Bug 108024 - Crash with a crafted odp when closing "Insert OLE object" dialog
Summary: Crash with a crafted odp when closing "Insert OLE object" dialog
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Impress (show other bugs)
Version:
(earliest affected)
5.2.0.0.alpha0+
Hardware: All All
: highest critical
Assignee: Takeshi Abe
URL:
Whiteboard: target:5.5.0 target:5.4.0.1 target:5.3.4
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2017-05-23 11:07 UTC by Takeshi Abe
Modified: 2017-06-07 16:05 UTC (History)
4 users (show)

See Also:
Crash report or crash signature: ["sd::ViewShell::MouseButtonUp(MouseEvent%20const%20&,sd::Window%20*)"]


Attachments
A presentation file to reproduce crash (11.34 KB, application/vnd.oasis.opendocument.presentation)
2017-05-23 11:07 UTC, Takeshi Abe
Details
gdb backtrace (18.07 KB, text/plain)
2017-05-23 12:08 UTC, Xisco Faulí
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Takeshi Abe 2017-05-23 11:07:03 UTC
Created attachment 133474 [details]
A presentation file to reproduce crash

Steps to reproduce:
1. Open the attached .odp
2. Double-click area saying "Double-click to add an Object" in the slide
   (then "Insert OLE object" dialog appears.)
3. Click "Cancel"
   (then it crashes.)

I found this behavior reproduced with both LibO 5.2.7 and LibO 5.3.3 on several platforms, but not reproduced with LibO 4.3.3.
Comment 1 Xisco Faulí 2017-05-23 11:47:01 UTC
Confirmed in

Versión: 5.3.2.2
Id. de compilación: 6cd4f1ef626f15116896b1d8e1398b56da0d0ee1
Subproc. CPU: 1; SO: Windows 6.1; Repr. de IU: predet.; Motor de trazado: HarfBuzz; 
Configuración regional: ro-RO (es_ES); Calc: group

and

Version: 5.5.0.0.alpha0+
Build ID: 7662b11cad6105d56fb9acc9c431c89d3b68dc89
CPU threads: 1; OS: Windows 6.1; UI render: default; 
TinderBox: Win-x86@39, Branch:master, Time: 2017-05-20_10:09:09
Locale: es-ES (es_ES); Calc: group
Comment 2 Xisco Faulí 2017-05-23 12:08:40 UTC
Created attachment 133476 [details]
gdb backtrace
Comment 3 Telesto 2017-05-23 12:10:24 UTC
No repro with:
Version: 5.1.0.3
Build ID: 5e3e00a007d9b3b6efb6797a8b8e57b51ab1f737
CPU Threads: 4; OS Version: Windows 6.2; UI Render: GL; 
Locale: en-US (nl_NL)
Comment 5 Xisco Faulí 2017-05-23 12:19:19 UTC
Plausible candidate baf34a9e44fbd39c3657cabd22d871bc804ab12d
Comment 6 Xisco Faulí 2017-05-23 14:23:35 UTC
Confirmed by reverting the commit.

Regression introduced by:

author	Noel Grandin <noel@peralex.com>	2016-04-13 13:37:03 (GMT)
committer	Noel Grandin <noel@peralex.com>	2016-04-14 07:21:40 (GMT)
commit baf34a9e44fbd39c3657cabd22d871bc804ab12d (patch)
tree cd82a6b15c89f5ae510f2e241b3587f6a294dcb5
parent 89fa923a28fb351bb4faad1f69ca94d17f8a5b06 (diff)
loplugin:passstuffbyref in sd

Adding Cc: to Noel Grandin
Comment 7 Takeshi Abe 2017-05-24 06:41:37 UTC
Thank you Xisco for quick inspection, which led me to a small fix:
https://gerrit.libreoffice.org/#/c/37976/
Comment 8 Commit Notification 2017-06-01 09:00:43 UTC
Takeshi Abe committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=96d59ffc572c4cf112405a85aee3366d45bc7757

tdf#108024 Keep original selection during DrawViewShell::FuTemporary()

It will be available in 5.5.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 9 Xisco Faulí 2017-06-01 09:20:57 UTC
Hi Takeshi,

Thanks for the fix. Please backport it to 5.4 and 5.3.4
Comment 10 Commit Notification 2017-06-02 04:30:54 UTC
Takeshi Abe committed a patch related to this issue.
It has been pushed to "libreoffice-5-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=30a1c429c24b8de9a51ed066571d3c315f812844&h=libreoffice-5-4

tdf#108024 Keep original selection during DrawViewShell::FuTemporary()

It will be available in 5.4.0.1.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 11 Commit Notification 2017-06-02 07:04:01 UTC
Takeshi Abe committed a patch related to this issue.
It has been pushed to "libreoffice-5-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=64c8c76a1dca96cb2ceed2aced8ff4e5efd60aa9&h=libreoffice-5-3

tdf#108024 Keep original selection during DrawViewShell::FuTemporary()

It will be available in 5.3.5.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 12 Commit Notification 2017-06-07 12:21:48 UTC
Takeshi Abe committed a patch related to this issue.
It has been pushed to "libreoffice-5-3-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=008043ed195cec3bd526ac0c4e96d32d2c3e345f&h=libreoffice-5-3-4

tdf#108024 Keep original selection during DrawViewShell::FuTemporary()

It will be available in 5.3.4.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.