Bug 100270 - SfxModule destructor SfxInterface deletion references invalid objects
Summary: SfxModule destructor SfxInterface deletion references invalid objects
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: LibreOffice (show other bugs)
Version:
(earliest affected)
unspecified
Hardware: All All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords: skillCpp
Depends on:
Blocks: Dev-related
  Show dependency tree / graph
 
Reported: 2016-06-08 07:53 UTC by aptitude
Modified: 2023-05-11 12:42 UTC (History)
5 users (show)

See Also:
Crash report or crash signature:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description aptitude 2016-06-08 07:53:40 UTC 
We have a problem with the destruction of SfxModule

With reference to:
core/include/sfx2/module.hxx, core/sfx2/source/appl/module.cxx (SfxModule)
core/include/sfx2/msgpool.hxx, core/sfx2/source/control/msgpool.cxx (SfxSlotPool)
core/include/sfx2/objface.hxx, core/sfx2/source/control/objface.cxx (SfxInterface)

Lets call the current pointer to SfxModule "this_SfxModule"
A)  this_SfxModule->~SfxModule() calls "delete pImpl" (SfxModule_Impl)
B)  pImpl->~SfxModule_Impl() calls "delete pSlotPool" (SfxSlotPool)
C)  pSlotPool->~SfxSlotPool() calls "delete on all _pInterfaces" (SfxInterface)
D)  _pInterfaces[x]->~SfxInterface() calls "pMod->GetSlotPool()->ReleaseInterface(*this);"

Now "pMod == this_SfxModule" (demonstrated using the debugger)
So with (D), this is called:
  this_SfxModule->pImpl->pSlotPool->ReleaseInterface(*this);

Issue #1) Notice that "pImpl" destruction has started in 'A' 
Issue #2) Notice that "pSlotPool" destruction has started in 'B'

E) ReleaseInterface() calls erase on _pInterfaces" 

Notice that "_pInterfaces" struct is being deleted in 'C'.
However, in this instance it probably is harmless call (and not required)

These issues was discovered when attempting to turn "pImpl" into a smart pointer,
that causes undefined behaviour (reading pImpl during it's destruction), and crashes
depending on which compiler is used.

This might be the reason for various random exit crashes, reported in Bugzilla?
Comment 1 Julien Nabet 2016-06-08 21:35:15 UTC 
I'm not an expert but your analysis seems right.
I think it could interesting you discuss this on dev mailing list, see http://nabble.documentfoundation.org/Dev-f1639786.html so every dev may give his opinion.
Comment 3 Julien Nabet 2016-06-19 08:24:43 UTC 
Michael: any thoughts about this one or do you know who may help here?
Comment 4 Michael Meeks 2016-06-20 10:58:49 UTC 
Wow - aptitude; you've done a lot of work here chasing this =) It would be great to see your patch pushed as a gerrit draft (?).

Clearly moving to a smart-pointer scheme for these very involved reference counting solutions involves quite a degree of risk - since inevitably everyone holds a smart pointer to everyone else ;-) Are you introducing a 'dispose' pattern at the same time to ensure all cyclical references are released ?
Comment 5 aptitude 2016-06-20 14:11:55 UTC 
Michael: 

I would also avoid using the smart pointer scheme for the same reasons as you give.

Yes, we could probably fix it using the dispose method; however at this stage I am unsure that it is the best solution.

I have not yet studied the code to make an accurate judgement.
Comment 6 QA Administrators 2017-09-01 11:20:23 UTC Comment hidden (obsolete)
Comment 8 QA Administrators 2019-01-16 03:54:42 UTC Comment hidden (obsolete)
Comment 9 QA Administrators 2021-01-16 04:16:13 UTC Comment hidden (obsolete)
Comment 10 QA Administrators 2023-01-17 03:19:45 UTC 
Dear aptitude,

To make sure we're focusing on the bugs that affect our users today, LibreOffice QA is asking bug reporters and confirmers to retest open, confirmed bugs which have not been touched for over a year.

There have been thousands of bug fixes and commits since anyone checked on this bug report. During that time, it's possible that the bug has been fixed, or the details of the problem have changed. We'd really appreciate your help in getting confirmation that the bug is still present.

If you have time, please do the following:

Test to see if the bug is still present with the latest version of LibreOffice from https://www.libreoffice.org/download/

If the bug is present, please leave a comment that includes the information from Help - About LibreOffice.
 
If the bug is NOT present, please set the bug's Status field to RESOLVED-WORKSFORME and leave a comment that includes the information from Help - About LibreOffice.

Please DO NOT

Update the version field
Reply via email (please reply directly on the bug tracker)
Set the bug's Status field to RESOLVED - FIXED (this status has a particular meaning that is not 
appropriate in this case)


If you want to do more to help you can test to see if your issue is a REGRESSION. To do so:
1. Download and install oldest version of LibreOffice (usually 3.3 unless your bug pertains to a feature added after 3.3) from https://downloadarchive.documentfoundation.org/libreoffice/old/

2. Test your bug
3. Leave a comment with your results.
4a. If the bug was present with 3.3 - set version to 'inherited from OOo';
4b. If the bug was not present in 3.3 - add 'regression' to keyword


Feel free to come ask questions or to say hello in our QA chat: https://web.libera.chat/?settings=#libreoffice-qa

Thank you for helping us make LibreOffice even better for everyone!

Warm Regards,
QA Team

MassPing-UntouchedBug