Kaydet (Commit) 3fcd1f80 authored tarafından Marco Cecchetti's avatar Marco Cecchetti Kaydeden (comit) Marco Cecchetti

Calc: edit engine could be accessed after being destroyed

ScTabView <---------------- ScTabViewShell
+ScViewData                 +ScInputHandler
   +EditView[4]                +EditEngine
                                +ImpEditEngine
                                   +vector<pointer<EditView>>

On tab view shell destruction:
~ScTabViewShell -> ~ScTabView -> ScViewData::KillEditView ->
EditEngine::RemoveView

but it occurs after the following:
~ScTabViewShell -> ~ScInputHandler -> ~EditEngine

since data members are destroyed before ancestor classes.

Change-Id: Ida56b8009c0d8a3cd23952259d78318e96ae5124
Reviewed-on: https://gerrit.libreoffice.org/29409Tested-by: 's avatarJenkins <ci@libreoffice.org>
Reviewed-by: 's avatarMarco Cecchetti <mrcekets@gmail.com>
üst f5ed9254
......@@ -661,14 +661,14 @@ ScInputHandler::~ScInputHandler()
if ( pInputWin && pInputWin->GetInputHandler() == this )
pInputWin->SetInputHandler( nullptr );
delete pRangeFindList;
delete pEditDefaults;
delete pEngine;
delete pLastState;
delete pDelayTimer;
delete pColumnData;
delete pFormulaData;
delete pFormulaDataPara;
delete pRangeFindList; pRangeFindList = nullptr;
delete pEditDefaults; pEditDefaults = nullptr;
delete pEngine; pEngine = nullptr;
delete pLastState; pLastState = nullptr;
delete pDelayTimer; pDelayTimer = nullptr;
delete pColumnData; pColumnData = nullptr;
delete pFormulaData; pFormulaData = nullptr;
delete pFormulaDataPara; pFormulaDataPara = nullptr;
}
void ScInputHandler::SetRefScale( const Fraction& rX, const Fraction& rY )
......
......@@ -1435,11 +1435,16 @@ void ScViewData::ResetEditView()
void ScViewData::KillEditView()
{
EditEngine* pEngine = nullptr;
for (sal_uInt16 i=0; i<4; i++)
if (pEditView[i])
{
if (bEditActive[i])
pEditView[i]->GetEditEngine()->RemoveView(pEditView[i]);
{
pEngine = pEditView[i]->GetEditEngine();
if (pEngine)
pEngine->RemoveView(pEditView[i]);
}
delete pEditView[i];
pEditView[i] = nullptr;
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment