Bug 107142 - FILEOPEN crash on opening svg-result of slide export
Summary: FILEOPEN crash on opening svg-result of slide export
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: LibreOffice (show other bugs)
Version:
(earliest affected)
5.4.0.0.alpha0+
Hardware: x86 (IA32) Windows (All)
: highest critical
Assignee: Not Assigned
URL:
Whiteboard: target:5.4.0
Keywords: bibisectRequest, haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2017-04-13 13:39 UTC by Regina Henschel
Modified: 2017-05-09 10:04 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:


Attachments
File makes LO crash on File > Open (386.98 KB, image/svg+xml)
2017-04-13 13:39 UTC, Regina Henschel
Details
Source for export (13.85 KB, application/vnd.oasis.opendocument.presentation)
2017-04-13 13:40 UTC, Regina Henschel
Details
Backtrace (12.29 KB, text/plain)
2017-04-20 14:33 UTC, Aron Budea
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Regina Henschel 2017-04-13 13:39:43 UTC
Created attachment 132539 [details]
File makes LO crash on File > Open

I have used the attached file SourceOfExport.odp. I select both slides in the slide pane. The goto File>Export. Do _not_ check "selection" and export to svg format. I get the attached file ResultOfExport.svg. Close document.
Goto File>Open and open the just product file. LO crashes immediately.

I have used Version: 5.4.0.0.alpha0+
Build ID: 0ba23e36bb81b65360f3279f5af14a63916189f6
CPU threads: 4; OS: Windows 6.1; UI render: default; 
TinderBox: Win-x86@42, Branch:master, Time: 2017-03-31_00:23:32
Locale: de-DE (de_DE); Calc: group
Comment 1 Regina Henschel 2017-04-13 13:40:46 UTC
Created attachment 132540 [details]
Source for export
Comment 2 Xisco Faulí 2017-04-13 14:05:08 UTC
I can't reproduce it in

Version: 5.4.0.0.alpha0+
Build ID: 7635e0c1c7f821a1081f8e3868f641ae74a172d6
CPU threads: 4; OS: Linux 4.8; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group

nor

Versión: 5.3.2.2
Id. de compilación: 6cd4f1ef626f15116896b1d8e1398b56da0d0ee1
Subproc. CPU: 1; SO: Windows 6.1; Repr. de IU: predet.; Motor de trazado: HarfBuzz; 
Configuración regional: es-ES (es_ES); Calc: group

but I do in

Version: 5.4.0.0.alpha0+
Build ID: 156f778593ca9c57845076a88c6b544a63e12e7a
CPU threads: 1; OS: Windows 6.1; UI render: default; 
TinderBox: Win-x86@42, Branch:master, Time: 2017-04-05_06:30:54
Locale: es-ES (es_ES); Calc: group
Comment 3 Regina Henschel 2017-04-13 16:14:49 UTC
With Version: 5.4.0.0.alpha0+
Build ID: c2850bab4f7e5700151a18d806268f2b86a25d56
CPU Threads: 4; OS Version: Windows 6.1; UI Render: default; 
TinderBox: Win-x86@39, Branch:master, Time: 2017-01-24_03:10:33
Locale: de-DE (de_DE); Calc: group


I get this "Assertion failed!":
Program: ..\program\svgfilterlo.dll
File:C:\cygwin\home\tinderbox\master\include\c.../Reference.h
Line:411

Expression: _pInterface != NULL
Comment 4 Aron Budea 2017-04-16 03:43:36 UTC
Bibisection pointed to a huge range of ~850 commits (builds failed inside that range):
https://cgit.freedesktop.org/libreoffice/core/log/?qt=range&q=aabc5aab5af27e929a81a6036d2f470ab1f5ac4d..3e973760b788c49396c7a18404bffa0505e65a04
Comment 5 Julien Nabet 2017-04-16 16:31:07 UTC
On pc Debian x86-64 with master sources updated today, I don't reproduce this (with gtk3 or gen rendering)
Could someone attach a bt?
Comment 6 Aron Budea 2017-04-20 14:33:17 UTC
Created attachment 132714 [details]
Backtrace

If WinDbg is correct, this is where it dies:

const sal_Int32 nFooNumAttrs(xParentAttributes->getLength());
http://opengrok.libreoffice.org/xref/core/filter/source/svg/svgreader.cxx#200

Attaching backtrace.
Comment 7 Aron Budea 2017-04-20 14:35:37 UTC
Build used (dbgutil):

Version: 5.4.0.0.alpha0+
Build ID: 5f282c101a644ffc3615c3dc43ddb99febecae16
CPU threads: 4; OS: Windows 6.1; UI render: GL; 
Locale: hu-HU (hu_HU); Calc: CL
Comment 8 Julien Nabet 2017-04-24 21:11:44 UTC
Is IsAncestorId called recursively?
I wonder if a safeguard doesn't lack in this function.
I mean shouldn't we change the test if (!bSelfCycle)
(see http://opengrok.libreoffice.org/xref/core/filter/source/svg/svgreader.cxx#213) by something like:
if (!bSelfCycle && xParentNode->getParentNode() != xParentNode)
?
Comment 9 Xisco Faulí 2017-04-28 12:35:01 UTC
Patch submitted to gerrit -> https://gerrit.libreoffice.org/#/c/37070/
Comment 10 Commit Notification 2017-04-28 21:01:18 UTC
Takeshi Abe committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=843f633c842f8540c42613cea78c5f66b262051a

tdf#107142 Fix crash when opening SVG with <use>

It will be available in 5.4.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 11 Xisco Faulí 2017-05-09 10:04:36 UTC
I can no longer reproduce it in

Version: 5.4.0.0.alpha1+
Build ID: 9d320ec4d818f86e58a15fd46248026502b1cc94
CPU threads: 1; OS: Windows 6.1; UI render: default; 
TinderBox: Win-x86@62-TDF, Branch:MASTER, Time: 2017-05-09_01:27:12
Locale: es-ES (es_ES); Calc: group