Bug 108881

Summary: Crash in: SfxItemPool::IsInRange(unsigned short)
Product: LibreOffice Reporter: Telesto <telesto>
Component: CalcAssignee: Dennis Francis <dennisfrancis.in>
Status: VERIFIED FIXED    
Severity: critical CC: kohei, raal, xiscofauli
Priority: highest Keywords: bibisected, bisected, haveBacktrace, regression
Version: 4.0.0.3 release   
Hardware: All   
OS: All   
See Also: https://bugs.documentfoundation.org/show_bug.cgi?id=58562
https://bugs.documentfoundation.org/show_bug.cgi?id=58988
Whiteboard: target:6.0.0 target:5.4.1
Crash report or crash signature: ["SfxItemPool::IsInRange(unsigned short)"] Regression By:
Attachments: Example file
gdb backtrace

Description Telesto 2017-06-30 20:38:38 UTC
Created attachment 134418 [details]
Example file

This bug was filed from the crash reporting server and is br-8171aa54-683d-4660-9cf3-f901e0c96d75.
=========================================

Steps to reproduce
1. Open the attached file
2. Cut the Ole Chart object
3. Close the Calc document (gray cross). No saving.
4. Open Calc from start center
5. Paste the Ole object -> Crash
Comment 1 Telesto 2017-06-30 20:43:18 UTC
It also crashes when pasting to Writer instead of Calc -> Crash report differs a bit
Comment 2 raal 2017-07-01 07:47:11 UTC
repro with LO 6, linux. Regression.
Comment 3 Eike Rathke 2017-07-03 12:02:17 UTC
The draw object's SfxItemPool::pImpl is invalid when pasting.

Already crashes in 5.1.5 (earliest I have), I somewhat doubt this is a regression.
Comment 4 Telesto 2017-07-03 15:12:27 UTC
Repro with:
Versie 4.0.0.3 (Bouw-id: 7545bee9c2a0782548772a21bc84a9dcc583b89)

but not with:
LibreOffice 3.5.7.2 
Build ID: 3215f89-f603614-ab984f2-7348103-1225a5b
Comment 5 raal 2017-07-03 17:21:25 UTC
This seems to have begun at the below commit.
Adding Cc: to Kohei Yoshida ; Could you possibly take a look at this one?
Thanks


commit 36d197c0646cd054145c7edcd7fb906b13c610a8
Author: Matthew Francis <mjay.francis@gmail.com>
Date:   Fri Sep 18 10:21:27 2015 +0800

    source-hash-c55d52262ea1d5f869a9528fd051ee19e687f1cc
    
    commit c55d52262ea1d5f869a9528fd051ee19e687f1cc
    Author:     Kohei Yoshida <kohei.yoshida@gmail.com>
    AuthorDate: Fri Jan 18 14:36:33 2013 -0500
    Commit:     Kohei Yoshida <kohei.yoshida@gmail.com>
    CommitDate: Fri Jan 18 14:41:42 2013 -0500
    
        fdo#58988, fdo#58562: Populate draw clip document with data for charts.
    
        Without populating the clip document, copying a chart (or charts) into
        clipboard makes the charts lose all their referenced data, which causes
        the pasted chart to appear empty.
    
        Change-Id: I3675f76baed19b48cec403964c19df00725a044b
Comment 6 raal 2017-07-03 17:32:01 UTC
*** Bug 108887 has been marked as a duplicate of this bug. ***
Comment 7 Buovjaga 2017-07-03 17:56:15 UTC
*** Bug 108886 has been marked as a duplicate of this bug. ***
Comment 8 Xisco Faulí 2017-07-04 09:38:02 UTC
*** Bug 108930 has been marked as a duplicate of this bug. ***
Comment 9 Xisco Faulí 2017-07-05 11:04:17 UTC
Created attachment 134491 [details]
gdb backtrace
Comment 10 Michael Meeks 2017-07-19 10:26:15 UTC
Fix in gerrit awaiting review: https://gerrit.libreoffice.org/#/c/40057/ =)
Comment 11 Commit Notification 2017-07-19 18:08:32 UTC
Dennis Francis committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=4d783c45062d030d278c076d7817b9589fa77d91

tdf#108881 : do not assume that chart objects always...

It will be available in 6.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 12 Commit Notification 2017-07-19 19:01:25 UTC
Dennis Francis committed a patch related to this issue.
It has been pushed to "libreoffice-5-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=013cc39448b00a450d040ddc8828aa9ab3004e3d&h=libreoffice-5-4

tdf#108881 : do not assume that chart objects always...

It will be available in 5.4.1.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 13 Telesto 2017-07-20 08:23:33 UTC
I can confirm the fix is working with:
Version: 6.0.0.0.alpha0+
Build ID: b8e26ebe2c37640212ef663a483cddf1639af742
CPU threads: 4; OS: Windows 6.19; UI render: default; 
TinderBox: Win-x86@39, Branch:master, Time: 2017-07-20_07:15:12
Locale: nl-NL (nl_NL); Calc: CL

However, bug 108887 (marked as dupe of this one) still exists.
Comment 14 Xisco Faulí 2017-07-20 08:25:26 UTC
Hi Telesto,
Thanks for verifying this one.
Please, go ahead and reopen the other one.