Bug 106424 - Crash in: SfxItemPool::Put(SfxPoolItem const &,unsigned short)
Summary: Crash in: SfxItemPool::Put(SfxPoolItem const &,unsigned short)
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
(earliest affected)
Hardware: x86 (IA32) Windows (All)
: medium normal
Assignee: Not Assigned
QA Contact:
Whiteboard: target:5.3.4 target:5.5.0 target:5.4.0
Depends on:
Reported: 2017-03-07 23:30 UTC by F. Toulmay
Modified: 2017-06-05 15:49 UTC (History)
5 users (show)

See Also:
Crash report or crash signature: ["SfxItemPool::Put(SfxPoolItem const &,unsigned short)"]

Copy of file when crashed Writer upon closing (338.76 KB, application/vnd.oasis.opendocument.text)
2017-03-08 07:37 UTC, F. Toulmay

Note You need to log in before you can comment on or make changes to this bug.
Description F. Toulmay 2017-03-07 23:30:03 UTC
This bug was filed from the crash reporting server and is br-17143bf4-0204-406e-861e-4884e962d48b.

LO crashes upon closing an odt document. This is a small document (8 pages) which contains however a lot of math formulas (Objects). There was no apparent problem with this file before closing. 
A copy of this file could aferwards be opened w/o problem and be saved.
I suspect LO not to accept too many formulas in a document, since I already had similar problems several years ago (with the French LO version at that time, which  I could resolve by re-installing the English version).

Comment 1 Xisco Faulí 2017-03-08 00:15:58 UTC
Thank you for reporting the bug. Please attach a sample document, as this makes it easier for us to verify the bug. 
I have set the bug's status to 'NEEDINFO'. Please change it back to 'UNCONFIRMED' once the requested document is provided.
(Please note that the attachment will be public, remove any sensitive information before attaching it. 
See https://wiki.documentfoundation.org/QA/FAQ#How_can_I_eliminate_confidential_data_from_a_sample_document.3F for help on how to do so.)

BTW, on which version do you reproduce the problem ?
Comment 2 F. Toulmay 2017-03-08 07:37:41 UTC
Created attachment 131745 [details]
Copy of file when crashed Writer upon closing

My LO version=
The crash occured only once with this file; can't be repeated.
Comment 3 Xisco Faulí 2017-03-08 09:32:49 UTC
To me, it seems like a duplicate of bug 104830 and you shouldn't be able to reproduce it in now. Probably you reproduced it in 5.2.4
In order to reproduce the crash in 5.2.4 you needed to copy something into the clipboard and then close LibreOffice...
Please, reopen it if you see the crash again.

*** This bug has been marked as a duplicate of bug 104830 ***
Comment 5 Xisco Faulí 2017-03-08 15:15:34 UTC
Hi JoNi,
thank you for investigating it.
Do you think of any way we can trigger the crash?
Comment 6 Jesse 2017-03-08 17:49:01 UTC
I was unaware of a crash until I restarted LO and got a crash report. I closed LO last night on a single document of less than two pages, and I put the laptop to sleep (possibly "hibernate") overnight. The crash document had only ordinary text in a 3-column table of 3x31 cells. When I started LO this morning, the crash reporter sent me here. I have not reproduced the crash. Copying or cutting text to the clipboard, with with or without modification of the document, and either closing LO or closing the document first and then quitting LO, does not reproduce it.
Comment 7 JoNi 2017-03-12 17:06:26 UTC
(In reply to Xisco Faulí from comment #5)
> Do you think of any way we can trigger the crash?

sadly no, the code from bug 85651, comment 4 looks like a reproducer but I don't have the tools for that.

An other approach would be to remove said hack and see if we still leak like the comment claimed 15 years ago. sadly the bug report in the commit line is lost too.

removing the lines, writer still worked as expected and unit test passed.
Comment 8 Xisco Faulí 2017-05-24 21:03:29 UTC
A patch has been pushed to https://cgit.freedesktop.org/libreoffice/core/commit/?id=6d51bb3d54ac52e4870bd00a21fce3a3b1c5010b
However, it hasn't been communicated...
Comment 9 Commit Notification 2017-05-25 19:42:11 UTC
Jochen Nitschke committed a patch related to this issue.
It has been pushed to "libreoffice-5-3":


tdf#106424 fix crash in SfxItemPool::Put

It will be available in 5.3.4.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:

Affected users are encouraged to test the fix and report feedback.
Comment 10 Julien Nabet 2017-06-05 15:49:05 UTC
Following Jochen's patch, let's put this one to FIXED

F. Toulmay: don't hesitate to reopen this tracker if you still reproduce this with future 5.3.4