ODFstudio/odfstudio
2
0
Fork 0
Code Issues Packages Activity

filter: fix crash in PDFDialog::executedDialog()

Browse Source 
Crashreport backtrace:

	#0  0x00007d8e166943f0 in lcl_GetConfigPropertyMap()::aConfigPropertyMap_Impl () from /opt/collaboraoffice/program/../program/libsclo.so
	#1  0x00007d8e1876047a in cppu::WeakImplHelper<com::sun::star::ui::dialogs::XExecutableDialog, com::sun::star::lang::XServiceInfo, com::sun::star::lang::XInitialization>::release (
	    this=0x5a9aec60) at /home/collabora/jenkins/workspace/build_core_co-25.04_for_online_snapshot/include/cppuhelper/implbase.hxx:115
	#2  svt::OGenericUnoDialog::release (this=0x5a9aec60) at /home/collabora/jenkins/workspace/build_core_co-25.04_for_online_snapshot/include/svtools/genericunodialog.hxx:80
	#3  cppu::ImplInheritanceHelper<svt::OGenericUnoDialog, com::sun::star::ui::dialogs::XAsynchronousExecutableDialog>::release (this=0x5a9aec60)
	    at /home/collabora/jenkins/workspace/build_core_co-25.04_for_online_snapshot/include/cppuhelper/implbase.hxx:171
	#4  cppu::ImplInheritanceHelper<svt::OGenericUnoAsyncDialog<SfxTabDialogController>, com::sun::star::beans::XPropertyAccess, com::sun::star::document::XExporter>::release (this=0x5a9aec60)
	    at /home/collabora/jenkins/workspace/build_core_co-25.04_for_online_snapshot/include/cppuhelper/implbase.hxx:171
	#5  rtl::Reference<PDFDialog>::~Reference (this=<synthetic pointer>, __in_chrg=<optimized out>)
	    at /home/collabora/jenkins/workspace/build_core_co-25.04_for_online_snapshot/include/rtl/ref.hxx:126
	#6  operator() (nResponse=<optimized out>, __closure=<optimized out>) at /home/collabora/jenkins/workspace/build_core_co-25.04_for_online_snapshot/filter/source/pdf/pdfdialog.cxx:88

Calling into sc/ sounds like a broken vtable, possibly just reading
already freed memory.

The potential problem is that by the time the lambda in
PDFDialog::runAsync() would try to keep 'this' alive, it's gone already.
Try to fix that by moving the keep alive variable to the caller, so the
lambda increases the refcount.

Change-Id: Ida39f6fda976ddc044bb92e839de125fdae4fc2d
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/203059
Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/204057
Tested-by: Jenkins
This commit is contained in:
Miklos Vajna
2026-04-23 13:44:08 +02:00
committed by Xisco Fauli
parent 8cbd028c0b
commit 984b18cbf8
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
filter/source/pdf/pdfdialog.cxx
+4 -4
View File
@@ -78,13 +78,13 @@ void PDFDialog::executedDialog( sal_Int16 nExecutionResult )
void PDFDialog::runAsync(const css::uno::Reference< css::ui::dialogs::XDialogClosedListener >& xListener)
{
SfxTabDialogController::runAsync(m_xAsyncDialog, [this, xListener](sal_Int32 nResponse) {
rtl::Reference<PDFDialog> xThis(this); // keep alive for scope, dialogClosed can cause owner to drop this
executedAsyncDialog( m_xAsyncDialog, nResponse );
rtl::Reference<PDFDialog> xThis(this); // keep alive, 'this' may be droped otherwise
SfxTabDialogController::runAsync(m_xAsyncDialog, [xThis, xListener](sal_Int32 nResponse) {
xThis->executedAsyncDialog( xThis->m_xAsyncDialog, nResponse );
css::ui::dialogs::DialogClosedEvent aEvent;
aEvent.DialogResult = nResponse;
xListener->dialogClosed( aEvent );
destroyAsyncDialog();
xThis->destroyAsyncDialog();
});
}