Bug 52293

Summary: crash when pressing delete in "divide by" formula
Product: [Applications] calligraformula Reporter: Mikael Collin <hdi99mco>
Component: generalAssignee: Thomas Zander <zander>
Status: RESOLVED FIXED    
Severity: crash    
Priority: NOR    
Version: 1.x   
Target Milestone: ---   
Platform: RedHat Enterprise Linux   
OS: Linux   
Latest Commit: Version Fixed In:

Description Mikael Collin 2002-12-25 17:19:41 UTC
Version:           1.2.1 (using KDE KDE 3.0.99)
Installed from:    RedHat RPMs
Compiler:          GCC 3.2 
OS:          Linux

I have just installed RedHat 8.1 Beta 1, on an empty harddrive.

KWord produces a SIGSEGV - signal 11 message (the error-window pops up) the error is reproducible:
1. Start KWord, press ok.
2. Use the formula button at the left bar.
3. Choose divide by from the bottom bar.
4. Then enter anything at the top, and then when you are supposed to enter the bottom press the delete key.
5. Crach ;)

Micke
Comment 1 Waldo Bastian 2004-02-01 23:23:06 UTC
Valgrind:

==5737== Invalid read of size 4
==5737==    at 0x48A521B0: KFormula::FractionElement::draw(QPainter&, QRect const&, KFormula::ContextStyle const&, KFormula::ContextStyle::TextStyle, KFormula::ContextStyle::IndexStyle, QPoint const&) (contextstyle.h:224)
==5737==    by 0x48A4039D: KFormula::SequenceElement::draw(QPainter&, QRect const&, KFormula::ContextStyle const&, KFormula::ContextStyle::TextStyle, KFormula::ContextStyle::IndexStyle, QPoint const&) (sequenceelement.cc:265)
==5737==    by 0x48A353F2: KFormula::FormulaElement::draw(QPainter&, QRect const&, KFormula::ContextStyle const&, KFormula::ContextStyle::TextStyle, KFormula::ContextStyle::IndexStyle, QPoint const&) (formulaelement.cc:133)
==5737==    by 0x48A354C5: KFormula::FormulaElement::draw(QPainter&, QRect const&, KFormula::ContextStyle&) (contextstyle.h:154)
==5737==    by 0x48A3CA1F: KFormula::Container::draw(QPainter&, QRect const&, bool) (kozoomhandler.h:172)
==5737==    by 0x48A3C84E: KFormula::Container::draw(QPainter&, QRect const&, QColorGroup const&, bool) (kformulacontainer.cc:297)
==5737==    by 0x48A7EFF3: KFormula::View::draw(QPainter&, QRect const&, QColorGroup const&) (kformulaview.cc:123)
==5737==    by 0x47C8FBF8: KWFormulaFrameSet::drawFrameContents(KWFrame*, QPainter*, QRect const&, QColorGroup const&, bool, bool, KWFrameSetEdit*, KWViewMode*) (kwformulaframe.cc:185)
==5737==    by 0x47C854E2: KWFrameSet::drawFrame(KWFrame*, QPainter*, QRect const&, QRect const&, QPoint const&, KWFrame*, QColorGroup const&, bool, bool, KWFrameSetEdit*, KWViewMode*, bool) (kwframe.cc:1351)
==5737==    by 0x47C84FA6: KWFrameSet::drawFrameAndBorders(KWFrame*, QPainter*, QRect const&, QColorGroup const&, bool, bool, KWFrameSetEdit*, KWViewMode*, KWFrame*, bool) (qpoint.h:233)
==5737==    by 0x47C84281: KWFrameSet::drawContents(QPainter*, QRect const&, QColorGroup const&, bool, bool, KWFrameSetEdit*, KWViewMode*) (kwframe.cc:1165)
==5737==    by 0x47C8B5BF: KWFrameSetEdit::drawContents(QPainter*, QRect const&, QColorGroup const&, bool, bool, KWViewMode*) (kwframe.h:346)
==5737==    by 0x47C6A16A: KWCanvas::drawFrameSet(KWFrameSet*, QPainter*, QRect const&, bool, bool, KWViewMode*) (kwcanvas.cc:282)
==5737==    by 0x47C694BE: KWCanvas::repaintChanged(KWFrameSet*, bool) (kwcanvas.cc:179)
==5737==    by 0x47C9153D: KWFormulaFrameSetEdit::cursorChanged(bool, bool) (kwformulaframe.h:121)
==5737==    by 0x47C91C4A: KWFormulaFrameSetEdit::qt_invoke(int, QUObject*) (qucom_p.h:369)
==5737==    by 0x41116508: QObject::activate_signal(QConnectionList*, QUObject*) (qobject.cpp:2333)
==5737==    by 0x48A8078F: KFormula::View::cursorChanged(bool, bool) (kformulaview.moc:116)
==5737==    by 0x48A80582: KFormula::View::emitCursorChanged() (formulacursor.h:90)
==5737==    by 0x48A8014F: KFormula::View::slotElementWillVanish(KFormula::BasicElement*) (kformulaview.cc:264)
==5737==    by 0x48A80854: KFormula::View::qt_invoke(int, QUObject*) (qucom_p.h:312)
==5737==    by 0x41116508: QObject::activate_signal(QConnectionList*, QUObject*) (qobject.cpp:2333)
==5737==    by 0x48A3F168: KFormula::Container::elementWillVanish(KFormula::BasicElement*) (kformulacontainer.moc:209)
==5737==    by 0x48A3C2DF: KFormula::Container::elementRemoval(KFormula::BasicElement*) (kformulacontainer.cc:159)
==5737==    by 0x48A35268: KFormula::FormulaElement::elementRemoval(KFormula::BasicElement*) (formulaelement.cc:71)
==5737==    by 0x48A416BA: KFormula::SequenceElement::removeChild(QPtrList<KFormula::BasicElement>&, int) (sequenceelement.cc:794)
==5737==    by 0x48A414FF: KFormula::SequenceElement::remove(KFormula::FormulaCursor*, QPtrList<KFormula::BasicElement>&, KFormula::Direction) (sequenceelement.cc:741)
==5737==    by 0x48A340C1: KFormula::FormulaCursor::remove(QPtrList<KFormula::BasicElement>&, KFormula::Direction) (formulacursor.cc:335)
==5737==    by 0x48A3425C: KFormula::FormulaCursor::replaceByMainChildContent(KFormula::Direction) (formulacursor.cc:391)
==5737==    by 0x48A599B5: KFormula::KFCRemove::execute() (kformulacommand.cc:202)
==5737==    by 0x480E1BFB: KoCommandHistory::addCommand(KCommand*, bool) (kocommandhistory.cpp:204)
==5737==    by 0x48A3D01C: KFormula::Container::execute(KCommand*) (kformulacontainer.cc:402)
==5737==    by 0x48A3CBA9: KFormula::Container::input(QKeyEvent*) (formulacursor.h:231)
==5737==    by 0x48A7F107: KFormula::View::keyPressEvent(QKeyEvent*) (kformulaview.cc:139)
==5737==    by 0x47C90EE2: KWFormulaFrameSetEdit::keyPressEvent(QKeyEvent*) (kwformulaframe.cc:388)
==5737==    by 0x47C7640E: KWCanvas::eventFilter(QObject*, QEvent*) (kwcanvas.cc:2542)
==5737==    by 0x41114103: QObject::activate_filters(QEvent*) (qobject.cpp:902)
==5737==    by 0x41113F75: QObject::event(QEvent*) (qobject.cpp:735)
==5737==    by 0x4114DAF0: QWidget::event(QEvent*) (qwidget.cpp:4408)
==5737==    by 0x410B3746: QApplication::internalNotify(QObject*, QEvent*) (qapplication.cpp:2582)
==5737==    Address 0x0 is not stack'd, malloc'd or free'd
Comment 2 Ulrich Kuettler 2004-02-02 09:21:37 UTC
Subject: Re:  crash when pressing delete in "divide by" formula

Obviously there is a repaint triggered during a half finished deletion. That's 
due to the somewhat confused signal handling. Sadly however, I don't have an 
opportunity to fix it. I have to apologize.

Uli

Comment 3 Raphael Langerhorst 2005-01-23 11:05:16 UTC
Thank you for your bug report.
The bug that you reported has been identified and has been fixed in 
the latest development (CVS) version of KOffice. The bug report will 
be closed.