Bug 107959 - Crash in: SfxItemSet::Get(unsigned short,bool)
Summary: Crash in: SfxItemSet::Get(unsigned short,bool)
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Draw (show other bugs)
Version:
(earliest affected)
5.2.0.0.alpha1
Hardware: All All
: medium normal
Assignee: Caolán McNamara
QA Contact:
URL:
Whiteboard: target:5.5.0 target:5.4.0.1 target:5.3.5
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2017-05-19 17:31 UTC by Regina Henschel
Modified: 2017-06-30 16:17 UTC (History)
5 users (show)

See Also:
Crash report or crash signature: ["SfxItemSet::Get(unsigned short,bool)"]


Attachments
File with linked image and the image itself (98.40 KB, application/zip)
2017-05-19 17:31 UTC, Regina Henschel
Details
backtrace (27.44 KB, text/plain)
2017-05-20 11:21 UTC, Xisco Faulí
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Regina Henschel 2017-05-19 17:31:05 UTC
Created attachment 133406 [details]
File with linked image and the image itself

This bug was filed from the crash reporting server and is br-f1b9bf5b-e601-4792-9e9e-5737b7abd247..
=========================================

Open attached archive. Open file "Target.odg". It contains a linked image. Click the image and use the tool "Color Replacer" to change the White parts in the image to transparent. You get a message, whether you want to unlink the image. Click yes. Close color replacer. Close document. Crash.
Comment 1 Regina Henschel 2017-05-19 17:34:43 UTC
BTW: Unlinking does not work. The image keeps linked.
Comment 2 Telesto 2017-05-19 17:47:19 UTC
Repro with:
Version: 5.5.0.0.alpha0+
Build ID: d57e6cd9dcc96112994ca2b14ac45896e86b26e5
CPU threads: 4; OS: Windows 6.19; UI render: default; 
TinderBox: Win-x86@42, Branch:master, Time: 2017-05-18_22:43:07
Locale: nl-NL (nl_NL); Calc: CL
Comment 3 Xisco Faulí 2017-05-20 11:15:54 UTC
Reproduced in

Version: 5.4.0.0.alpha1+
Build ID: 74d2e606fd3605fe0a585f596eaa215ae4e20d18
CPU Threads: 4; OS Version: Linux 4.8; UI Render: default; VCL: gtk3; 
Locale: en-US (ca_ES.UTF-8); Calc: group

and

Version: 5.2.0.0.alpha1+
Build ID: 5b168b3fa568e48e795234dc5fa454bf24c9805e
CPU Threads: 4; OS Version: Linux 4.8; UI Render: default; 
Locale: ca-ES (ca_ES.UTF-8)

but not in

Version: 5.0.0.0.alpha1+
Build ID: 0db96caf0fcce09b87621c11b584a6d81cc7df86
Locale: ca-ES (ca_ES.UTF-8)
Comment 4 Xisco Faulí 2017-05-20 11:21:52 UTC
Created attachment 133418 [details]
backtrace
Comment 6 Julien Nabet 2017-05-20 17:41:03 UTC
I noticed that SDRATTR_GRAFINVERT wasn't in include/svx/unoshprp.hxx
I added it with this:
{ OUString(UNO_NAME_GRAPHIC_IS_INVERTED),   SDRATTR_GRAFINVERT          , cppu::UnoType<bool>::get(),    0,   0}, \

(+ #define UNO_NAME_GRAPHIC_IS_INVERTED            "GraphicIsInverted"
in include/editeng/unoprnms.hxx)
but I still got the crash at the same place.

I also noticed this in the logs before the crash:
warn:sd:26504:1:sd/source/ui/unoidl/DrawController.cxx:836: Calling disposed DrawController object. Throwing exception:
warn:sd:26504:1:sd/source/ui/unoidl/DrawController.cxx:836: Calling disposed DrawController object. Throwing exception:

Björn: thought you might be interested in this one since you were working on SfxItemPool and other related stuff. If I'm wrong, don't hesitate to uncc yourself.
Comment 7 Aron Budea 2017-05-21 10:05:49 UTC Comment hidden (bibisection)
Comment 8 Aron Budea 2017-05-21 10:06:16 UTC
Apparently, the crash was introduced with the commit referenced below. Adding Cc: to Caolán McNamara, please take a look.

https://cgit.freedesktop.org/libreoffice/core/commit/?id=217a22188274221035aec988eccea5e5c9768921
author		Caolán McNamara <caolanm@redhat.com>	2015-09-18 13:40:24 (GMT)
committer	Caolán McNamara <caolanm@redhat.com>	2015-09-18 14:28:27 (GMT)

"valgrind, leak in SdStyleSheet"
Comment 9 Xisco Faulí 2017-05-21 17:07:01 UTC
Yup, reverting the mentioned commit avoids LibreOffice to crash
Comment 10 Caolán McNamara 2017-05-21 20:16:19 UTC
Seems to be a a SdrGrafObj still alive at the destruction time of the stylesheets.  It seems to be leaked actually, so there's another underlying bug I think
Comment 11 Commit Notification 2017-05-22 08:16:14 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=118401aae4516bf4cc122e96b376d129ab3a3d5e

Resolves: tdf#107959 SdrGrafObj leak triggers later crash

It will be available in 5.4.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 12 Commit Notification 2017-05-22 08:17:03 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-5-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=e4db2fc10ba4447fa5393853d0cfed795b260f0b&h=libreoffice-5-4

Resolves: tdf#107959 SdrGrafObj leak triggers later crash

It will be available in 5.4.0.1.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 13 Caolán McNamara 2017-05-22 08:25:00 UTC
backport to 5-3 in gerrit
Comment 14 Julien Nabet 2017-05-22 08:31:03 UTC
Fix targets.
Comment 15 Julien Nabet 2017-05-23 17:28:19 UTC
With master sources updated today, I don't reproduce this.
Thank you Caolán!
Comment 16 Commit Notification 2017-06-30 16:17:17 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-5-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=c00af602013b840f4f92c15b259ce6cdeeaabcae&h=libreoffice-5-3

Resolves: tdf#107959 SdrGrafObj leak triggers later crash

It will be available in 5.3.5.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.