Created attachment 47588 [details] Word document and LibO model in a zip file I want to convert to ODF format a Word document containing footpage notes I proceed as follows: - opening the file doc - Opening a new document from a template ott - Ctrl + A then Ctrl + C in the file doc - Ctrl + V in the file no name 1 " after a page break - registration in odt format - deleting and recreating one by one footpage notes: + selecting the text of the note and then ctrl + C + deleting note by deleting the note call + creating a new note in the same location Insert> Footpage note + choosing automatic numbering notes Click OK > crash Crash also occurs with the choice : character, instead of numbering Testing with a new profile : crash occurs earlier, when deleting note by deleting the note call. No problem with LibO332 under Windows XP SP3 and Windows 7 SP1. Problem occurs with LibO340.
It crashes only on Windows.
Backtrace at crash: swmi.dll!std::_Vector_const_iterator<boost::shared_ptr<sw::mark::IMark>,std::allocator<boost::shared_ptr<sw::mark::IMark> > >::_Vector_const_iterator<boost::shared_ptr<sw::mark::IMark>,std::allocator<boost::shared_ptr<sw::mark::IMark> > >(boost::shared_ptr<sw::mark::IMark> * _Ptr=0x12326f10, const std::_Container_base_aux * _Pvector=0x1226d2d4) Line 79 C++ swmi.dll!std::_Vector_iterator<boost::shared_ptr<sw::mark::IMark>,std::allocator<boost::shared_ptr<sw::mark::IMark> > >::_Vector_iterator<boost::shared_ptr<sw::mark::IMark>,std::allocator<boost::shared_ptr<sw::mark::IMark> > >(boost::shared_ptr<sw::mark::IMark> * _Ptr=0x12326f10, const std::_Container_base_aux * _Pvector=0x1226d2d4) Line 328 C++ swmi.dll!std::vector<boost::shared_ptr<sw::mark::IMark>,std::allocator<boost::shared_ptr<sw::mark::IMark> > >::_Make_iter(std::_Vector_const_iterator<boost::shared_ptr<sw::mark::IMark>,std::allocator<boost::shared_ptr<sw::mark::IMark> > > _Where={px=0x12327400 pn={...} }) Line 661 + 0x10 bytes C++ swmi.dll!std::vector<boost::shared_ptr<sw::mark::IMark>,std::allocator<boost::shared_ptr<sw::mark::IMark> > >::erase(std::_Vector_const_iterator<boost::shared_ptr<sw::mark::IMark>,std::allocator<boost::shared_ptr<sw::mark::IMark> > > _Where={px=0x12327400 pn={...} }) Line 1022 + 0x14 bytes C++ > swmi.dll!sw::mark::MarkManager::deleteMark(std::_Vector_const_iterator<boost::shared_ptr<sw::mark::IMark>,std::allocator<boost::shared_ptr<sw::mark::IMark> > > ppMark={px=0x12327400 pn={...} }) Line 720 C++ swmi.dll!SwUndoSaveCntnt::DelCntntIndex(const SwPosition & rMark={...}, const SwPosition & rPoint={...}, unsigned short nDelCntntType=0x000f) Line 870 C++ swmi.dll!SwUndoSaveSection::SaveSection(SwDoc * __formal=0x05cee928, const SwNodeRange & rRange={...}) Line 913 C++ swmi.dll!SwUndoSaveSection::SaveSection(SwDoc * pDoc=0x05cee928, const SwNodeIndex & rSttIdx={...}) Line 903 C++ swmi.dll!SwHistorySetFootnote::SwHistorySetFootnote(SwTxtFtn * pTxtFtn=0x12123ca8, unsigned long nNodePos=0x00000045) Line 460 C++ swmi.dll!SwHistory::Add(SwTxtAttr * pHint=0x12123ca8, unsigned long nNodeIdx=0x00000045, bool bNewAttr=false) Line 1076 + 0x2a bytes C++ swmi.dll!SwUndoSaveCntnt::DelCntntIndex(const SwPosition & rMark={...}, const SwPosition & rPoint={...}, unsigned short nDelCntntType=0x000f) Line 604 C++ swmi.dll!SwUndoDelete::SwUndoDelete(SwPaM & rPam={...}, unsigned char bFullPara=0x00, unsigned char bCalledByTblCpy=0x00) Line 149 C++ swmi.dll!SwDoc::DeleteRangeImplImpl(SwPaM & rPam={...}) Line 1690 + 0x33 bytes C++ swmi.dll!SwDoc::DeleteRangeImpl(SwPaM & rPam={...}, const bool __formal=false) Line 1618 + 0xc bytes C++ swmi.dll!SwDoc::DeleteAndJoinImpl(SwPaM & rPam={...}, const bool bForceJoinNext=false) Line 1597 + 0xe bytes C++ swmi.dll!lcl_DoWithBreaks(SwDoc & rDoc={...}, SwPaM & rPam={...}, bool (SwPaM &, bool)* pFunc=0x0d6121ac, const bool bForceJoinNext=false) Line 1492 + 0x12 bytes C++ swmi.dll!SwDoc::DeleteAndJoin(SwPaM & rPam={...}, const bool bForceJoinNext=false) Line 1819 + 0x6a bytes C++ swmi.dll!SwEditShell::DeleteSel(SwPaM & rPam={...}, unsigned char * pUndo=0x00cff19b) Line 111 C++ swmi.dll!SwEditShell::Delete() Line 138 C++ swmi.dll!SwWrtShell::DelLeft() Line 244 + 0x8 bytes C++ swmi.dll!SwBaseShell::ExecDelete(SfxRequest & rReq={...}) Line 240 C++ swmi.dll!SfxStubSwBaseShellExecDelete(SfxShell * pShell=0x122e6908, SfxRequest & rReq={...}) Line 1626 + 0xf bytes C++ The source line in question is: m_vMarks.erase(m_vMarks.begin() + (ppMark - m_vMarks.begin())); // clumsy const-cast
The value of m_vMarks as displayed by Visual Studio is: m_vMarks [0xffffffff]({px=0x12327400 pn={...} },{px=0x12326efc pn={...} },{px=0x12326efc pn={...} },{px=0x12326efc pn={...} },{px=0x12326eac pn={...} },{px=0x12326eac pn={...} },{px=0x12326eac pn={...} },{px=0x00000000 pn={...} },{px=0x00000000 pn={...} },{px=0x11785c55 pn={...} },{px=0x00000000 pn={...} },{px=0x00000000 pn={...} },{px=0x00000000 pn={...} },{px=0x00000000 pn={...} },{px=0x00000000 pn= },...,...) std::vector<boost::shared_ptr<sw::mark::IMark>,std::allocator<boost::shared_ptr<sw::mark::IMark> > > whatever that then means... the 0xffffffff looks weird?
The problem seems to be that sw::mark::MarkManager::deleteMark() gets called recursively: swmi.dll!sw::mark::MarkManager::deleteMark(std::_Vector_const_iterator<boost::shared_ptr<sw::mark::IMark>,std::allocator<boost::shared_ptr<sw::mark::IMark> > > ppMark={px=0x05668608 pn={...} }) Line 721 C++ swmi.dll!SwTrnsfrDdeLink::Disconnect(unsigned char bRemoveDataAdvise=0x00) Line 3599 + 0x3d bytes C++ > swmi.dll!SwTrnsfrDdeLink::DataChanged(const String & __formal={...}, const String & __formal={...}) Line 3513 C++ sfxmi.dll!64d60919() [Frames below may be incorrect and/or missing, no symbols loaded for sfxmi.dll] swmi.dll!sw::mark::DdeBookmark::~DdeBookmark() Line 220 C++ swmi.dll!sw::mark::DdeBookmark::`vbase destructor'() + 0x12 bytes C++ swmi.dll!sw::mark::DdeBookmark::`scalar deleting destructor'() + 0x12 bytes C++ swmi.dll!boost::checked_delete<sw::mark::DdeBookmark>(sw::mark::DdeBookmark * x=0x056685c8) Line 34 + 0x3b bytes C++ swmi.dll!boost::detail::sp_counted_impl_p<sw::mark::DdeBookmark>::dispose() Line 78 + 0xc bytes C++ swmi.dll!boost::detail::sp_counted_base::release() Line 103 C++ swmi.dll!boost::detail::shared_count::~shared_count() Line 221 C++ swmi.dll!boost::shared_ptr<sw::mark::IMark>::~shared_ptr<sw::mark::IMark>() + 0x3f bytes C++ swmi.dll!boost::shared_ptr<sw::mark::IMark>::`scalar deleting destructor'() + 0xf bytes C++ swmi.dll!std::_Destroy<boost::shared_ptr<sw::mark::IMark> >(boost::shared_ptr<sw::mark::IMark> * _Ptr=0x129626a0) Line 60 C++ swmi.dll!std::allocator<boost::shared_ptr<sw::mark::IMark> >::destroy(boost::shared_ptr<sw::mark::IMark> * _Ptr=0x129626a0) Line 160 + 0x9 bytes C++ swmi.dll!std::_Destroy_range<std::allocator<boost::shared_ptr<sw::mark::IMark> > >(boost::shared_ptr<sw::mark::IMark> * _First=0x129626a0, boost::shared_ptr<sw::mark::IMark> * _Last=0x129626a8, std::allocator<boost::shared_ptr<sw::mark::IMark> > & _Al={...}, std::_Nonscalar_ptr_iterator_tag __formal={...}) Line 234 + 0xc bytes C++ swmi.dll!std::_Destroy_range<std::allocator<boost::shared_ptr<sw::mark::IMark> > >(boost::shared_ptr<sw::mark::IMark> * _First=0x129626a0, boost::shared_ptr<sw::mark::IMark> * _Last=0x129626a8, std::allocator<boost::shared_ptr<sw::mark::IMark> > & _Al={...}) Line 225 + 0x29 bytes C++ swmi.dll!std::vector<boost::shared_ptr<sw::mark::IMark>,std::allocator<boost::shared_ptr<sw::mark::IMark> > >::_Destroy(boost::shared_ptr<sw::mark::IMark> * _First=0x129626a0, boost::shared_ptr<sw::mark::IMark> * _Last=0x129626a8) Line 1119 + 0x14 bytes C++ swmi.dll!std::vector<boost::shared_ptr<sw::mark::IMark>,std::allocator<boost::shared_ptr<sw::mark::IMark> > >::erase(std::_Vector_const_iterator<boost::shared_ptr<sw::mark::IMark>,std::allocator<boost::shared_ptr<sw::mark::IMark> > > _Where={px=0x05668608 pn={...} }) Line 1021 C++ swmi.dll!sw::mark::MarkManager::deleteMark(std::_Vector_const_iterator<boost::shared_ptr<sw::mark::IMark>,std::allocator<boost::shared_ptr<sw::mark::IMark> > > ppMark={px=0x05668608 pn={...} }) Line 724 C++ swmi.dll!SwUndoSaveCntnt::DelCntntIndex(const SwPosition & rMark={...}, const SwPosition & rPoint={...}, unsigned short nDelCntntType=0x000f) Line 870 C++ swmi.dll!SwUndoSaveSection::SaveSection(SwDoc * __formal=0x05820258, const SwNodeRange & rRange={...}) Line 913 C++ swmi.dll!SwUndoSaveSection::SaveSection(SwDoc * pDoc=0x05820258, const SwNodeIndex & rSttIdx={...}) Line 903 C++ swmi.dll!SwHistorySetFootnote::SwHistorySetFootnote(SwTxtFtn * pTxtFtn=0x1296c040, unsigned long nNodePos=0x00000045) Line 460 C++ swmi.dll!SwHistory::Add(SwTxtAttr * pHint=0x1296c040, unsigned long nNodeIdx=0x00000045, bool bNewAttr=false) Line 1076 + 0x2a bytes C++ swmi.dll!SwUndoSaveCntnt::DelCntntIndex(const SwPosition & rMark={...}, const SwPosition & rPoint={...}, unsigned short nDelCntntType=0x000f) Line 604 C++ swmi.dll!SwUndoDelete::SwUndoDelete(SwPaM & rPam={...}, unsigned char bFullPara=0x00, unsigned char bCalledByTblCpy=0x00) Line 149 C++ swmi.dll!SwDoc::DeleteRangeImplImpl(SwPaM & rPam={...}) Line 1690 + 0x33 bytes C++ swmi.dll!SwDoc::DeleteRangeImpl(SwPaM & rPam={...}, const bool __formal=false) Line 1618 + 0xc bytes C++ swmi.dll!SwDoc::DeleteAndJoinImpl(SwPaM & rPam={...}, const bool bForceJoinNext=false) Line 1597 + 0xe bytes C++ swmi.dll!lcl_DoWithBreaks(SwDoc & rDoc={...}, SwPaM & rPam={...}, bool (SwPaM &, bool)* pFunc=0x0e2a21b6, const bool bForceJoinNext=false) Line 1492 + 0x12 bytes C++ swmi.dll!SwDoc::DeleteAndJoin(SwPaM & rPam={...}, const bool bForceJoinNext=false) Line 1819 + 0x6a bytes C++ swmi.dll!SwEditShell::DeleteSel(SwPaM & rPam={...}, unsigned char * pUndo=0x016df17b) Line 111 C++ swmi.dll!SwEditShell::Delete() Line 138 C++ swmi.dll!SwWrtShell::DelLeft() Line 244 + 0x8 bytes C++ swmi.dll!SwBaseShell::ExecDelete(SfxRequest & rReq={...}) Line 240 C++ swmi.dll!SfxStubSwBaseShellExecDelete(SfxShell * pShell=0x12973420, SfxRequest & rReq={...}) Line 1626 + 0xf bytes C++
Nah, I give up.
Created attachment 47763 [details] speculative fix tor: I can't reproduce the crash, but looking at the stack under linux I have serious doubts about the reentering of ::deleteMark from the destructor of a mark called during std::vector::erase. Does the attached patch make a difference ?, i.e. defer actual destruction of element until after its removed from the vector
reportedly works
checked in, and cherry-picked to 3-4 branch
RC2 is bit by bit identical with release version, so separate items in the version picker are useless. Changes have been discussed with Michael Meeks.
@Caolán: Is this fix in 3.4.1?
yes, I think so. http://cgit.freedesktop.org/libreoffice/writer/commit/?h=libreoffice-3-4-1&id=4a2d8af43d7408aa037f1afc9ec819a363c02278
Hello, Yes it seems ok (re-tested with LibO 3.4.2). Thanks, Bernard