| Summary: | Crash when changing formatting (e.g. font) inside Text Box Form Control | ||
|---|---|---|---|
| Product: | LibreOffice | Reporter: | Stéphane Guillou (stragu) <stephane.guillou> |
| Component: | Writer | Assignee: | Armin Le Grand <Armin.Le.Grand> |
| Status: | VERIFIED FIXED | ||
| Severity: | critical | CC: | Armin.Le.Grand, serval2412, telesto |
| Priority: | medium | Keywords: | bibisected, bisected, haveBacktrace, regression |
| Version: | 24.2.0.0 alpha0+ | ||
| Hardware: | x86-64 (AMD64) | ||
| OS: | All | ||
| See Also: |
https://bugs.documentfoundation.org/show_bug.cgi?id=160907 https://bugs.documentfoundation.org/show_bug.cgi?id=107092 |
||
| Whiteboard: | target:24.8.0 target:24.2.4 | ||
| Crash report or crash signature: | ["SfxEnumItem<FontWeight>::operator==(SfxPoolItem const &)","SfxEnumItem<FontItalic>::operator==(SfxPoolItem const &)","libmergedlo.so","mergedlo.dll"] | Regression By: | |
| Bug Depends on: | |||
| Bug Blocks: | 107742, 133092 | ||
| Attachments: | bt with debug symbols | ||
|
Description
Stéphane Guillou (stragu)
2024-05-02 11:34:15 UTC
( still reproduced in recent trunk build, of course: Version: 24.8.0.0.alpha0+ (X86_64) / LibreOffice Community Build ID: ce454f382d0d005dd3de021c7820be3ffa0bb582 CPU threads: 8; OS: Linux 6.5; UI render: default; VCL: gtk3 Locale: en-AU (en_AU.UTF-8); UI: en-US Calc: CL threaded ) Created attachment 193940 [details]
bt with debug symbols
On pc Debian x86-64 with master sources updated today, I could reproduce this.
Taking a look... Yes, typical use of deleted Item: In OParametrizedAttributeDispatcher::convertDispatchArgsToItem a SfxPoolItem* is returned. It gets fetched from a local temporary SfxAllItemSet aParameterSet. Of course when the ItemSet gets destroyed, the Item gets destroyed -> a deleted Item is returned. For that cases we nowadays have SfxPoolItemHolder, so have to change it to use that... NOTE: I checked forms/source/richtext/parametrizedattributedispatcher.cxx and OParametrizedAttributeDispatcher::convertDispatchArgsToItem, but it was always done that way -> former versions just 'survived' working with that deleted Item as it seems... Armin Le Grand (allotropia) committed a patch related to this issue. It has been pushed to "master": https://git.libreoffice.org/core/commit/24d78fcb5399b2c783ab7908263a1b54bb687a22 tdf#160906 use SfxPoolItemHolder It will be available in 24.8.0. The patch should be included in the daily builds available at https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: https://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback. Verified in: Version: 24.8.0.0.alpha0+ (X86_64) / LibreOffice Community Build ID: ad1f0bdeac30fca1dc56a08803ef23f2aca4db05 CPU threads: 8; OS: Linux 6.5; UI render: default; VCL: gtk3 Locale: en-AU (en_AU.UTF-8); UI: en-US Calc: CL threaded Thanks Armin! Armin Le Grand (allotropia) committed a patch related to this issue. It has been pushed to "libreoffice-24-2": https://git.libreoffice.org/core/commit/01bdb97829d103d06175fb50746ddeefddbaa3b3 tdf#160906 use SfxPoolItemHolder It will be available in 24.2.4. The patch should be included in the daily builds available at https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: https://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback. |