[libreoffice/f16] add SwRootFrm::~SwRootFrm: refactor to Destroy patch
Michael Stahl
mstahl at fedoraproject.org
Thu Mar 1 12:24:17 UTC 2012
commit 4149f8b7edd1dbe502dedb7f40dee010e5c8e255
Author: Michael Stahl <mstahl at redhat.com>
Date: Thu Mar 1 13:23:34 2012 +0100
add SwRootFrm::~SwRootFrm: refactor to Destroy patch
0001-SwRootFrm-SwRootFrm-refactor.patch | 158 +++++++++++++++++++++++++++++++
libreoffice.spec | 2 +
2 files changed, 160 insertions(+), 0 deletions(-)
---
diff --git a/0001-SwRootFrm-SwRootFrm-refactor.patch b/0001-SwRootFrm-SwRootFrm-refactor.patch
new file mode 100644
index 0000000..e05ad34
--- /dev/null
+++ b/0001-SwRootFrm-SwRootFrm-refactor.patch
@@ -0,0 +1,158 @@
+From 011a970de6f65fe6543337c7da643d998a450750 Mon Sep 17 00:00:00 2001
+From: Michael Stahl <mstahl at redhat.com>
+Date: Mon, 27 Feb 2012 20:43:27 +0100
+Subject: [PATCH] SwRootFrm::~SwRootFrm: refactor:
+
+Since CWS swlayoutrefactoring the SwRootFrms are destroyed with
+SwDoc::IsInDtor not set. This can cause at least reads of freed
+SwRootFrm members when executing the dtors of SwRootFrm base class
+SwLayoutFrm calling into SwRootFrm::GetPageAtPos.
+
+Prevent this scenario by:
+- moving the implementation of SwRootFrm base class dtors to new
+ methods SwFrm::Destroy and SwLayoutFrm::Destroy
+- calling SwFrm::Destroy and SwLayoutFrm::Destroy explicitly before
+ SwRootFrm members are freed
+(cherry picked from commit ebb74441790a9852b1a1532d6e025c324666f6fc)
+
+Signed-off-by: Miklos Vajna <vmiklos at suse.cz>
+---
+ sw/source/core/inc/frame.hxx | 2 ++
+ sw/source/core/inc/layfrm.hxx | 4 +++-
+ sw/source/core/inc/rootfrm.hxx | 2 +-
+ sw/source/core/layout/newfrm.cxx | 9 ++++++++-
+ sw/source/core/layout/ssfrm.cxx | 21 +++++++++++++++++++--
+ 5 files changed, 33 insertions(+), 5 deletions(-)
+
+diff --git a/sw/source/core/inc/frame.hxx b/sw/source/core/inc/frame.hxx
+index ba148cc..f118233 100644
+--- a/sw/source/core/inc/frame.hxx
++++ b/sw/source/core/inc/frame.hxx
+@@ -442,6 +442,8 @@ protected:
+ void ColLock() { bColLocked = sal_True; }
+ void ColUnlock() { bColLocked = sal_False; }
+
++ void Destroy(); // for ~SwRootFrm
++
+ // Only used by SwRootFrm Ctor to get 'this' into mpRoot...
+ void setRootFrm( SwRootFrm* pRoot ) { mpRoot = pRoot; }
+
+diff --git a/sw/source/core/inc/layfrm.hxx b/sw/source/core/inc/layfrm.hxx
+index c6d17ba..14f4a3e 100644
+--- a/sw/source/core/inc/layfrm.hxx
++++ b/sw/source/core/inc/layfrm.hxx
+@@ -56,6 +56,8 @@ class SwLayoutFrm: public SwFrm
+
+ void CopySubtree( const SwLayoutFrm *pDest );
+ protected:
++ void Destroy(); // for ~SwRootFrm
++
+ virtual void Format( const SwBorderAttrs *pAttrs = 0 );
+ virtual void MakeAll();
+
+@@ -104,7 +106,7 @@ public:
+ const sal_Bool bDefaultExpand = sal_True ) const;
+
+ SwLayoutFrm( SwFrmFmt*, SwFrm* );
+- ~SwLayoutFrm();
++ virtual ~SwLayoutFrm();
+
+ virtual void Paint( SwRect const&,
+ SwPrintData const*const pPrintData = NULL ) const;
+diff --git a/sw/source/core/inc/rootfrm.hxx b/sw/source/core/inc/rootfrm.hxx
+index a73b28b..e460486 100644
+--- a/sw/source/core/inc/rootfrm.hxx
++++ b/sw/source/core/inc/rootfrm.hxx
+@@ -178,7 +178,7 @@ public:
+ static sal_Bool HasSameRect( const SwRect& rRect );
+
+ SwRootFrm( SwFrmFmt*, ViewShell* );
+- ~SwRootFrm();
++ virtual ~SwRootFrm();
+ void Init(SwFrmFmt*);
+
+ ViewShell *GetCurrShell() const { return pCurrShell; }
+diff --git a/sw/source/core/layout/newfrm.cxx b/sw/source/core/layout/newfrm.cxx
+index f51aa6b..e96ebb8 100644
+--- a/sw/source/core/layout/newfrm.cxx
++++ b/sw/source/core/layout/newfrm.cxx
+@@ -630,8 +630,15 @@ SwRootFrm::~SwRootFrm()
+ (*pCurrShells)[i]->pRoot = 0;
+
+ delete pCurrShells;
++ pCurrShells = 0;
+
+- OSL_ENSURE( 0==nAccessibleShells, "Some accessible shells are left" );
++ // Some accessible shells are left => problems on second SwFrm::Destroy call
++ assert(0 == nAccessibleShells);
++
++ // manually call base classes Destroy because it could call stuff
++ // that accesses members of this
++ SwLayoutFrm::Destroy();
++ SwFrm::Destroy();
+ }
+
+ /*************************************************************************
+diff --git a/sw/source/core/layout/ssfrm.cxx b/sw/source/core/layout/ssfrm.cxx
+index 6ac8bc7..a77b00b 100644
+--- a/sw/source/core/layout/ssfrm.cxx
++++ b/sw/source/core/layout/ssfrm.cxx
+@@ -365,7 +365,7 @@ Point SwFrm::GetFrmAnchorPos( sal_Bool bIgnoreFlysAnchoredAtThisFrame ) const
+ |*
+ |*************************************************************************/
+
+-SwFrm::~SwFrm()
++void SwFrm::Destroy()
+ {
+ // accessible objects for fly and cell frames have been already disposed
+ // by the destructors of the derived classes.
+@@ -405,6 +405,7 @@ SwFrm::~SwFrm()
+ }
+ if ( pDrawObjs )
+ delete pDrawObjs;
++ pDrawObjs = 0;
+ }
+
+ #if OSL_DEBUG_LEVEL > 1
+@@ -413,6 +414,14 @@ SwFrm::~SwFrm()
+ #endif
+ }
+
++SwFrm::~SwFrm()
++{
++ if (!IsRootFrm()) // ~SwRootFrm already calls Destroy!
++ {
++ Destroy();
++ }
++}
++
+ /*************************************************************************/
+
+ const SwFrmFmt * SwLayoutFrm::GetFmt() const
+@@ -560,7 +569,7 @@ void SwCntntFrm::DelFrms( const SwCntntNode& rNode )
+ |*************************************************************************/
+
+
+-SwLayoutFrm::~SwLayoutFrm()
++void SwLayoutFrm::Destroy()
+ {
+ SwFrm *pFrm = pLower;
+
+@@ -644,6 +653,14 @@ SwLayoutFrm::~SwLayoutFrm()
+ }
+ }
+
++SwLayoutFrm::~SwLayoutFrm()
++{
++ if (!IsRootFrm()) // ~SwRootFrm already calls Destroy!
++ {
++ Destroy();
++ }
++}
++
+ /*************************************************************************
+ |*
+ |* SwFrm::PaintArea()
+--
+1.7.7.6
+
diff --git a/libreoffice.spec b/libreoffice.spec
index 1e68107..8dbf0aa 100644
--- a/libreoffice.spec
+++ b/libreoffice.spec
@@ -224,6 +224,7 @@ Patch105: 0001-rhbz-794679-use-proper-Indian-Rupee-currency-symbol.patch
Patch106: 0001-fdo-31966-do-not-create-an-empty-slide-when-printing.patch
Patch107: 0001-Correctly-calculate-leap-year.patch
Patch108: 0001-fix-nsplugin-to-create-correct-com.sun.star.ucb.Simp.patch
+Patch109: 0001-SwRootFrm-SwRootFrm-refactor.patch
%{!?python_sitearch: %global python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib(1))")}
%define instdir %{_libdir}
@@ -1131,6 +1132,7 @@ mv -f redhat.soc extras/source/palettes/standard.soc
%patch106 -p1 -b .fdo-31966-do-not-create-an-empty-slide-when-printing.patch
%patch107 -p1 -b .Correctly-calculate-leap-year.patch
%patch108 -p1 -b .fix-nsplugin-to-create-correct-com.sun.star.ucb.Simp.patch
+%patch109 -p1 -b .SwRootFrm-SwRootFrm-refactor.patch
# these are horribly incomplete--empty translations and copied english
# strings with spattering of translated strings
More information about the scm-commits
mailing list