Bug 114427

macro:

Sub TestDeletingFrame3
	dim oAFrame
	'Globalscope.BasicLibraries.LoadLibrary("XrayTool")

	oAFrame = ThisComponent.DrawPages(1).NotesPage.GetByIndex(2)
	'xray oAFrame
	'oAFrame.release()
	oAFrame.String = ""
	oAFrame.Dispose 'crashes
End Sub

Created attachment 138397 [details]
presentation to test

Regression introduced by:

author	Luke Deller <luke@deller.id.au>	2013-04-28 07:06:11 +1000
committer	David Tardon <dtardon@redhat.com>	2013-04-28 11:52:12 +0000
commit 57082b1243e86694b72c5e4fad013bf207bfe81a (patch)
tree 2e461c166beecb5b569c966a2aeceb90995a4b85
parent 2094610175140023cf8f904f8506c189e36dec06 (diff)
fdo#60910: discard UNO shape object in SdrObject::SetPage
The creation of the UNO shape in SdrObject::getUnoShape is influenced
by pPage, so when the page changes we need to discard the cached UNO
shape so that a new one will be created with the new page.

This replaces my first shot at a fix for fdo#60910 which reinstated a
line to discard the custom shape engine (and consequently the UNO shape) in
SdrObjCustomShape::InvalidateRenderGeometry.  That worked but did more
discarding than was necessary.

Bisected with: bibisect-41max

Adding Cc: to Luke Deller

Created attachment 138403 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated yesterday, I could reproduce this.
I attached a bt with symbols

Let's increase priority since:
- it's on all platforms
- it's a crash
- it's a regression

BTW, I had to change this:
oAFrame = ThisComponent.DrawPages(1).NotesPage.GetByIndex(2)
to this:
oAFrame = ThisComponent.DrawPages(1).NotesPage.GetByIndex(1)

since it failed with an out of bounds.

(In reply to Julien Nabet from comment #6)
> BTW, I had to change this:
> oAFrame = ThisComponent.DrawPages(1).NotesPage.GetByIndex(2)
> to this:
> oAFrame = ThisComponent.DrawPages(1).NotesPage.GetByIndex(1)
> 
> since it failed with an out of bounds.

Ah, the orig version had a blue shape too on the notes page. Sorry for this mistake.

Solution that does not crash: use the remove method from the page:

(In reply to Cor Nouws from comment #1)

> 	oAFrame.Dispose 'crashes

oDrawPage.Remove(oAFrame)

I have a fix to make this not crash

Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=17838c9c4279ab3e7932d4f383a8b1696491e622

Resolves: tdf#114427 crash when basic used to dispose shape

It will be available in 6.2.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.

6.1 backport in gerrit

Hi Caolán,

I don't know if it's related but now I get a crash when closing LibreOffice in

Version: 6.2.0.0.alpha0+
Build ID: 1af7f19224f18e5025352339648db659575eae33
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: threaded

Steps:
1. Open attached document
2. Run


Sub TestDeletingFrame3
	dim oAFrame
	'Globalscope.BasicLibraries.LoadLibrary("XrayTool")

	oAFrame = ThisComponent.DrawPages(1).NotesPage.GetByIndex(1)
	'xray oAFrame
	'oAFrame.release()
	oAFrame.String = ""
	oAFrame.Dispose 'crashes
End Sub

3. Close macro editor
4. Close LibreOffice

seems I need to adjust that fix a bit then, no crash here but I can see the problem under valgrind. https://gerrit.libreoffice.org/#/c/59172/

Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=4f2b25c406b3e63b5d15bf90ad29abb3eb9041a1

tdf#114427 improve fix, wedo need to free it regardless

It will be available in 6.2.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.

Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-6-1":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=876a433607831f5c82bb952582c151ac653841e7&h=libreoffice-6-1

Resolves: tdf#114427 crash when basic used to dispose shape

It will be available in 6.1.1.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.

Verified in

Version: 6.2.0.0.alpha0+
Build ID: da7040510d5be27ad7b90ffb0c962535f3375358
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: threaded

@Caolán, Thanks for fixing this!!

Xisco Fauli committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/1994009b7d244a36314df56c6dafa6ce477c01ba

tdf#114427: sc_macros_test: Add unittest

It will be available in 7.1.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.