(Upstream) lvtinydom: fix memory leaks

Direct leak of 128 byte(s) in 2 object(s) allocated from: 0 in operator new(unsigned long) (libasan.so.6+0xb0087) 1 in ldomNode::modify() lvtinydom.cpp:19148 2 in ldomNode::removeChild(unsigned int) lvtinydom.cpp:18643 3 in ldomNode::removeChildren(int, int) lvtinydom.cpp:5845 4 in ldomNode::autoboxChildren(int, int, bool) lvtinydom.cpp:5995 5 in ldomNode::initNodeRendMethod() lvtinydom.cpp:6842 6 in ldomElementWriter::onBodyExit() lvtinydom.cpp:7815 7 in ldomElementWriter::~ldomElementWriter() lvtinydom.cpp:7955 8 in ldomDocumentWriterFilter::popUpTo(ldomElementWriter*, unsigned short, int) lvtinydom.cpp:13895 9 in ldomDocumentWriterFilter::AutoOpenClosePop(int, unsigned short) lvtinydom.cpp:14126 10 in ldomDocumentWriterFilter::OnTagClose(char32_t const*, char32_t const*, bool) lvtinydom.cpp:14657 11 in LVXMLParser::Parse() lvxmlparser.cpp:278 Direct leak of 64 byte(s) in 1 object(s) allocated from: 0 in operator new(unsigned long) (libasan.so.6+0xb0087) 1 in ldomNode::modify() lvtinydom.cpp:19148 2 in ldomNode::insertChildElement(unsigned int, unsigned short, unsigned short) lvtinydom.cpp:18534 3 in ldomNode::autoboxChildren(int, int, bool) lvtinydom.cpp:5974 4 in ldomNode::initNodeRendMethod() lvtinydom.cpp:6842 5 in ldomElementWriter::onBodyExit() lvtinydom.cpp:7815 6 in ldomElementWriter::~ldomElementWriter() lvtinydom.cpp:7955 7 in ldomDocumentWriterFilter::popUpTo(ldomElementWriter*, unsigned short, int) lvtinydom.cpp:13895 8 in ldomDocumentWriterFilter::AutoOpenClosePop(int, unsigned short) lvtinydom.cpp:14126 9 in ldomDocumentWriterFilter::OnTagClose(char32_t const*, char32_t const*, bool) lvtinydom.cpp:14657 Direct leak of 64 byte(s) in 1 object(s) allocated from: 0 in operator new(unsigned long) (libasan.so.6+0xb0087) 1 in tinyNodeCollection::allocTinyElement(ldomNode*, unsigned short, unsigned short) lvtinydom.cpp:16424 2 in ldomNode::insertChildElement(unsigned int, unsigned short, unsigned short) lvtinydom.cpp:18538 3 in ldomNode::autoboxChildren(int, int, bool) lvtinydom.cpp:5974 4 in ldomNode::initNodeRendMethod() lvtinydom.cpp:6842 5 in ldomElementWriter::onBodyExit() lvtinydom.cpp:7815 6 in ldomElementWriter::~ldomElementWriter() lvtinydom.cpp:7955 7 in ldomDocumentWriterFilter::popUpTo(ldomElementWriter*, unsigned short, int) lvtinydom.cpp:13895 8 in ldomDocumentWriterFilter::AutoOpenClosePop(int, unsigned short) lvtinydom.cpp:14126 9 in ldomDocumentWriterFilter::OnTagClose(char32_t const*, char32_t const*, bool) lvtinydom.cpp:14657 10 in LVXMLParser::Parse() lvxmlparser.cpp:278 11 in LVHTMLParser::Parse() lvhtmlparser.cpp:157 Direct leak of 144 byte(s) in 2 object(s) allocated from: 0 in operator new(unsigned long) (libasan.so.6+0xb0087) 1 in CCRTable::LookupElem(ldomNode*, int, int) (cr3qt/cr3+0x1f6681a) 2 in CCRTable::LookupElem(ldomNode*, int, int) (cr3qt/cr3+0x1f65cb3) 3 in CCRTable::CCRTable(ldomNode*, int, bool, int, int, bool, bool, int, bool) lvrend.cpp:2243 4 in renderTable(LVRendPageContext&, ldomNode*, int, int, int, bool, int, int&, int, bool, bool, bool) lvrend.cpp:2276 5 in renderBlockElementEnhanced(FlowState*, ldomNode*, int, int, unsigned int) lvrend.cpp:7639 6 in renderBlockElementEnhanced(FlowState*, ldomNode*, int, int, unsigned int) lvrend.cpp:7860 7 in renderBlockElement(LVRendPageContext&, ldomNode*, int, int, int, int, int, int, int*, unsigned int) lvrend.cpp:8393 8 in renderBlockElement(LVRendPageContext&, ldomNode*, int, int, int, int, int, int, int*) lvrend.cpp:8409 9 in LVFormatter::measureText() lvtextfm.cpp:2045 10 in LVFormatter::processParagraph(int, int, bool) lvtextfm.cpp:3809 11 in LVFormatter::splitParagraphs() lvtextfm.cpp:4461 12 in LVFormatter::format() lvtextfm.cpp:4508 13 in LFormattedText::Format(unsigned short, unsigned short, int, int, int, bool, BlockFloatFootprint*) lvtextfm.cpp:4612 14 in ldomNode::renderFinalBlock(LVRef<LFormattedText>&, RenderRectAccessor*, int, BlockFloatFootprint*) lvtinydom.cpp:19074 15 in renderBlockElementEnhanced(FlowState*, ldomNode*, int, int, unsigned int) lvrend.cpp:8167 Indirect leak of 896 byte(s) in 28 object(s) allocated from: 0 in __interceptor_realloc (libasan.so.6+0xaea88) 1 in lxmlAttribute* cr_realloc<lxmlAttribute>(lxmlAttribute*, unsigned long) (cr3qt/cr3+0x1c890d6) 2 in ldomAttributeCollection::set(unsigned short, unsigned short, unsigned int) lvtinydom.cpp:3933 3 in ldomNode::setAttributeValue(unsigned short, unsigned short, char32_t const*) lvtinydom.cpp:17001 4 in fixupMathML mathml.cpp:2157 5 in fixupMathMLRecursive mathml.cpp:1737 6 in fixupMathMLRecursive mathml.cpp:1734 14 in fixupMathMLRecursive mathml.cpp:1734 15 in fixupMathMLMathElement(ldomNode*) mathml.cpp:1708 16 in ldomNode::initNodeRendMethod() lvtinydom.cpp:7777 17 in ldomElementWriter::onBodyExit() lvtinydom.cpp:7819 18 in ldomElementWriter::~ldomElementWriter() lvtinydom.cpp:7959
weijiuqiao · Jul 10, 2021 · 437c07f · 437c07f
1 parent aa843d1
commit 437c07f
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 1 deletion.
diff --git a/crengine/src/lvtinydom.cpp b/crengine/src/lvtinydom.cpp
@@ -6170,6 +6170,7 @@ int initTableRendMethods( ldomNode * enode, int state )
             first_unproper = -1;
             last_unproper = -1;
         }
+        child->persist();
     }
     // if ( state==0 ) {
     //     dumpRendMethods( enode, cs32("   ") );
@@ -7617,6 +7618,8 @@ void ldomNode::initNodeRendMethod()
             }
         }
     #endif
+
+    persist();
 }
 #endif
 
@@ -18623,6 +18626,7 @@ void ldomNode::moveItemsTo( ldomNode * destination, int startChildIndex, int end
         item->setParentNode(destination);
         destination->addChild( item->getDataIndex() );
     }
+    destination->persist();
     // TODO: renumber rest of children in necessary
 /*#ifdef _DEBUG
     if ( !_document->checkConsistency( false ) )

diff --git a/crengine/src/mathml.cpp b/crengine/src/mathml.cpp
@@ -1733,6 +1733,7 @@ static void fixupMathMLRecursive( ldomNode * node, bool is_in_script ) {
         }
     }
     fixupMathML( node, is_in_script );
+    node->persist();
     return;
         // If we would be inseting nodes in the upper tree, we might
         // want to use a non-recursive subtree walker

diff --git a/crengine/src/mathml_table_ext.h b/crengine/src/mathml_table_ext.h
@@ -75,7 +75,7 @@ void CCRTable::MathML_checkAndTweakTableElement() {
                     i++; // keep it in row1 as a filler for the missing cell at top right
                 }
                 else {
-                    row1->cells.remove(i); // remove it
+                    delete row1->cells.remove(i); // remove it
                 }
                 insert_at = 0; // next cells will be moved at start of rows
                 next_is_sup = false; // next is a sub