desktop/source/deployment/registry/package/dp_package.cxx | 9 ----- embeddedobj/source/inc/oleembobj.hxx | 7 ++- embeddedobj/source/msole/oleembed.cxx | 8 ++-- embeddedobj/source/msole/olemisc.cxx | 15 +++++--- embeddedobj/source/msole/olepersist.cxx | 25 +++++++------- embeddedobj/source/msole/olevisual.cxx | 4 +- include/osl/mutex.hxx | 21 +++++++++++ include/sfx2/objsh.hxx | 6 +-- sfx2/source/doc/objcont.cxx | 2 - sfx2/source/doc/objxtor.cxx | 15 ++++---- sw/source/core/doc/DocumentTimerManager.cxx | 2 + sw/source/uibase/uiview/view.cxx | 20 +++++++---- 12 files changed, 82 insertions(+), 52 deletions(-)
New commits: commit 4ae90355d888555865145e39958c0e7ee5ed0a01 Author: Mike Kaganski <mike.kagan...@collabora.com> AuthorDate: Wed Aug 14 14:09:30 2024 +0500 Commit: Mike Kaganski <mike.kagan...@collabora.com> CommitDate: Mon Aug 26 12:20:40 2024 +0500 Disallow closing document during idle layout Similar to commit 99c1bd1a4ef5365d8c26a41c8e858c67e673beb4 (Disallow closing document during generation of preview, 2024-03-11), it may happen that an external process is closes a document that is being in the process of the background layout, leading to use-after-free. The request thread at the crash time, executing XComponent::dispose: swlo.dll!SwNoTextFrame::~SwNoTextFrame() Line 170 swlo.dll!SwNoTextFrame::`scalar deleting destructor'(unsigned int) swlo.dll!SwFrame::DestroyFrame(SwFrame * const pFrame) Line 397 swlo.dll!SwFlyFrame::DeleteCnt() Line 424 swlo.dll!SwFlyFrame::DestroyImpl() Line 358 swlo.dll!SwFlyFreeFrame::DestroyImpl() Line 89 swlo.dll!SwFrame::DestroyFrame(SwFrame * const pFrame) Line 396 swlo.dll!SwLayoutFrame::DestroyImpl() Line 516 swlo.dll!SwFrame::DestroyFrame(SwFrame * const pFrame) Line 396 swlo.dll!SwLayoutFrame::DestroyImpl() Line 540 swlo.dll!SwPageFrame::DestroyImpl() Line 317 swlo.dll!SwFrame::DestroyFrame(SwFrame * const pFrame) Line 396 swlo.dll!SwLayoutFrame::DestroyImpl() Line 540 swlo.dll!SwRootFrame::DestroyImpl() Line 570 swlo.dll!SwFrame::DestroyFrame(SwFrame * const pFrame) Line 396 swlo.dll!std::_Ref_count_resource<SwRootFrame *,void (__cdecl*)(SwFrame *)>::_Destroy() Line 1222 swlo.dll!std::_Ref_count_base::_Decref() Line 1164 swlo.dll!std::_Ptr_base<SwRootFrame>::_Decref() Line 1380 swlo.dll!std::shared_ptr<SwRootFrame>::~shared_ptr<SwRootFrame>() Line 1685 swlo.dll!SwViewShell::~SwViewShell() Line 354 swlo.dll!SwCursorShell::~SwCursorShell() Line 3440 swlo.dll!SwEditShell::~SwEditShell() Line 63 swlo.dll!SwFEShell::~SwFEShell() Line 699 swlo.dll!SwWrtShell::~SwWrtShell() Line 2065 swlo.dll!SwWrtShell::`scalar deleting destructor'(unsigned int) swlo.dll!std::default_delete<SwWrtShell>::operator()(SwWrtShell * _Ptr) Line 3302 swlo.dll!std::unique_ptr<SwWrtShell,std::default_delete<SwWrtShell>>::reset(SwWrtShell * _Ptr) Line 3447 swlo.dll!SwView::~SwView() Line 1196 swlo.dll!SwView::`vector deleting destructor'(unsigned int) sfxlo.dll!SfxViewFrame::ReleaseObjectShell_Impl() Line 1140 sfxlo.dll!SfxViewFrame::~SfxViewFrame() Line 2059 sfxlo.dll!SfxViewFrame::`scalar deleting destructor'(unsigned int) sfxlo.dll!SfxViewFrame::Close() Line 1192 sfxlo.dll!SfxFrame::DoClose_Impl() Line 138 sfxlo.dll!SfxBaseController::dispose() Line 928 fwklo.dll!`anonymous namespace'::XFrameImpl::setComponent(const com::sun::star::uno::Reference<com::sun::star::awt::XWindow> & xComponentWindow, const com::sun::star::uno::Reference<com::sun::star::frame::XController> & xController) Line 1496 fwklo.dll!`anonymous namespace'::XFrameImpl::close(unsigned char bDeliverOwnership) Line 1707 sfxlo.dll!SfxFrame::DoClose() Line 104 sfxlo.dll!SfxViewFrame::Notify(SfxBroadcaster & __formal, const SfxHint & rHint) Line 1820 svllo.dll!SfxBroadcaster::Broadcast(const SfxHint & rHint) Line 40 sfxlo.dll!`anonymous namespace'::SfxModelListener_Impl::notifyClosing(const com::sun::star::lang::EventObject & __formal) Line 154 sfxlo.dll!SfxBaseModel::close(unsigned char bDeliverOwnership) Line 1511 swlo.dll!SwXTextDocument::close(unsigned char bDeliverOwnership) Line 574 sfxlo.dll!SfxBaseModel::dispose() Line 745 swlo.dll!SwXTextDocument::dispose() Line 561 mscx_uno.dll!`anonymous namespace'::cpp_call(bridges::cpp_uno::shared::UnoInterfaceProxy * pThis, bridges::cpp_uno::shared::VtableSlot aVtableSlot, _typelib_TypeDescriptionReference * pReturnTypeRef, long nParams, _typelib_MethodParameter * pParams, void * pUnoReturn, void * * pUnoArgs, _uno_Any * * ppUnoExc) Line 214 mscx_uno.dll!unoInterfaceProxyDispatch(_uno_Interface * pUnoI, const _typelib_TypeDescription * pMemberTD, void * pReturn, void * * pArgs, _uno_Any * * ppException) Line 430 binaryurplo.dll!binaryurp::IncomingRequest::execute_throw(binaryurp::BinaryAny * returnValue, std::vector<binaryurp::BinaryAny,std::allocator<binaryurp::BinaryAny>> * outArguments) Line 239 binaryurplo.dll!binaryurp::IncomingRequest::execute() Line 79 binaryurplo.dll!request(void * pThreadSpecificData) Line 84 cppu3.dll!cppu_threadpool::JobQueue::enter(const void * nDisposeId, bool bReturnWhenNoJob) Line 101 cppu3.dll!cppu_threadpool::ORequestThread::run() Line 165 cppu3.dll!threadFunc(void * param) Line 190 sal3.dll!oslWorkerWrapperFunction(void * pData) Line 67 Main thread, doing an idle layout of the same document: emboleobj.dll!OleComponent::SetExtent(const com::sun::star::awt::Size & aVisAreaSize, __int64 nAspect) Line 1099 emboleobj.dll!OleEmbeddedObject::setVisualAreaSize(__int64 nAspect, const com::sun::star::awt::Size & aSize) Line 138 swlo.dll!SwWrtShell::CalcAndSetScale(svt::EmbeddedObjectRef & xObj, const SwRect * pFlyPrtRect, const SwRect * pFlyFrameRect, const bool bNoTextFramePrtAreaChanged) Line 777 swlo.dll!SwContentNotify::ImplDestroy() Line 926 swlo.dll!SwContentNotify::~SwContentNotify() Line 1037 swlo.dll!SwNoTextFrame::MakeAll(OutputDevice * pRenderContext) Line 584 swlo.dll!SwFrame::OptPrepareMake() Line 412 swlo.dll!SwFrame::OptCalc() Line 1110 swlo.dll!SwLayAction::FormatContent_(const SwContentFrame * pContent, const SwPageFrame * pPage) Line 1969 swlo.dll!SwLayAction::FormatFlyContent(const SwFlyFrame * pFly) Line 1994 swlo.dll!SwObjectFormatter::FormatObj_(SwAnchoredObject & _rAnchoredObj) Line 312 swlo.dll!SwObjectFormatterTextFrame::DoFormatObj(SwAnchoredObject & _rAnchoredObj, const bool _bCheckForMovedFwd) Line 133 swlo.dll!SwObjectFormatter::FormatObjsAtFrame_(SwTextFrame * _pMasterTextFrame) Line 414 swlo.dll!SwObjectFormatterTextFrame::DoFormatObjs() Line 348 swlo.dll!SwObjectFormatter::FormatObjsAtFrame(SwFrame & _rAnchorFrame, const SwPageFrame & _rPageFrame, SwLayAction * _pLayAction) Line 160 swlo.dll!SwLayAction::FormatContent(SwPageFrame * pPage) Line 1802 swlo.dll!SwLayAction::InternalAction(OutputDevice * pRenderContext) Line 607 swlo.dll!SwLayAction::Action(OutputDevice * pRenderContext) Line 390 swlo.dll!SwLayIdle::SwLayIdle(SwRootFrame * pRt, SwViewShellImp * pI) Line 2372 swlo.dll!SwViewShell::LayoutIdle() Line 827 swlo.dll!sw::DocumentTimerManager::DoIdleJobs(Timer * __formal) Line 176 swlo.dll!sw::DocumentTimerManager::LinkStubDoIdleJobs(void * instance, Timer * data) Line 156 vcllo.dll!Link<Timer *,void>::Call(Timer * data) Line 111 vcllo.dll!Timer::Invoke() Line 75 vcllo.dll!Scheduler::CallbackTaskScheduling() Line 509 vcllo.dll!SalTimer::CallCallback() Line 53 vclplug_winlo.dll!WinSalTimer::ImplHandleElapsedTimer() Line 169 vclplug_winlo.dll!ImplSalYield(bool bWait, bool bHandleAllCurrentEvents) Line 525 vclplug_winlo.dll!WinSalInstance::DoYield(bool bWait, bool bHandleAllCurrentEvents) Line 581 vcllo.dll!ImplYield(bool i_bWait, bool i_bAllEvents) Line 385 vcllo.dll!Application::Yield() Line 473 vcllo.dll!Application::Execute() Line 361 sofficeapp.dll!desktop::Desktop::Main() Line 1652 vcllo.dll!ImplSVMain() Line 229 vcllo.dll!SVMain() Line 262 sofficeapp.dll!soffice_main() Line 121 soffice.bin!sal_main() Line 51 soffice.bin!main(int argc, char * * argv) Line 49 soffice.bin!invoke_main() Line 79 soffice.bin!__scrt_common_main_seh() Line 288 soffice.bin!__scrt_common_main() Line 331 soffice.bin!mainCRTStartup(void * __formal) Line 17 Change-Id: I92102a9cd11ccde307b070ebc1984eb3d17d65bf Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171856 Reviewed-by: Mike Kaganski <mike.kagan...@collabora.com> Tested-by: Jenkins diff --git a/include/sfx2/objsh.hxx b/include/sfx2/objsh.hxx index 2d8ce9f1ef89..f1d46795d6ca 100644 --- a/include/sfx2/objsh.hxx +++ b/include/sfx2/objsh.hxx @@ -834,14 +834,14 @@ public: } }; -class SfxCloseVetoLock +class SFX2_DLLPUBLIC SfxCloseVetoLock { public: - SfxCloseVetoLock(const SfxObjectShell& rDocShell); + SfxCloseVetoLock(const SfxObjectShell* pDocShell); ~SfxCloseVetoLock(); private: - const SfxObjectShell& m_rDocShell; + const SfxObjectShell* mpDocShell; }; typedef rtl::Reference<SfxObjectShell> SfxObjectShellRef; diff --git a/sfx2/source/doc/objcont.cxx b/sfx2/source/doc/objcont.cxx index 90e92f353434..46f026bdba6d 100644 --- a/sfx2/source/doc/objcont.cxx +++ b/sfx2/source/doc/objcont.cxx @@ -104,7 +104,7 @@ SfxObjectShell::GetPreviewMetaFile( bool bFullContent ) const BitmapEx SfxObjectShell::GetPreviewBitmap() const { - SfxCloseVetoLock lock(*this); + SfxCloseVetoLock lock(this); ScopedVclPtrInstance< VirtualDevice > pDevice; pDevice->SetAntialiasing(AntialiasingFlags::Enable | pDevice->GetAntialiasing()); if(!CreatePreview_Impl(/*bFullContent*/false, pDevice, nullptr)) diff --git a/sfx2/source/doc/objxtor.cxx b/sfx2/source/doc/objxtor.cxx index a9d2d3899441..4cd27194d0b2 100644 --- a/sfx2/source/doc/objxtor.cxx +++ b/sfx2/source/doc/objxtor.cxx @@ -345,20 +345,21 @@ SfxObjectShell::~SfxObjectShell() } } -SfxCloseVetoLock::SfxCloseVetoLock(const SfxObjectShell& rDocShell) - : m_rDocShell(rDocShell) +SfxCloseVetoLock::SfxCloseVetoLock(const SfxObjectShell* pDocShell) + : mpDocShell(pDocShell) { - osl_atomic_increment(&m_rDocShell.Get_Impl()->m_nClosingLockLevel); + if (mpDocShell) + osl_atomic_increment(&mpDocShell->Get_Impl()->m_nClosingLockLevel); } SfxCloseVetoLock::~SfxCloseVetoLock() { - if (osl_atomic_decrement(&m_rDocShell.Get_Impl()->m_nClosingLockLevel) == 0) + if (mpDocShell && osl_atomic_decrement(&mpDocShell->Get_Impl()->m_nClosingLockLevel) == 0) { - if (m_rDocShell.Get_Impl()->m_bCloseModelScheduled) + if (mpDocShell->Get_Impl()->m_bCloseModelScheduled) { - m_rDocShell.Get_Impl()->m_bCloseModelScheduled = false; // pass ownership - if (rtl::Reference model = static_cast<SfxBaseModel*>(m_rDocShell.GetBaseModel().get())) + mpDocShell->Get_Impl()->m_bCloseModelScheduled = false; // pass ownership + if (rtl::Reference model = static_cast<SfxBaseModel*>(mpDocShell->GetBaseModel().get())) { try { diff --git a/sw/source/core/doc/DocumentTimerManager.cxx b/sw/source/core/doc/DocumentTimerManager.cxx index 13f85a2026c8..44df4c33729d 100644 --- a/sw/source/core/doc/DocumentTimerManager.cxx +++ b/sw/source/core/doc/DocumentTimerManager.cxx @@ -158,6 +158,8 @@ IMPL_LINK_NOARG( DocumentTimerManager, DoIdleJobs, Timer*, void ) #ifdef TIMELOG static ::rtl::Logfile* pModLogFile = new ::rtl::Logfile( "First DoIdleJobs" ); #endif + SfxCloseVetoLock lock(m_rDoc.GetDocShell()); + BlockIdling(); StopIdling(); commit d6590e9f88bfc8dd4eb3a8e8515928045004f18b Author: Mike Kaganski <mike.kagan...@collabora.com> AuthorDate: Wed Aug 14 14:01:48 2024 +0500 Commit: Mike Kaganski <mike.kagan...@collabora.com> CommitDate: Mon Aug 26 12:20:40 2024 +0500 Unlock the mutex to avoid deadlock The request thread was calling OleComponent::CloseObject, which executed on main thread; OleEmbeddedObject::m_aMutex as locked by request thread: emboleobj.dll!OleComponent::CloseObject() Line 1004 emboleobj.dll!OleComponent::Dispose() Line 451 emboleobj.dll!OleComponent::close(unsigned char bDeliverOwnership) Line 1513 emboleobj.dll!OleEmbeddedObject::GetRidOfComponent() Line 235 emboleobj.dll!OleEmbeddedObject::Dispose() Line 269 emboleobj.dll!OleEmbeddedObject::close(unsigned char bDeliverOwnership) Line 498 comphelper.dll!comphelper::EmbeddedObjectContainer::CloseEmbeddedObjects() Line 208 sfxlo.dll!SfxObjectShell::~SfxObjectShell() Line 322 swlo.dll!SwDocShell::~SwDocShell() Line 380 swlo.dll!SwDocShell::`vector deleting destructor'(unsigned int) cppuhelper3MSC.dll!cppu::OWeakObject::release() Line 229 sfxlo.dll!rtl::Reference<SfxObjectShell>::~Reference<SfxObjectShell>() Line 126 sfxlo.dll!IMPL_SfxBaseModel_DataContainer::~IMPL_SfxBaseModel_DataContainer() Line 265 sfxlo.dll!IMPL_SfxBaseModel_DataContainer::`scalar deleting destructor'(unsigned int) sfxlo.dll!std::_Destroy_in_place<IMPL_SfxBaseModel_DataContainer>(IMPL_SfxBaseModel_DataContainer & _Obj) Line 293 sfxlo.dll!std::_Ref_count_obj2<IMPL_SfxBaseModel_DataContainer>::_Destroy() Line 2113 sfxlo.dll!std::_Ref_count_base::_Decref() Line 1164 sfxlo.dll!std::_Ptr_base<IMPL_SfxBaseModel_DataContainer>::_Decref() Line 1380 sfxlo.dll!std::shared_ptr<IMPL_SfxBaseModel_DataContainer>::~shared_ptr<IMPL_SfxBaseModel_DataContainer>() Line 1685 sfxlo.dll!std::shared_ptr<IMPL_SfxBaseModel_DataContainer>::reset() Line 1732 sfxlo.dll!SfxBaseModel::dispose() Line 794 swlo.dll!SwXTextDocument::dispose() Line 561 sfxlo.dll!SfxBaseModel::close(unsigned char bDeliverOwnership) Line 1523 swlo.dll!SwXTextDocument::close(unsigned char bDeliverOwnership) Line 574 sfxlo.dll!SfxBaseModel::dispose() Line 745 swlo.dll!SwXTextDocument::dispose() Line 561 mscx_uno.dll!`anonymous namespace'::cpp_call(bridges::cpp_uno::shared::UnoInterfaceProxy * pThis, bridges::cpp_uno::shared::VtableSlot aVtableSlot, _typelib_TypeDescriptionReference * pReturnTypeRef, long nParams, _typelib_MethodParameter * pParams, void * pUnoReturn, void * * pUnoArgs, _uno_Any * * ppUnoExc) Line 214 mscx_uno.dll!unoInterfaceProxyDispatch(_uno_Interface * pUnoI, const _typelib_TypeDescription * pMemberTD, void * pReturn, void * * pArgs, _uno_Any * * ppException) Line 430 binaryurplo.dll!binaryurp::IncomingRequest::execute_throw(binaryurp::BinaryAny * returnValue, std::vector<binaryurp::BinaryAny,std::allocator<binaryurp::BinaryAny>> * outArguments) Line 239 binaryurplo.dll!binaryurp::IncomingRequest::execute() Line 79 binaryurplo.dll!request(void * pThreadSpecificData) Line 84 cppu3.dll!cppu_threadpool::JobQueue::enter(const void * nDisposeId, bool bReturnWhenNoJob) Line 101 cppu3.dll!cppu_threadpool::ORequestThread::run() Line 165 cppu3.dll!threadFunc(void * param) Line 190 sal3.dll!oslWorkerWrapperFunction(void * pData) Line 67 Main thread was acquiring OleEmbeddedObject::m_aMutex, which deadlocked: sal3.dll!osl_acquireMutex(_oslMutexImpl * Mutex) Line 65 emboleobj.dll!osl::Mutex::acquire() Line 63 emboleobj.dll!osl::ResettableGuard<osl::Mutex>::reset() Line 250 emboleobj.dll!OleEmbeddedObject::setVisualAreaSize(__int64 nAspect, const com::sun::star::awt::Size & aSize) Line 148 swlo.dll!SwWrtShell::CalcAndSetScale(svt::EmbeddedObjectRef & xObj, const SwRect * pFlyPrtRect, const SwRect * pFlyFrameRect, const bool bNoTextFramePrtAreaChanged) Line 777 swlo.dll!SwContentNotify::ImplDestroy() Line 926 swlo.dll!SwContentNotify::~SwContentNotify() Line 1037 swlo.dll!SwNoTextFrame::MakeAll(OutputDevice * pRenderContext) Line 584 swlo.dll!SwFrame::OptPrepareMake() Line 412 swlo.dll!SwFrame::OptCalc() Line 1110 swlo.dll!SwLayAction::FormatContent_(const SwContentFrame * pContent, const SwPageFrame * pPage) Line 1960 swlo.dll!SwLayAction::FormatFlyContent(const SwFlyFrame * pFly) Line 1985 swlo.dll!SwObjectFormatter::FormatObj_(SwAnchoredObject & _rAnchoredObj) Line 312 swlo.dll!SwObjectFormatterTextFrame::DoFormatObj(SwAnchoredObject & _rAnchoredObj, const bool _bCheckForMovedFwd) Line 133 swlo.dll!SwObjectFormatter::FormatObjsAtFrame_(SwTextFrame * _pMasterTextFrame) Line 414 swlo.dll!SwObjectFormatterTextFrame::DoFormatObjs() Line 348 swlo.dll!SwObjectFormatter::FormatObjsAtFrame(SwFrame & _rAnchorFrame, const SwPageFrame & _rPageFrame, SwLayAction * _pLayAction) Line 160 swlo.dll!SwLayAction::FormatContent(SwPageFrame * pPage) Line 1793 swlo.dll!SwLayAction::InternalAction(OutputDevice * pRenderContext) Line 605 swlo.dll!SwLayAction::Action(OutputDevice * pRenderContext) Line 389 swlo.dll!SwLayIdle::SwLayIdle(SwRootFrame * pRt, SwViewShellImp * pI) Line 2363 swlo.dll!SwViewShell::LayoutIdle() Line 827 swlo.dll!sw::DocumentTimerManager::DoIdleJobs(Timer * __formal) Line 176 swlo.dll!sw::DocumentTimerManager::LinkStubDoIdleJobs(void * instance, Timer * data) Line 156 vcllo.dll!Link<Timer *,void>::Call(Timer * data) Line 111 vcllo.dll!Timer::Invoke() Line 75 vcllo.dll!Scheduler::CallbackTaskScheduling() Line 509 vcllo.dll!SalTimer::CallCallback() Line 53 vclplug_winlo.dll!WinSalTimer::ImplHandleElapsedTimer() Line 169 vclplug_winlo.dll!ImplSalYield(bool bWait, bool bHandleAllCurrentEvents) Line 525 vclplug_winlo.dll!WinSalInstance::DoYield(bool bWait, bool bHandleAllCurrentEvents) Line 581 vcllo.dll!ImplYield(bool i_bWait, bool i_bAllEvents) Line 385 vcllo.dll!Application::Yield() Line 473 vcllo.dll!Application::Execute() Line 361 sofficeapp.dll!desktop::Desktop::Main() Line 1652 vcllo.dll!ImplSVMain() Line 229 vcllo.dll!SVMain() Line 262 sofficeapp.dll!soffice_main() Line 110 soffice.bin!sal_main() Line 51 soffice.bin!main(int argc, char * * argv) Line 49 soffice.bin!invoke_main() Line 79 soffice.bin!__scrt_common_main_seh() Line 288 soffice.bin!__scrt_common_main() Line 331 soffice.bin!mainCRTStartup(void * __formal) Line 17 Change-Id: Iaf5133c488d4f26f43530ea19584e99cce12d81e Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171855 Tested-by: Jenkins Reviewed-by: Mike Kaganski <mike.kagan...@collabora.com> diff --git a/embeddedobj/source/inc/oleembobj.hxx b/embeddedobj/source/inc/oleembobj.hxx index 983f242308cf..e513c57085ce 100644 --- a/embeddedobj/source/inc/oleembobj.hxx +++ b/embeddedobj/source/inc/oleembobj.hxx @@ -217,7 +217,7 @@ protected: css::uno::Reference< css::io::XStream > GetNewFilledTempStream_Impl( const css::uno::Reference< css::io::XInputStream >& xInStream ); #ifdef _WIN32 - void SwitchComponentToRunningState_Impl(); + void SwitchComponentToRunningState_Impl(osl::ResettableMutexGuard& guard); #endif void MakeEventListenerNotification_Impl( const OUString& aEventName ); #ifdef _WIN32 @@ -231,7 +231,7 @@ protected: const css::uno::Sequence< css::embed::VerbDescriptor >& aVerbList ); #endif - void Dispose(); + void Dispose(osl::ResettableMutexGuard* guard = nullptr); void SwitchOwnPersistence( const css::uno::Reference< css::embed::XStorage >& xNewParentStorage, @@ -242,7 +242,7 @@ protected: const css::uno::Reference< css::embed::XStorage >& xNewParentStorage, const OUString& aNewName ); - void GetRidOfComponent(); + void GetRidOfComponent(osl::ResettableMutexGuard* guard); /// @throws css::uno::Exception void StoreToLocation_Impl( @@ -272,6 +272,7 @@ protected: css::uno::Reference< css::io::XStream > TryToRetrieveCachedVisualRepresentation_Impl( const css::uno::Reference< css::io::XStream >& xStream, + osl::ResettableMutexGuard& rGuard, bool bAllowRepair50 = false ) noexcept; #ifdef _WIN32 diff --git a/embeddedobj/source/msole/oleembed.cxx b/embeddedobj/source/msole/oleembed.cxx index 6593374ed772..9a5d41abfabc 100644 --- a/embeddedobj/source/msole/oleembed.cxx +++ b/embeddedobj/source/msole/oleembed.cxx @@ -66,7 +66,7 @@ using namespace ::com::sun::star; #ifdef _WIN32 -void OleEmbeddedObject::SwitchComponentToRunningState_Impl() +void OleEmbeddedObject::SwitchComponentToRunningState_Impl(osl::ResettableMutexGuard& guard) { if ( !m_pOleComponent ) { @@ -78,12 +78,12 @@ void OleEmbeddedObject::SwitchComponentToRunningState_Impl() } catch( const embed::UnreachableStateException& ) { - GetRidOfComponent(); + GetRidOfComponent(&guard); throw; } catch( const embed::WrongStateException& ) { - GetRidOfComponent(); + GetRidOfComponent(&guard); throw; } } @@ -515,7 +515,7 @@ void SAL_CALL OleEmbeddedObject::changeState( sal_Int32 nNewState ) // it can be created during loading to detect type of object CreateOleComponentAndLoad_Impl( m_pOleComponent ); - SwitchComponentToRunningState_Impl(); + SwitchComponentToRunningState_Impl(aGuard); m_nObjectState = embed::EmbedStates::RUNNING; aGuard.clear(); StateChangeNotification_Impl( false, nOldState, m_nObjectState ); diff --git a/embeddedobj/source/msole/olemisc.cxx b/embeddedobj/source/msole/olemisc.cxx index 4f50aedeba5f..ae4a292c37ce 100644 --- a/embeddedobj/source/msole/olemisc.cxx +++ b/embeddedobj/source/msole/olemisc.cxx @@ -221,7 +221,7 @@ void OleEmbeddedObject::StateChangeNotification_Impl( bool bBeforeChange, sal_In } #endif -void OleEmbeddedObject::GetRidOfComponent() +void OleEmbeddedObject::GetRidOfComponent(osl::ResettableMutexGuard* guard) { #ifdef _WIN32 if ( m_pOleComponent ) @@ -232,6 +232,9 @@ void OleEmbeddedObject::GetRidOfComponent() m_pOleComponent->removeCloseListener( m_xClosePreventer ); try { + std::optional<osl::ResettableMutexGuardScopedReleaser> oReleaser; + if (guard) + oReleaser.emplace(*guard); m_pOleComponent->close( false ); } catch( const uno::Exception& ) @@ -245,11 +248,13 @@ void OleEmbeddedObject::GetRidOfComponent() m_pOleComponent->disconnectEmbeddedObject(); m_pOleComponent.clear(); } +#else + (void)guard; #endif } -void OleEmbeddedObject::Dispose() +void OleEmbeddedObject::Dispose(osl::ResettableMutexGuard* guard) { if ( m_pInterfaceContainer ) { @@ -266,7 +271,7 @@ void OleEmbeddedObject::Dispose() if ( m_pOleComponent ) try { - GetRidOfComponent(); + GetRidOfComponent(guard); } catch( const uno::Exception& ) { m_bDisposed = true; @@ -449,7 +454,7 @@ void SAL_CALL OleEmbeddedObject::close( sal_Bool bDeliverOwnership ) } // end wrapping related part ==================== - ::osl::MutexGuard aGuard( m_aMutex ); + osl::ResettableMutexGuard aGuard(m_aMutex); if ( m_bDisposed ) throw lang::DisposedException(); // TODO @@ -495,7 +500,7 @@ void SAL_CALL OleEmbeddedObject::close( sal_Bool bDeliverOwnership ) } } - Dispose(); + Dispose(&aGuard); } diff --git a/embeddedobj/source/msole/olepersist.cxx b/embeddedobj/source/msole/olepersist.cxx index e6af72fedccf..f2f945d0ec24 100644 --- a/embeddedobj/source/msole/olepersist.cxx +++ b/embeddedobj/source/msole/olepersist.cxx @@ -594,6 +594,7 @@ bool OleEmbeddedObject::HasVisReplInStream() uno::Reference< io::XStream > OleEmbeddedObject::TryToRetrieveCachedVisualRepresentation_Impl( const uno::Reference< io::XStream >& xStream, + osl::ResettableMutexGuard& rGuard, bool bAllowToRepair50 ) noexcept { @@ -697,7 +698,7 @@ uno::Reference< io::XStream > OleEmbeddedObject::TryToRetrieveCachedVisualRepres #ifdef _WIN32 // retry to create the component after recovering - GetRidOfComponent(); + GetRidOfComponent(&rGuard); try { @@ -706,12 +707,12 @@ uno::Reference< io::XStream > OleEmbeddedObject::TryToRetrieveCachedVisualRepres } catch( const uno::Exception& ) { - GetRidOfComponent(); + GetRidOfComponent(&rGuard); } #endif } - xResult = TryToRetrieveCachedVisualRepresentation_Impl( xStream ); + xResult = TryToRetrieveCachedVisualRepresentation_Impl( xStream, rGuard ); } } } @@ -1173,7 +1174,7 @@ void OleEmbeddedObject::StoreToLocation_Impl( // is not changed by StoreTo action uno::Reference< io::XStream > xTmpCVRepresentation = - TryToRetrieveCachedVisualRepresentation_Impl( xTargetStream ); + TryToRetrieveCachedVisualRepresentation_Impl( xTargetStream, rGuard ); // the locally retrieved representation is always preferable if ( xTmpCVRepresentation.is() ) @@ -1204,7 +1205,7 @@ void OleEmbeddedObject::StoreToLocation_Impl( if ( bStoreVis ) { if ( !xCachedVisualRepresentation.is() ) - xCachedVisualRepresentation = TryToRetrieveCachedVisualRepresentation_Impl( xTargetStream ); + xCachedVisualRepresentation = TryToRetrieveCachedVisualRepresentation_Impl( xTargetStream, rGuard ); SAL_WARN_IF( !xCachedVisualRepresentation.is(), "embeddedobj.ole", "No representation is available!" ); @@ -1228,7 +1229,7 @@ void OleEmbeddedObject::StoreToLocation_Impl( { // the removed representation could be cached by this method if ( !xCachedVisualRepresentation.is() ) - xCachedVisualRepresentation = TryToRetrieveCachedVisualRepresentation_Impl( xTargetStream ); + xCachedVisualRepresentation = TryToRetrieveCachedVisualRepresentation_Impl( xTargetStream, rGuard ); if (!m_bStreamReadOnly) RemoveVisualCache_Impl(xTargetStream); @@ -1294,7 +1295,7 @@ void SAL_CALL OleEmbeddedObject::setPersistentEntry( // the only exception is object initialized from a stream, // the class ID will be detected from the stream - ::osl::MutexGuard aGuard( m_aMutex ); + osl::ResettableMutexGuard aGuard( m_aMutex ); if ( m_bDisposed ) throw lang::DisposedException(); // TODO @@ -1378,7 +1379,7 @@ void SAL_CALL OleEmbeddedObject::setPersistentEntry( { // TODO/LATER: detect classID of the object if possible // means that the object inprocess server could not be successfully instantiated - GetRidOfComponent(); + GetRidOfComponent(&aGuard); } m_nObjectState = embed::EmbedStates::LOADED; @@ -1753,14 +1754,14 @@ void SAL_CALL OleEmbeddedObject::storeOwn() InsertVisualCache_Impl( m_xObjectStream, m_xCachedVisualRepresentation ); else { - m_xCachedVisualRepresentation = TryToRetrieveCachedVisualRepresentation_Impl( m_xObjectStream ); + m_xCachedVisualRepresentation = TryToRetrieveCachedVisualRepresentation_Impl( m_xObjectStream, aGuard ); SAL_WARN_IF( !m_xCachedVisualRepresentation.is(), "embeddedobj.ole", "No representation is available!" ); } } else { if ( !m_xCachedVisualRepresentation.is() ) - m_xCachedVisualRepresentation = TryToRetrieveCachedVisualRepresentation_Impl( m_xObjectStream ); + m_xCachedVisualRepresentation = TryToRetrieveCachedVisualRepresentation_Impl( m_xObjectStream, aGuard ); RemoveVisualCache_Impl( m_xObjectStream ); } @@ -1875,7 +1876,7 @@ void SAL_CALL OleEmbeddedObject::breakLink( const uno::Reference< embed::XStorag } // end wrapping related part ==================== - ::osl::MutexGuard aGuard( m_aMutex ); + osl::ResettableMutexGuard aGuard( m_aMutex ); if ( m_bDisposed ) throw lang::DisposedException(); // TODO @@ -1927,7 +1928,7 @@ void SAL_CALL OleEmbeddedObject::breakLink( const uno::Reference< embed::XStorag } try { - GetRidOfComponent(); + GetRidOfComponent(&aGuard); } catch (const uno::Exception&) { diff --git a/embeddedobj/source/msole/olevisual.cxx b/embeddedobj/source/msole/olevisual.cxx index b5047d1036b6..075f02998257 100644 --- a/embeddedobj/source/msole/olevisual.cxx +++ b/embeddedobj/source/msole/olevisual.cxx @@ -346,7 +346,7 @@ embed::VisualRepresentation SAL_CALL OleEmbeddedObject::getPreferredVisualRepres if ( !m_xCachedVisualRepresentation.is() && ( !m_bVisReplInitialized || m_bVisReplInStream ) && m_nObjectState == embed::EmbedStates::LOADED ) { - m_xCachedVisualRepresentation = TryToRetrieveCachedVisualRepresentation_Impl( m_xObjectStream, true ); + m_xCachedVisualRepresentation = TryToRetrieveCachedVisualRepresentation_Impl( m_xObjectStream, aGuard, true ); SetVisReplInStream( m_xCachedVisualRepresentation.is() ); } @@ -388,7 +388,7 @@ embed::VisualRepresentation SAL_CALL OleEmbeddedObject::getPreferredVisualRepres // the cache is used only as a fallback if object is not in loaded state if ( !m_xCachedVisualRepresentation.is() && ( !m_bVisReplInitialized || m_bVisReplInStream ) ) { - m_xCachedVisualRepresentation = TryToRetrieveCachedVisualRepresentation_Impl( m_xObjectStream ); + m_xCachedVisualRepresentation = TryToRetrieveCachedVisualRepresentation_Impl( m_xObjectStream, aGuard ); SetVisReplInStream( m_xCachedVisualRepresentation.is() ); } commit 393d2b91abf488e3364bf7eb8c0db4236b7467c3 Author: Mike Kaganski <mike.kagan...@collabora.com> AuthorDate: Thu Apr 4 11:26:53 2024 +0500 Commit: Mike Kaganski <mike.kagan...@collabora.com> CommitDate: Mon Aug 26 12:20:40 2024 +0500 Introduce ResettableMutexGuardScopedReleaser And use it to guarantee reretting a guard, without having to do that explicitly in exception handlers. Change-Id: I4727cb5b7f37b25e203396957797d24a093e0797 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165775 Tested-by: Jenkins Reviewed-by: Mike Kaganski <mike.kagan...@collabora.com> diff --git a/desktop/source/deployment/registry/package/dp_package.cxx b/desktop/source/deployment/registry/package/dp_package.cxx index d5c1feeb4992..494ce437e1e9 100644 --- a/desktop/source/deployment/registry/package/dp_package.cxx +++ b/desktop/source/deployment/registry/package/dp_package.cxx @@ -808,14 +808,11 @@ void BackendImpl::PackageImpl::processPackage_( // can occur if the main thread calls isRegistered() on this // package or any of its parents. So, temporarily release // this package's mutex while registering the child package. - guard.clear(); + osl::ResettableMutexGuardScopedReleaser releaser(guard); xPackage->registerPackage( startup, xSubAbortChannel, xCmdEnv ); - guard.reset(); } catch (const Exception &) { - guard.reset(); - //We even try a rollback if the user cancelled the action (CommandAbortedException) //in order to prevent invalid database entries. Any exc( ::cppu::getCaughtException() ); @@ -866,10 +863,6 @@ void BackendImpl::PackageImpl::processPackage_( ::cppu::throwException(exc); } } - catch (...) { - guard.reset(); - throw; - } data.items.emplace_back(xPackage->getURL(), xPackage->getPackageType()->getMediaType()); diff --git a/include/osl/mutex.hxx b/include/osl/mutex.hxx index 481a2bb55002..ca75cc9fb2dc 100644 --- a/include/osl/mutex.hxx +++ b/include/osl/mutex.hxx @@ -252,9 +252,30 @@ namespace osl } }; +#ifdef LIBO_INTERNAL_ONLY + // A RAII helper to allow exception-safe scoped release of an acquired object + template<class ResettableGuard_t> + class ResettableGuardScopedReleaser + { + public: + ResettableGuardScopedReleaser(ResettableGuard_t& r) + : m_rResettableGuard(r) + { + m_rResettableGuard.clear(); + } + ~ResettableGuardScopedReleaser() { m_rResettableGuard.reset(); } + + private: + ResettableGuard_t& m_rResettableGuard; + }; +#endif + typedef Guard<Mutex> MutexGuard; typedef ClearableGuard<Mutex> ClearableMutexGuard; typedef ResettableGuard< Mutex > ResettableMutexGuard; +#ifdef LIBO_INTERNAL_ONLY + typedef ResettableGuardScopedReleaser<ResettableMutexGuard> ResettableMutexGuardScopedReleaser; +#endif } #endif // INCLUDED_OSL_MUTEX_HXX commit fd6520b7dd200a7c2322dfe5e148af5fc69f7d33 Author: Mike Kaganski <mike.kagan...@collabora.com> AuthorDate: Tue Aug 13 16:58:50 2024 +0500 Commit: Mike Kaganski <mike.kagan...@collabora.com> CommitDate: Mon Aug 26 12:20:40 2024 +0500 Handle possible exceptions in SwView::ImpSetVerb This reportedly may crash on unhandled exception, with the following stack: KernelBase.dll!00007ffaa227fabc() [External Code] emboleobj.dll!OleComponent::GetVerbList() Line 1013 at D:\lombeddedobj\source\msole\olecomponent.cxx(1013) emboleobj.dll!OleEmbeddedObject::getSupportedVerbs() Line 1000 at D:\lombeddedobj\source\msole\oleembed.cxx(1000) swlo.dll!SwView::ImpSetVerb(SelectionType nSelType) Line 162 at D:\lo\sw\source\uibase\uiviewiew.cxx(162) swlo.dll!SwView::SelectShell() Line 309 at D:\lo\sw\source\uibase\uiviewiew.cxx(309) swlo.dll!SwView::AttrChangedNotify(LinkParamNone * __formal) Line 574 at D:\lo\sw\source\uibase\uiviewiew.cxx(574) [Inline Frame] swlo.dll!Link<LinkParamNone *,void>::Call(LinkParamNone *) Line 111 at D:\lo\include ools\link.hxx(111) swlo.dll!SwCursorShell::CallChgLnk() Line 2903 at D:\lo\sw\source swlo.dll!SwRootFrame::EndAllAction() Line 1941 at D:\lo\sw\source swlo.dll!UnoActionContext::~UnoActionContext() Line 212 at D:\lo\sw\source swlo.dll!SwXFrame::setPropertyValue(const rtl::OUString & rPropertyName, const com::sun::star::uno::Any & _rValue) Line 1605 at D:\lo\sw\source mscx_uno.dll!`anonymous namespace'::cpp_call(bridges::cpp_uno::shared::UnoInterfaceProxy * pThis, bridges::cpp_uno::shared::VtableSlot aVtableSlot, _typelib_TypeDescriptionReference * pReturnTypeRef, long nParams, _typelib_MethodParameter * pParams, void * pUnoReturn, void * * pUnoArgs, _uno_Any * * ppUnoExc) Line 214 at D:\loridges\source mscx_uno.dll!unoInterfaceProxyDispatch(_uno_Interface * pUnoI, const _typelib_TypeDescription * pMemberTD, void * pReturn, void * * pArgs, _uno_Any * * ppException) Line 430 at D:\loridges\source binaryurplo.dll!binaryurp::IncomingRequest::execute_throw(binaryurp::BinaryAny * returnValue, std::vector<binaryurp::BinaryAny,std::allocator<binaryurp::BinaryAny> > * outArguments) Line 239 at D:\loinaryurp\source\incomingrequest.cxx(239) binaryurplo.dll!binaryurp::IncomingRequest::execute() Line 79 at D:\loinaryurp\source\incomingrequest.cxx(79) binaryurplo.dll!request(void * pThreadSpecificData) Line 84 at D:\loinaryurp\source eader.cxx(84) cppu3.dll!cppu_threadpool::JobQueue::enter(const void * nDisposeId, bool bReturnWhenNoJob) Line 101 at D:\lo cppu3.dll!cppu_threadpool::ORequestThread::run() Line 169 at D:\lo cppu3.dll!threadFunc(void * param) Line 190 at D:\lo\include\osl hread.hxx(190) sal3.dll!oslWorkerWrapperFunction(void * pData) Line 67 at D:\lo\sal\osl\w32 hread.cxx(67) Change-Id: Ifef15938c7986c4179d61cfa07973ad9b13d4ad4 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171823 Reviewed-by: Mike Kaganski <mike.kagan...@collabora.com> Tested-by: Jenkins diff --git a/sw/source/uibase/uiview/view.cxx b/sw/source/uibase/uiview/view.cxx index 2d46cd04f260..8ce6b27ea4e0 100644 --- a/sw/source/uibase/uiview/view.cxx +++ b/sw/source/uibase/uiview/view.cxx @@ -26,6 +26,7 @@ #include <stdlib.h> #include <hintids.hxx> +#include <comphelper/diagnose_ex.hxx> #include <comphelper/string.hxx> #include <comphelper/lok.hxx> #include <o3tl/any.hxx> @@ -150,7 +151,7 @@ SfxDispatcher &SwView::GetDispatcher() void SwView::ImpSetVerb( SelectionType nSelType ) { - bool bResetVerbs = m_bVerbsActive; + Sequence<embed::VerbDescriptor> newVerbs; if ( !GetViewFrame().GetFrame().IsInPlace() && (SelectionType::Ole|SelectionType::Graphic) & nSelType ) { @@ -159,16 +160,21 @@ void SwView::ImpSetVerb( SelectionType nSelType ) { if ( nSelType & SelectionType::Ole ) { - SetVerbs( GetWrtShell().GetOLEObject()->getSupportedVerbs() ); - m_bVerbsActive = true; - bResetVerbs = false; + try + { + newVerbs = GetWrtShell().GetOLEObject()->getSupportedVerbs(); + } + catch (css::uno::Exception&) + { + DBG_UNHANDLED_EXCEPTION("sw.ui", "Failed to retrieve supported verbs"); + } } } } - if ( bResetVerbs ) + if (m_bVerbsActive || newVerbs.hasElements()) { - SetVerbs( Sequence< embed::VerbDescriptor >() ); - m_bVerbsActive = false; + SetVerbs(newVerbs); + m_bVerbsActive = newVerbs.hasElements(); } }