Bug 107350 - Examining a Writer Table object crashes LibreOffice ( steps in comment 6 )
Summary: Examining a Writer Table object crashes LibreOffice ( steps in comment 6 )
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: BASIC (show other bugs)
Version:
(earliest affected)
5.3.2.2 release
Hardware: All All
: highest critical
Assignee: LeMoyne Castle
QA Contact:
URL:
Whiteboard: target:5.4.0 target:5.3.4
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2017-04-22 09:26 UTC by Jean-Francois Nifenecker
Modified: 2017-07-10 15:34 UTC (History)
3 users (show)

See Also:
Crash report or crash signature: ["SwXCellRange::getData()"]


Attachments
A test for demonstration (11.90 KB, application/vnd.oasis.opendocument.text)
2017-04-22 09:26 UTC, Jean-Francois Nifenecker
Details
backtrace (101.16 KB, text/x-log)
2017-04-22 19:51 UTC, Xisco Faulí
Details
backtrace (37.11 KB, text/plain)
2017-04-26 12:21 UTC, Xisco Faulí
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Jean-Francois Nifenecker 2017-04-22 09:26:16 UTC
Created attachment 132747 [details]
A test for demonstration

When (trying to) examining a Table object within the IDE causes LibreOffice to crash.

Using the attachment, just F7 in the IDE on the lo_Table object and try to examine its contents. Crash.

Note: the xray tool crashes as well when trying to examine the same object.

Found under 5.2.x, exists under current 5.3.2.2

Debian GNU/Linux 8 (jessie)
Kernel 3.16.0-4-amd64
LibreOffice (64b) Version: 5.3.2.2
Build ID: 6cd4f1ef626f15116896b1d8e1398b56da0d0ee1
Comment 1 Regis Perdreau 2017-04-22 10:46:51 UTC
I have confirmed it


Version: 5.2.2.2
Build ID: 1:5.2.2-0ubuntu2
Threads CPU : 4; Version de l'OS :Linux 4.8; UI Render : par défaut; 
Locale : fr-FR (fr_FR.UTF-8); Calc: group
Comment 2 Jean-Francois Nifenecker 2017-04-22 11:24:11 UTC
Tested under :
WinXP sp3 + LibO 5.0.2
Win7 64b + LibO 5.2.2

Both crash as well.
Comment 3 Jean-Francois Nifenecker 2017-04-22 11:34:17 UTC
Another test under Win 7 (64b) + LibO 4.3.7.2

Works fine. No crash.
Comment 4 Rpnpif 2017-04-22 13:59:23 UTC
Clicking on the left arrow which is front of the io_Table variable crashes LO.

gdb :
Thread 1 "soffice.bin" received signal SIGSEGV, Segmentation fault.
0x00007fffcd120b6c in SwXCellRange::getData() ()
   from /opt/libreoffice5.3/program/../program/libswlo.so

On Debian Jessie-backports.

Regards.
Comment 5 Xisco Faulí 2017-04-22 19:42:04 UTC
Regression introduced by:

author	Bjoern Michaelsen <bjoern.michaelsen@canonical.com>	2015-04-11 00:37:45 (GMT)
committer	Bjoern Michaelsen <bjoern.michaelsen@canonical.com>	2015-04-13 15:21:30 (GMT)
commit	b845d236f530327610a6f69b0126c63693028e84 (patch)
tree	721a9e92c0e8efe99b78ead06083e94e995c1a86
parent	d7b6b1dc1d21dd3925798954a59508a40a700cfd (diff)
use getCells()

Bisected with bibisect-50max

Adding Cc: to Bjoern Michaelsen
Comment 6 Xisco Faulí 2017-04-22 19:49:55 UTC
Steps to reproduce:
1. Open the document
2. Place the cursor in the first cell of the table
3. Tools - Macros - Edit Macros
4. Select testTableWriter_bug.odt - Standard - Module 1 on the left panel
5. Highlight lo_Table and press F7
6. Press Shift + F8 5 times
7. In the bottom panel, click on the arrow next to lo_Table
Comment 7 Xisco Faulí 2017-04-22 19:51:23 UTC
Created attachment 132754 [details]
backtrace
Comment 8 Xisco Faulí 2017-04-26 12:21:53 UTC
Created attachment 132860 [details]
backtrace
Comment 9 LeMoyne Castle 2017-04-26 19:52:07 UTC
Submitted a crash prevention patch 
https://gerrit.libreoffice.org/37002

Gets past crash point - can examine table object in Watch. 

Not returning any data, but trying to ignore that deficiency and read the Data array is trapped as either a Basic error (grab array ref) or as basic+uno error (reading .Data(0) => runtime exception w/no msg).  

The no data from complex tables behavior is inherited from OOo: 
a separate enhancement issue.
Comment 10 Commit Notification 2017-04-28 23:12:43 UTC
LeMoyne Castle committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=eea79562f1a5785a8a22cde732a091725e46bbad

tdf#107350 - prevent crash in unotbl.cxx

It will be available in 5.4.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 11 Xisco Faulí 2017-05-04 14:56:20 UTC
Verified in

Version: 5.4.0.0.alpha1+
Build ID: f12096272e684ddcd8ffa4e34dcb0a680cc594c2
CPU threads: 4; OS: Linux 4.8; UI render: default; VCL: gtk2; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group
Comment 12 Commit Notification 2017-05-04 20:43:22 UTC
LeMoyne Castle committed a patch related to this issue.
It has been pushed to "libreoffice-5-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=066cd52857ad9c2494c584bc36b38fc34836d10f&h=libreoffice-5-3

tdf#107350 - prevent crash in unotbl.cxx

It will be available in 5.3.4.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.