Ticket #15186 (closed defect: fixed)
Undoing a particular series of wxRichTextTable column changes reproducibly segfaults
|Reported by:||dghart||Owned by:|
|Keywords:||wxRichTextTable undo crash||Cc:|
The preceding wxRichTextTable patch series made it possible to undo and redo adding/deleting columns and rows to a table. In normal use this works reliably. However the following scenario (shown in the attached patch to the richtext sample) reliably segfaults:
Create a table with e.g. 1 cell. In that cell create another 1-cell table. Add a column (or row) to the inner table. Now delete the containing column of the original table.
Undo the column deletion. Now undoing the inner-table column addition will crash in wxRichTextCtrl::LayoutContent.
Though the details vary with the precise situation, the immediate cause of the crash is accessing an object with an invalid refcount. This object is the parent paragraph of the inner table, which should still exist.
This only happens with a child table; and only when undoing something in it, so swapping old-for-new table objects. Failed fix attempts include storing the parent paragraph in the wxRichTextAction instead of the table itself; parking it in m_newParagraphs; and altering or removing the InvalidateHierarchy() call.