Bug 153486

Summary:	Crash with SmartArt shapes and Development Tools
Product:	LibreOffice	Reporter:	Regina Henschel <rb.henschel>
Component:	Writer	Assignee:	Not Assigned <libreoffice-bugs>
Status:	RESOLVED FIXED
Severity:	critical	CC:	aron.budea, noelgrandin, serval2412, stephane.guillou
Priority:	medium	Keywords:	haveBacktrace
Version:	7.5.2.2 release
Hardware:	x86-64 (AMD64)
OS:	All
See Also:	https://bugs.documentfoundation.org/show_bug.cgi?id=143640 https://bugs.documentfoundation.org/show_bug.cgi?id=154827 https://bugs.documentfoundation.org/show_bug.cgi?id=154428
Whiteboard:	target:7.6.0 target:7.5.3.2
Crash report or crash signature:		Regression By:
Bug Depends on:
Bug Blocks:	106547, 141420
Attachments:	SmartArt minidump backtrace at failed file load gdb bt

Description Regina Henschel 2023-02-09 00:50:31 UTC

Created attachment 185244 [details]
SmartArt

Enable "SmartArt to LibreOffice Shapes or reverse" in Tools > Options > Load/Save > Microsoft Office.
Open attached document. It contains a simple SmartArt object.
Ungroup the SmartArt object. You get the two colored rectangles and a third rectangle for the SmartArt background.
Open Development Tools and select "Current Selection"
Click on one of the colored rectangles to select it.
In the Development Tools chose tab "Properties".
Click on the + to open the shape properties => Crash.

LibreOffice does not send a crash report.

I see the problem in Version: 7.6.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 9d44236a62bf59d120dda89924d0d1407b2bd52b
CPU threads: 8; OS: Windows 10.0 Build 19045; UI render: Skia/Raster; VCL: win
Locale: en-US (en_US); UI: en-US
Calc: CL threaded

Comment 1 Stéphane Guillou (stragu) 2023-02-09 15:29:28 UTC

Thanks, Regina!
Repro in:

Version: 7.6.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: d8ae6d1388f28c405c4de2dfe93dbfe2d8acd470
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: threaded

Crash reporter is stuck after clicking "send crash report".

In the console, I get:

warn:legacy.osl:61159:61159:svx/source/unodraw/unoshape.cxx:1873: SvxShape::GetAnyForItem() Returnvalue has wrong Type!

Comment 2 Stéphane Guillou (stragu) 2023-02-09 15:42:40 UTC

Created attachment 185266 [details]
minidump

Comment 3 Stéphane Guillou (stragu) 2023-02-09 15:47:10 UTC

Created attachment 185267 [details]
backtrace at failed file load

Using --backtrace on a debug build, LO crashes earlier, on file load. This is the resulting backtrace.

Debug build details:

Version: 7.6.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 5cd3a8ec6d36a389eb0be4d59f4570e3bda92dc5
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: threaded

Comment 4 Julien Nabet 2023-02-09 20:48:25 UTC

Created attachment 185271 [details]
gdb bt

On pc Debian x86-64 with master sources updated today, I could reproduce this.

I also noticed these logs:
warn:legacy.osl:4682:4682:svx/source/unodraw/unoshape.cxx:1873: SvxShape::GetAnyForItem() Returnvalue has wrong Type!
warn:legacy.osl:4682:4682:svx/source/unodraw/unoshape.cxx:1873: SvxShape::GetAnyForItem() Returnvalue has wrong Type!
warn:legacy.osl:4682:4682:svx/source/unodraw/unoshape.cxx:1873: SvxShape::GetAnyForItem() Returnvalue has wrong Type!
warn:legacy.osl:4682:4682:svx/source/unodraw/unoshape.cxx:1873: SvxShape::GetAnyForItem() Returnvalue has wrong Type!

Comment 5 Hossein 2023-08-04 02:32:18 UTC

I no longer reproduce this problem with the latest LO 24.2 dev master:

Version: 24.2.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 2b0b4ddc8bd8fdd4cd689300620fe4621d7533b7
CPU threads: 20; OS: Windows 10.0 Build 22621; UI render: Skia/Vulkan; VCL: win
Locale: en-US (en_DE); UI: en-US
Calc: CL threaded

Might be a duplicate of tdf#143640, which is also no longer reproducible.

Comment 6 Stéphane Guillou (stragu) 2023-08-04 09:27:46 UTC

No crash either with:

Version: 7.6.0.2 (X86_64) / LibreOffice Community
Build ID: 41d6f628ba3f046f16b5fa9fa8db8d4c2ab3b582
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: threaded

Fix bibisected to Noel's 40babcfa637957bf7b59caa3cd12a630189e3e63 (which is 964594f07272039d0787c8334b84efc38cf20dc2 in the linux-64-7.6 bibisect repo):

"tdf#154827 and tdf#154428 graphics anchored in Writer as character become anchored at paragraph when reopening the document"

Thanks Noel, Regina, et al.! Marking as fixed and populating the targets (I could reproduce the crash in 7.5.2)

(Couldn't test if the fix was the same for bug 143640.)