame::FormatAdjust(SwTextFormatter&, WidowsAndOrphans&, o3tl::strong_int<int, Tag_TextFrameIndex>, bool) (frmform.cxx:1166)
>==9631==    by 0x29433AF7: SwTextFrame::Format_(SwTextFormatter&, SwTextFormatInfo&, bool) (frmform.cxx:1612)
>==9631==    by 0x294347D6: SwTextFrame::Format_(OutputDevice*, SwParaPortion*) (frmform.cxx:1722)
>==9631==    by 0x294353C8: SwTextFrame::Format(OutputDevice*, SwBorderAttrs const*) (frmform.cxx:1911)
>==9631==    by 0x29341298: SwContentFrame::MakeAll(OutputDevice*) (calcmove.cxx:1521)
>==9631==    by 0x2933E4E5: SwFrame::PrepareMake(OutputDevice*) (calcmove.cxx:370)
>==9631==    by 0x2934272E: SwContentFrame::MakeAll(OutputDevice*) (calcmove.cxx:1603)
>==9631==    by 0x2933E4E5: SwFrame::PrepareMake(OutputDevice*) (calcmove.cxx:370)
>==9631==    by 0x2938A476: SwObjectFormatterTextFrame::DoFormatObj(SwAnchoredObject&, bool) (objectformattertxtfrm.cxx:781)
>==9631==    by 0x29388F74: SwObjectFormatter::FormatObjsAtFrame_(SwTextFrame*) (objectformatter.cxx:408)
>==9631==    by 0x2938A855: SwObjectFormatterTextFrame::DoFormatObjs() (objectformattertxtfrm.cxx:333)
>==9631==    by 0x29388B6A: SwObjectFormatter::FormatObjsAtFrame(SwFrame&, SwPageFrame const&, SwLayAction*) (objectformatter.cxx:159)
>==9631==    by 0x2937D2EA: SwLayAction::FormatContent(SwPageFrame const*) (layact.cxx:1653)
>==9631==    by 0x2937FC3D: SwLayAction::InternalAction(OutputDevice*) (layact.cxx:560)
>==9631==    by 0x293807D2: SwLayAction::Action(OutputDevice*) (layact.cxx:345)
>==9631==    by 0x296EEA03: SwViewShell::CalcLayout() (viewsh.cxx:998)
>==9631==    by 0x292BB0F7: SwEditShell::CalcLayout() (edws.cxx:111)
>==9631==    by 0x299DB548: SwView::SwView(SfxViewFrame*, SfxViewShell*) (view.cxx:965)
>==9631==    by 0x299DD7D4: SwView::CreateInstance(SfxViewFrame*, SfxViewShell*) (view0.cxx:68)
>==9631==    by 0x60F2A25: SfxBaseModel::createViewController(rtl::OUString const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) (sfxbasemodel.cxx:4204)
>==9631==    by 0x61B32AC: (anonymous namespace)::SfxFrameLoader_Impl::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) (frmload.cxx:574)
>==9631==    by 0x1E67F09B: framework::LoadEnv::impl_loadContent() (loadenv.cxx:1157)
>==9631==    by 0x1E67FD0F: framework::LoadEnv::start() (loadenv.cxx:395)
>==9631==    by 0x1E680368: framework::LoadEnv::startLoading(rtl::OUString const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&, rtl::OUString const&, int, LoadEnvFeatures) (loadenv.cxx:300)
>==9631==    by 0x1E61257D: framework::LoadDispatcher::impl_dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XDispatchResultListener> const&) (loaddispatcher.cxx:106)
>==9631==    by 0x1E612B07: framework::LoadDispatcher::dispatchWithReturnValue(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (loaddispatcher.cxx:59)
>==9631==    by 0x55835AA: comphelper::SynchronousDispatch::dispatch(com::sun::star::uno::Reference<com::sun::star::uno::XInterface> const&, rtl::OUString const&, rtl::OUString const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (synchronousdispatch.cxx:62)
>==9631==    by 0x4901A8E: desktop::DispatchWatcher::executeDispatchRequests(std::vector<desktop::DispatchWatcher::DispatchRequest, std::allocator<desktop::DispatchWatcher::DispatchRequest> > const&, bool) (dispatchwatcher.cxx:496)
>==9631==    by 0x490E8F9: desktop::RequestHandler::ExecuteCmdLineRequests(desktop::ProcessDocumentsRequest&, bool) (officeipcthread.cxx:1365)
>==9631==    by 0x48E243B: desktop::Desktop::OpenClients() (app.cxx:2131)
>==9631==    by 0x48E3E09: desktop::Desktop::OpenClients_Impl(void*) (app.cxx:1920)
>==9631==    by 0x841134E: ImplWindowFrameProc(vcl::Window*, SalEvent, void const*) (link.hxx:111)
>==9631==    by 0x86C7345: SalUserEventList::DispatchUserEvents(bool) (salusereventlist.cxx:111)
>==9631==    by 0x14D5DAA2: Qt5Instance::ImplYield(bool, bool) (Qt5Instance.cxx:350)
>==9631==    by 0x14D5DCF5: Qt5Instance::DoYield(bool, bool) (Qt5Instance.cxx:372)
>==9631==    by 0x8702421: ImplYield(bool, bool) (svapp.cxx:454)
>==9631==    by 0x8704534: Application::Execute() (svapp.cxx:433)
>==9631==    by 0x48E6C3A: desktop::Desktop::Main() (app.cxx:1599)
>==9631==    by 0x870C7F5: ImplSVMain() (svmain.cxx:196)
>==9631==    by 0x4917C4C: soffice_main (sofficemain.cxx:98)
>
>
>==9631==  Address 0x1fb8a710 is 208 bytes inside a block of size 280 free'd
>==9631==    at 0x483708B: operator delete(void*, unsigned long) (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
>==9631==    by 0x293C24FF: SwLayoutFrame::DestroyImpl() (ssfrm.cxx:525)
>==9631==    by 0x293C2025: SwFrame::DestroyFrame(SwFrame*) (ssfrm.cxx:387)
>==9631==    by 0x293754FD: SwFootnoteBossFrame::RemoveFootnote(SwContentFrame const*, SwTextFootnote const*, bool) (ftnfrm.cxx:1702)
>==9631==    by 0x2949977C: SwTextFrame::ConnectFootnote(SwTextFootnote*, long) (txtftn.cxx:751)
>==9631==    by 0x2949AA41: SwTextFormatter::NewFootnotePortion(SwTextFormatInfo&, SwTextAttr*) (txtftn.cxx:823)
>==9631==    by 0x294863DD: SwTextFormatter::NewExtraPortion(SwTextFormatInfo&) (txtfld.cxx:378)
>==9631==    by 0x29457EB0: SwTextFormatter::NewPortion(SwTextFormatInfo&) (itrform2.cxx:1387)
>==9631==    by 0x2945866D: SwTextFormatter::BuildPortions(SwTextFormatInfo&) (itrform2.cxx:698)
>==9631==    by 0x294596F3: SwTextFormatter::FormatLine(o3tl::strong_int<int, Tag_TextFrameIndex>) (itrform2.cxx:1602)
>==9631==    by 0x29430125: SwTextFrame::FormatLine(SwTextFormatter&, bool) (frmform.cxx:1189)
>==9631==    by 0x294339CA: SwTextFrame::Format_(SwTextFormatter&, SwTextFormatInfo&, bool) (frmform.cxx:1548)
>==9631==    by 0x294347D6: SwTextFrame::Format_(OutputDevice*, SwParaPortion*) (frmform.cxx:1722)
>==9631==    by 0x294353C8: SwTextFrame::Format(OutputDevice*, SwBorderAttrs const*) (frmform.cxx:1911)
>==9631==    by 0x29341298: SwContentFrame::MakeAll(OutputDevice*) (calcmove.cxx:1521)
>==9631==    by 0x2933E4E5: SwFrame::PrepareMake(OutputDevice*) (calcmove.cxx:370)
>==9631==    by 0x293898ED: lcl_FormatContentOfLayoutFrame(SwLayoutFrame*, SwFrame*) (objectformattertxtfrm.cxx:652)
>==9631==    by 0x2938A163: SwObjectFormatterTextFrame::FormatAnchorFrameAndItsPrevs(SwTextFrame&) (objectformattertxtfrm.cxx:747)
>==9631==    by 0x2938A8A0: SwObjectFormatterTextFrame::DoFormatObjs() (objectformattertxtfrm.cxx:781)
>
>==9631==    by 0x29388B6A: SwObjectFormatter::FormatObjsAtFrame(SwFrame&, SwPageFrame const&, SwLayAction*) (objectformatter.cxx:159)
>==9631==    by 0x29374E24: SwFootnoteBossFrame::MoveFootnotes_(std::vector<SwFootnoteFrame*, std::allocator<SwFootnoteFrame*> >&, bool) (ftnfrm.cxx:2034)
>==9631==    by 0x29379173: SwLayoutFrame::MoveLowerFootnotes(SwContentFrame*, SwFootnoteBossFrame*, SwFootnoteBossFrame*, bool) (ftnfrm.cxx:2705)
>==9631==    by 0x29350456: SwFlowFrame::MoveFwd(bool, bool, bool) (flowfrm.cxx:1949)
>==9631==    by 0x29341221: SwContentFrame::MakeAll(OutputDevice*) (calcmove.cxx:1339)
>==9631==    by 0x2933E862: SwFrame::PrepareMake(OutputDevice*) (calcmove.cxx:281)
>==9631==    by 0x29432741: SwTextFrame::CalcFollow(o3tl::strong_int<int, Tag_TextFrameIndex>) (frmform.cxx:279)
>==9631==    by 0x29432BE2: SwTextFrame::AdjustFollow_(SwTextFormatter&, o3tl::strong_int<int, Tag_TextFrameIndex>, o3tl::strong_int<int, Tag_TextFrameIndex>, unsigned char) (frmform.cxx:611)
>==9631==    by 0x29433004: SwTextFrame::FormatAdjust(SwTextFormatter&, WidowsAndOrphans&, o3tl::strong_int<int, Tag_TextFrameIndex>, bool) (frmform.cxx:1166)
>==9631==    by 0x29433AF7: SwTextFrame::Format_(SwTextFormatter&, SwTextFormatInfo&, bool) (frmform.cxx:1612)
>==9631==    by 0x294347D6: SwTextFrame::Format_(OutputDevice*, SwParaPortion*) (frmform.cxx:1722)
>==9631==    by 0x294353C8: SwTextFrame::Format(OutputDevice*, SwBorderAttrs const*) (frmform.cxx:1911)
>==9631==    by 0x29341298: SwContentFrame::MakeAll(OutputDevice*) (calcmove.cxx:1521)
>==9631==    by 0x2933E4E5: SwFrame::PrepareMake(OutputDevice*) (calcmove.cxx:370)
>==9631==    by 0x2934272E: SwContentFrame::MakeAll(OutputDevice*) (calcmove.cxx:1603)
>==9631==    by 0x2933E4E5: SwFrame::PrepareMake(OutputDevice*) (calcmove.cxx:370)
>==9631==    by 0x2938A476: SwObjectFormatterTextFrame::DoFormatObj(SwAnchoredObject&, bool) (objectformattertxtfrm.cxx:781)
>==9631==    by 0x29388F74: SwObjectFormatter::FormatObjsAtFrame_(SwTextFrame*) (objectformatter.cxx:408)
>==9631==    by 0x2938A855: SwObjectFormatterTextFrame::DoFormatObjs() (objectformattertxtfrm.cxx:333)
>==9631==    by 0x29388B6A: SwObjectFormatter::FormatObjsAtFrame(SwFrame&, SwPageFrame const&, SwLayAction*) (objectformatter.cxx:159)
>==9631==    by 0x2937D2EA: SwLayAction::FormatContent(SwPageFrame const*) (layact.cxx:1653)
>==9631==    by 0x2937FC3D: SwLayAction::InternalAction(OutputDevice*) (layact.cxx:560)
>==9631==    by 0x293807D2: SwLayAction::Action(OutputDevice*) (layact.cxx:345)
>==9631==    by 0x296EEA03: SwViewShell::CalcLayout() (viewsh.cxx:998)
>==9631==    by 0x292BB0F7: SwEditShell::CalcLayout() (edws.cxx:111)
>==9631==    by 0x299DB548: SwView::SwView(SfxViewFrame*, SfxViewShell*) (view.cxx:965)
>==9631==    by 0x299DD7D4: SwView::CreateInstance(SfxViewFrame*, SfxViewShell*) (view0.cxx:68)
>==9631==    by 0x60F2A25: SfxBaseModel::createViewController(rtl::OUString const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) (sfxbasemodel.cxx:4204)
>==9631==    by 0x61B32AC: (anonymous namespace)::SfxFrameLoader_Impl::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) (frmload.cxx:574)
>==9631==    by 0x1E67F09B: framework::LoadEnv::impl_loadContent() (loadenv.cxx:1157)
>==9631==    by 0x1E67FD0F: framework::LoadEnv::start() (loadenv.cxx:395)
>==9631==  Block was alloc'd at
>==9631==    at 0x4835DEF: operator new(unsigned long) (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
>==9631==    by 0x2948CB4C: sw::MakeTextFrame(SwTextNode&, SwFrame*, sw::FrameMode) (txtfrm.cxx:801)
>==9631==    by 0x2936D957: InsertCnt_(SwLayoutFrame*, SwDoc*, unsigned long, bool, unsigned long, SwFrame*, sw::FrameMode) (frmtool.cxx:1511)
>==9631==    by 0x293757D9: SwFootnoteBossFrame::AppendFootnote(SwContentFrame*, SwTextFootnote*) (ftnfrm.cxx:1577)
>==9631==    by 0x294999E9: SwTextFrame::ConnectFootnote(SwTextFootnote*, long) (txtftn.cxx:678)
>==9631==    by 0x2949AA41: SwTextFormatter::NewFootnotePortion(SwTextFormatInfo&, SwTextAttr*) (txtftn.cxx:823)
>==9631==    by 0x294863DD: SwTextFormatter::NewExtraPortion(SwTextFormatInfo&) (txtfld.cxx:378)
>==9631==    by 0x29457EB0: SwTextFormatter::NewPortion(SwTextFormatInfo&) (itrform2.cxx:1387)
>==9631==    by 0x2945866D: SwTextFormatter::BuildPortions(SwTextFormatInfo&) (itrform2.cxx:698)
>==9631==    by 0x294596F3: SwTextFormatter::FormatLine(o3tl::strong_int<int, Tag_TextFrameIndex>) (itrform2.cxx:1602)
>==9631==    by 0x29430125: SwTextFrame::FormatLine(SwTextFormatter&, bool) (frmform.cxx:1189)
>==9631==    by 0x294339CA: SwTextFrame::Format_(SwTextFormatter&, SwTextFormatInfo&, bool) (frmform.cxx:1548)
>==9631==    by 0x294347D6: SwTextFrame::Format_(OutputDevice*, SwParaPortion*) (frmform.cxx:1722)
>==9631==    by 0x294353C8: SwTextFrame::Format(OutputDevice*, SwBorderAttrs const*) (frmform.cxx:1911)
>==9631==    by 0x29341298: SwContentFrame::MakeAll(OutputDevice*) (calcmove.cxx:1521)
>==9631==    by 0x2933E402: SwFrame::PrepareMake(OutputDevice*) (calcmove.cxx:316)
>==9631==    by 0x293809DD: SwLayAction::FormatLayoutTab(SwTabFrame*, bool) (layact.cxx:1496)
>==9631==    by 0x2937E8E5: SwLayAction::FormatLayout(OutputDevice*, SwLayoutFrame*, bool) (layact.cxx:1384)
>==9631==    by 0x2937E872: SwLayAction::FormatLayout(OutputDevice*, SwLayoutFrame*, bool) (layact.cxx:1389)
>==9631==    by 0x2937E872: SwLayAction::FormatLayout(OutputDevice*, SwLayoutFrame*, bool) (layact.cxx:1389)
>==9631==    by 0x2937E872: SwLayAction::FormatLayout(OutputDevice*, SwLayoutFrame*, bool) (layact.cxx:1389)
>==9631==    by 0x2937FBEF: SwLayAction::InternalAction(OutputDevice*) (layact.cxx:548)
>==9631==    by 0x293807D2: SwLayAction::Action(OutputDevice*) (layact.cxx:345)
>==9631==    by 0x296EEA03: SwViewShell::CalcLayout() (viewsh.cxx:998)
>==9631==    by 0x292BB0F7: SwEditShell::CalcLayout() (edws.cxx:111)
>==9631==    by 0x299DB548: SwView::SwView(SfxViewFrame*, SfxViewShell*) (view.cxx:965)
>==9631==    by 0x299DD7D4: SwView::CreateInstance(SfxViewFrame*, SfxViewShell*) (view0.cxx:68)
>==9631==    by 0x60F2A25: SfxBaseModel::createViewController(rtl::OUString const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) (sfxbasemodel.cxx:4204)
>==9631==    by 0x61B32AC: (anonymous namespace)::SfxFrameLoader_Impl::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) (frmload.cxx:574)
>==9631==    by 0x1E67F09B: framework::LoadEnv::impl_loadContent() (loadenv.cxx:1157)
>==9631==    by 0x1E67FD0F: framework::LoadEnv::start() (loadenv.cxx:395)
>==9631==    by 0x1E680368: framework::LoadEnv::startLoading(rtl::OUString const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&, rtl::OUString const&, int, LoadEnvFeatures) (loadenv.cxx:300)
>==9631==    by 0x1E61257D: framework::LoadDispatcher::impl_dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XDispatchResultListener> const&) (loaddispatcher.cxx:106)
>==9631==    by 0x1E612B07: framework::LoadDispatcher::dispatchWithReturnValue(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (loaddispatcher.cxx:59)
>==9631==    by 0x55835AA: comphelper::SynchronousDispatch::dispatch(com::sun::star::uno::Reference<com::sun::star::uno::XInterface> const&, rtl::OUString const&, rtl::OUString const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (synchronousdispatch.cxx:62)
>==9631==    by 0x4901A8E: desktop::DispatchWatcher::executeDispatchRequests(std::vector<desktop::DispatchWatcher::DispatchRequest, std::allocator<desktop::DispatchWatcher::DispatchRequest> > const&, bool) (dispatchwatcher.cxx:496)
>==9631==    by 0x490E8F9: desktop::RequestHandler::ExecuteCmdLineRequests(desktop::ProcessDocumentsRequest&, bool) (officeipcthread.cxx:1365)
>==9631==    by 0x48E243B: desktop::Desktop::OpenClients() (app.cxx:2131)
>==9631==    by 0x48E3E09: desktop::Desktop::OpenClients_Impl(void*) (app.cxx:1920)
>==9631==    by 0x841134E: ImplWindowFrameProc(vcl::Window*, SalEvent, void const*) (link.hxx:111)
>==9631==    by 0x86C7345: SalUserEventList::DispatchUserEvents(bool) (salusereventlist.cxx:111)
>==9631==    by 0x14D5DAA2: Qt5Instance::ImplYield(bool, bool) (Qt5Instance.cxx:350)
>==9631==    by 0x14D5DCF5: Qt5Instance::DoYield(bool, bool) (Qt5Instance.cxx:372)
>==9631==    by 0x8702421: ImplYield(bool, bool) (svapp.cxx:454)
>==9631==    by 0x8704534: Application::Execute() (svapp.cxx:433)
>==9631==    by 0x48E6C3A: desktop::Desktop::Main() (app.cxx:1599)
>==9631==    by 0x870C7F5: ImplSVMain() (svmain.cxx:196)
>==9631==    by 0x4917C4C: soffice_main (sofficemain.cxx:98)
>==9631==    by 0x10877A: main (main.c:48)

Actions: View

Attachments on bug 122894: 148544 | 148547 | 159556 | 167129