Apache OpenOffice (AOO) Bugzilla – Issue 84984
impress137: crash when using graphic filters on bmp
Last modified: 2017-05-20 10:27:54 UTC
Open a new draw, insert a bmp and click on one of the graphic filter buttons of the picture bar: Office crashes. This happens only in CWS impress137 not in master build. The ID of the error report is r7vrb9.
Created attachment 51553 [details] This patch is based on that of issue 73871.
shoulnd't that be set as a PATCH issue type?
No, Ido no thinks so. This is a defect in the named CWS and it should be handled that way.
And I've already committed the patch to CWS impress137. Please check and test it.
As soon as the CWS gets into status "ready for QA" I will test it...
whatever the cause of this bug is, the given patch is not valid. The line pOL->ReplaceObject(pNewObj,pOldObj->GetOrdNum()); will remove pOldObj from the page and if it is not put into an undo action that it may also get deleted. So doing a MarkObj(pOldObj,&rPV,TRUE); after the call to ReplaceObject is an error since pOldObj could be deleted already at this point. Please change the fix.
->cl: Thank you for your explanation. However, based on my investigation ReplaceObject(...) does not always ensure it will remove the old object because it needs to judge a certain condition. Additionally MarkObj(pOldObj,&rPV,TRUE) can merely change the mark list to avoid confusion. The above points are just simple understanding. So please correct me if I'm wrong.
->liangweike: after a call to ReplaceObject(), pOldObj will no longer be part of the model. The only reason that ReplaceObject() will not remove it is if it is not part of the model or the new object is null. Both cases are fatal errors already. In any way, marking pOldObj after it is removed from the model makes no sense and is an invalid operation. You can not mark objects in a view that are not part of the model that the view displays.
Created attachment 51742 [details] The changes are made once more with the help of Christian.
Fixed by liangweike.
Decreasing priority to P3 because the crash is not in the master.
I've checked in m6. It's ok. No crashes.