crashtesting: let ZSortFly hold its own copy of the anchor
possibly an issue since:
commit 1d3d2a9952
Date: Mon Jun 20 17:27:53 2022 +0200
tdf#148687 tdf#149173 tdf#149546 sw: fix crash with textboxes
reproduce by loading tdf135164-3.docx and exporting it to odt, which
under asan gives:
==582547==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c2d9893bae0 at pc 0x7b6d5656a263 bp 0x7b6d67ee9b90 sp 0x7b6d67ee9b88
READ of size 1 at 0x7c2d9893bae0 thread T76
#0 0x7b6d5656a262 in std::_Optional_base<SwPosition, false, false>::_Optional_base(std::_Optional_base<SwPosition, false, false> const&) c++/15/optional:513:39
#1 0x7b6d5653ab8a in std::optional<SwPosition>::optional(std::optional<SwPosition> const&) c++/15/optional:778:11
#2 0x7b6d56511a07 in SwFormatAnchor::SwFormatAnchor(SwFormatAnchor const&) sw/source/core/layout/atrfrm.cxx:1694:7
#3 0x7b6d553c8de8 in sw::DocumentContentOperationsManager::CopyFlyInFlyImpl(SwNodeRange const&, SwPaM const*, SwNode&, bool, SwCopyFlags, bool) const sw/source/core/doc/DocumentContentOperationsManager.cxx:4121:24
#4 0x7b6d553c53c0 in sw::DocumentContentOperationsManager::CopyWithFlyInFly(SwNodeRange const&, SwNode&, std::pair<SwPaM const&, SwPosition const&> const*, bool, bool, bool, SwCopyFlags) const sw/source/core/doc/DocumentContentOperationsManager.cxx:3932:9
#5 0x7b6d553d81ee in sw::DocumentContentOperationsManager::CopyImplImpl(SwPaM&, SwPosition&, SwCopyFlags, SwPaM*) const sw/source/core/doc/DocumentContentOperationsManager.cxx:5470:17
#6 0x7b6d55375290 in sw::DocumentContentOperationsManager::CopyImpl(SwPaM&, SwPosition&, SwCopyFlags, SwPaM*) const sw/source/core/doc/DocumentContentOperationsManager.cxx:5087:16
#7 0x7b6d55373681 in sw::DocumentContentOperationsManager::CopyRange(SwPaM&, SwPosition&, SwCopyFlags, unsigned int) const sw/source/core/doc/DocumentContentOperationsManager.cxx:2113:16
#8 0x7b6d550f2385 in SwRangeRedline::CopyToSection() sw/source/core/doc/docredln.cxx:2105:46
#9 0x7b6d550eb84b in SwRangeRedline::Hide(unsigned short, unsigned long, bool) sw/source/core/doc/docredln.cxx:1815:17
#10 0x7b6d5550a3e2 in sw::DocumentRedlineManager::SetRedlineFlags(RedlineFlags, SfxRedlineRecordingMode, bool) sw/source/core/doc/DocumentRedlineManager.cxx:1348:17
#11 0x7b6d58f79b33 in SwXMLWriter::Write_(SfxItemSet const*) sw/source/filter/xml/wrtxml.cxx:243:41
#12 0x7b6d58f7f80b in SwXMLWriter::WriteMedium(SfxMedium&) sw/source/filter/xml/wrtxml.cxx:467:12
#13 0x7b6d58eb86fa in StgWriter::Write(SwPaM&, com::sun::star::uno::Reference<com::sun::star::embed::XStorage> const&, rtl::OUString const*, SfxMedium*) sw/source/filter/writer/writer.cxx:506:33
#14 0x7b6d58f7fb46 in SwXMLWriter::Write(SwPaM&, SfxMedium&, rtl::OUString const*) sw/source/filter/xml/wrtxml.cxx:474:47
#15 0x7b6d58751d1e in SwWriter::Write(tools::SvRef<Writer> const&, rtl::OUString const*) sw/source/filter/basflt/shellio.cxx:995:28
#16 0x7b6d5922e93a in SwDocShell::SaveAs(SfxMedium&) sw/source/uibase/app/docsh.cxx:545:21
#17 0x7f6dd5c75ac9 in SfxObjectShell::SaveAsOwnFormat(SfxMedium&) sfx2/source/doc/objstor.cxx:3513:16
#18 0x7f6dd5c4d8cb in SfxObjectShell::SaveTo_Impl(SfxMedium&, SfxItemSet const*) sfx2/source/doc/objstor.cxx:1748:23
#19 0x7f6dd5c72df9 in SfxObjectShell::PreDoSaveAs_Impl(rtl::OUString const&, rtl::OUString const&, SfxItemSet const&, cpo::uno::Sequence<com::sun::star::beans::PropertyValue> const&) sfx2/source/doc/objstor.cxx:3263:39
#20 0x7f6dd5c6e279 in SfxObjectShell::CommonSaveAs_Impl(INetURLObject const&, rtl::OUString const&, SfxItemSet&, cpo::uno::Sequence<com::sun::star::beans::PropertyValue> const&) sfx2/source/doc/objstor.cxx:3051:20
#21 0x7f6dd5bebeab in SfxObjectShell::APISaveAs_Impl(std::basic_string_view<char16_t, std::char_traits<char16_t>>, SfxItemSet&, cpo::uno::Sequence<com::sun::star::beans::PropertyValue> const&) sfx2/source/doc/objserv.cxx:329:19
#22 0x7f6dd5dfed92 in SfxBaseModel::impl_store(rtl::OUString const&, cpo::uno::Sequence<com::sun::star::beans::PropertyValue> const&, bool) sfx2/source/doc/sfxbasemodel.cxx:3247:42
#23 0x7f6dd5e02fa8 in SfxBaseModel::storeToURL(rtl::OUString const&, cpo::uno::Sequence<com::sun::star::beans::PropertyValue> const&) sfx2/source/doc/sfxbasemodel.cxx:1830:13
0x7c2d9893bae0 is located 96 bytes inside of 120-byte region [0x7c2d9893ba80,0x7c2d9893baf8)
freed by thread T76 here:
#0 0x561412fdfb36 in operator delete(void*, unsigned long) (instdir/program/soffice.bin+0x15cb36) (BuildId: 92501b697c39a7d873a4e4e34cbe433111a30f3c)
#1 0x7b6d56511ce6 in SwFormatAnchor::~SwFormatAnchor() sw/source/core/layout/atrfrm.cxx:1704:1
#2 0x7f6dd0447dcf in implCleanupItemEntry(SfxPoolItem const*) svl/source/items/globalpool.cxx:459:5
#3 0x7f6dd068f87a in SfxItemSet::PutImpl(SfxPoolItem const&, bool) svl/source/items/itemset.cxx:646:5
#4 0x7b6d5400e842 in SfxItemSet::Put(SfxPoolItem const&) include/svl/itemset.hxx:230:18
#5 0x7b6d5432d284 in SwAttrSet::Put_BC(SfxPoolItem const&, SwAttrSet*, SwAttrSet*) sw/source/core/attr/swatrset.cxx:232:40
#6 0x7b6d543079d1 in SwFormat::SetFormatAttr(SfxPoolItem const&) sw/source/core/attr/format.cxx:531:23
#7 0x7b6d55a2716e in SwTextBoxHelper::changeAnchor(SwFrameFormat*, SdrObject*) sw/source/core/doc/textboxhelper.cxx:1332:34
#8 0x7b6d55a462a9 in SwTextBoxNode::Clone(SwDoc*, SwFormatAnchor const&, SwFrameFormat*, bool, bool) const sw/source/core/doc/textboxhelper.cxx:2002:9
#9 0x7b6d55634d51 in sw::DocumentLayoutManager::CopyLayoutFormat(SwFrameFormat const&, SwFormatAnchor const&, bool, bool) sw/source/core/doc/DocumentLayoutManager.cxx:478:21
#10 0x7b6d553ca892 in sw::DocumentContentOperationsManager::CopyFlyInFlyImpl(SwNodeRange const&, SwPaM const*, SwNode&, bool, SwCopyFlags, bool) const sw/source/core/doc/DocumentContentOperationsManager.cxx:4232:71
#11 0x7b6d553c53c0 in sw::DocumentContentOperationsManager::CopyWithFlyInFly(SwNodeRange const&, SwNode&, std::pair<SwPaM const&, SwPosition const&> const*, bool, bool, bool, SwCopyFlags) const sw/source/core/doc/DocumentContentOperationsManager.cxx:3932:9
#12 0x7b6d553d81ee in sw::DocumentContentOperationsManager::CopyImplImpl(SwPaM&, SwPosition&, SwCopyFlags, SwPaM*) const sw/source/core/doc/DocumentContentOperationsManager.cxx:5470:17
#13 0x7b6d55375290 in sw::DocumentContentOperationsManager::CopyImpl(SwPaM&, SwPosition&, SwCopyFlags, SwPaM*) const sw/source/core/doc/DocumentContentOperationsManager.cxx:5087:16
#14 0x7b6d55373681 in sw::DocumentContentOperationsManager::CopyRange(SwPaM&, SwPosition&, SwCopyFlags, unsigned int) const sw/source/core/doc/DocumentContentOperationsManager.cxx:2113:16
#15 0x7b6d550f2385 in SwRangeRedline::CopyToSection() sw/source/core/doc/docredln.cxx:2105:46
#16 0x7b6d550eb84b in SwRangeRedline::Hide(unsigned short, unsigned long, bool) sw/source/core/doc/docredln.cxx:1815:17
#17 0x7b6d5550a3e2 in sw::DocumentRedlineManager::SetRedlineFlags(RedlineFlags, SfxRedlineRecordingMode, bool) sw/source/core/doc/DocumentRedlineManager.cxx:1348:17
#18 0x7b6d58f79b33 in SwXMLWriter::Write_(SfxItemSet const*) sw/source/filter/xml/wrtxml.cxx:243:41
It pointed at the anchor item owned by the format, and the fly copy
loop can set a new anchor on that format while the sorted set is
still being walked
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I3150efbd39c3da1241fdc7eb5036d2fabd38e37f
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/10580
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>
(cherry picked from commit 174958393287389a921b9d3c11664670882998c3)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/210336
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Caolán McNamara
8e4ea60983