Kaydet (Commit) 3fcd1f80 authored tarafından Marco Cecchetti's avatar Marco Cecchetti Kaydeden (comit) Marco Cecchetti

Calc: edit engine could be accessed after being destroyed

ScTabView <---------------- ScTabViewShell
+ScViewData                 +ScInputHandler
   +EditView[4]                +EditEngine
                                +ImpEditEngine
                                   +vector<pointer<EditView>>

On tab view shell destruction:
~ScTabViewShell -> ~ScTabView -> ScViewData::KillEditView ->
EditEngine::RemoveView

but it occurs after the following:
~ScTabViewShell -> ~ScInputHandler -> ~EditEngine

since data members are destroyed before ancestor classes.

Change-Id: Ida56b8009c0d8a3cd23952259d78318e96ae5124
Reviewed-on: https://gerrit.libreoffice.org/29409Tested-by: 's avatarJenkins <ci@libreoffice.org>
Reviewed-by: 's avatarMarco Cecchetti <mrcekets@gmail.com>
üst f5ed9254
...@@ -661,14 +661,14 @@ ScInputHandler::~ScInputHandler() ...@@ -661,14 +661,14 @@ ScInputHandler::~ScInputHandler()
if ( pInputWin && pInputWin->GetInputHandler() == this ) if ( pInputWin && pInputWin->GetInputHandler() == this )
pInputWin->SetInputHandler( nullptr ); pInputWin->SetInputHandler( nullptr );
delete pRangeFindList; delete pRangeFindList; pRangeFindList = nullptr;
delete pEditDefaults; delete pEditDefaults; pEditDefaults = nullptr;
delete pEngine; delete pEngine; pEngine = nullptr;
delete pLastState; delete pLastState; pLastState = nullptr;
delete pDelayTimer; delete pDelayTimer; pDelayTimer = nullptr;
delete pColumnData; delete pColumnData; pColumnData = nullptr;
delete pFormulaData; delete pFormulaData; pFormulaData = nullptr;
delete pFormulaDataPara; delete pFormulaDataPara; pFormulaDataPara = nullptr;
} }
void ScInputHandler::SetRefScale( const Fraction& rX, const Fraction& rY ) void ScInputHandler::SetRefScale( const Fraction& rX, const Fraction& rY )
......
...@@ -1435,11 +1435,16 @@ void ScViewData::ResetEditView() ...@@ -1435,11 +1435,16 @@ void ScViewData::ResetEditView()
void ScViewData::KillEditView() void ScViewData::KillEditView()
{ {
EditEngine* pEngine = nullptr;
for (sal_uInt16 i=0; i<4; i++) for (sal_uInt16 i=0; i<4; i++)
if (pEditView[i]) if (pEditView[i])
{ {
if (bEditActive[i]) if (bEditActive[i])
pEditView[i]->GetEditEngine()->RemoveView(pEditView[i]); {
pEngine = pEditView[i]->GetEditEngine();
if (pEngine)
pEngine->RemoveView(pEditView[i]);
}
delete pEditView[i]; delete pEditView[i];
pEditView[i] = nullptr; pEditView[i] = nullptr;
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment