Bug 108881 - Crash in: SfxItemPool::IsInRange(unsigned short)
Summary: Crash in: SfxItemPool::IsInRange(unsigned short)
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
4.0.0.3 release
Hardware: All All
: highest critical
Assignee: Dennis Francis
QA Contact:
URL:
Whiteboard: target:6.0.0 target:5.4.1
Keywords: bibisected, bisected, haveBacktrace, regression
: 108886 108930 (view as bug list)
Depends on:
Blocks:
 
Reported: 2017-06-30 20:38 UTC by Telesto
Modified: 2017-07-20 08:25 UTC (History)
3 users (show)

See Also:
Crash report or crash signature: ["SfxItemPool::IsInRange(unsigned short)"]


Attachments
Example file (11.42 KB, application/x-vnd.oasis.opendocument.spreadsheet)
2017-06-30 20:38 UTC, Telesto
Details
gdb backtrace (30.20 KB, text/x-log)
2017-07-05 11:04 UTC, Xisco Faulí
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Telesto 2017-06-30 20:38:38 UTC
Created attachment 134418 [details]
Example file

This bug was filed from the crash reporting server and is br-8171aa54-683d-4660-9cf3-f901e0c96d75.
=========================================

Steps to reproduce
1. Open the attached file
2. Cut the Ole Chart object
3. Close the Calc document (gray cross). No saving.
4. Open Calc from start center
5. Paste the Ole object -> Crash
Comment 1 Telesto 2017-06-30 20:43:18 UTC
It also crashes when pasting to Writer instead of Calc -> Crash report differs a bit
Comment 2 raal 2017-07-01 07:47:11 UTC
repro with LO 6, linux. Regression.
Comment 3 Eike Rathke 2017-07-03 12:02:17 UTC
The draw object's SfxItemPool::pImpl is invalid when pasting.

Already crashes in 5.1.5 (earliest I have), I somewhat doubt this is a regression.
Comment 4 Telesto 2017-07-03 15:12:27 UTC
Repro with:
Versie 4.0.0.3 (Bouw-id: 7545bee9c2a0782548772a21bc84a9dcc583b89)

but not with:
LibreOffice 3.5.7.2 
Build ID: 3215f89-f603614-ab984f2-7348103-1225a5b
Comment 5 raal 2017-07-03 17:21:25 UTC
This seems to have begun at the below commit.
Adding Cc: to Kohei Yoshida ; Could you possibly take a look at this one?
Thanks


commit 36d197c0646cd054145c7edcd7fb906b13c610a8
Author: Matthew Francis <mjay.francis@gmail.com>
Date:   Fri Sep 18 10:21:27 2015 +0800

    source-hash-c55d52262ea1d5f869a9528fd051ee19e687f1cc
    
    commit c55d52262ea1d5f869a9528fd051ee19e687f1cc
    Author:     Kohei Yoshida <kohei.yoshida@gmail.com>
    AuthorDate: Fri Jan 18 14:36:33 2013 -0500
    Commit:     Kohei Yoshida <kohei.yoshida@gmail.com>
    CommitDate: Fri Jan 18 14:41:42 2013 -0500
    
        fdo#58988, fdo#58562: Populate draw clip document with data for charts.
    
        Without populating the clip document, copying a chart (or charts) into
        clipboard makes the charts lose all their referenced data, which causes
        the pasted chart to appear empty.
    
        Change-Id: I3675f76baed19b48cec403964c19df00725a044b
Comment 6 raal 2017-07-03 17:32:01 UTC
*** Bug 108887 has been marked as a duplicate of this bug. ***
Comment 7 Buovjaga 2017-07-03 17:56:15 UTC
*** Bug 108886 has been marked as a duplicate of this bug. ***
Comment 8 Xisco Faulí 2017-07-04 09:38:02 UTC
*** Bug 108930 has been marked as a duplicate of this bug. ***
Comment 9 Xisco Faulí 2017-07-05 11:04:17 UTC
Created attachment 134491 [details]
gdb backtrace
Comment 10 Michael Meeks 2017-07-19 10:26:15 UTC
Fix in gerrit awaiting review: https://gerrit.libreoffice.org/#/c/40057/ =)
Comment 11 Commit Notification 2017-07-19 18:08:32 UTC
Dennis Francis committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=4d783c45062d030d278c076d7817b9589fa77d91

tdf#108881 : do not assume that chart objects always...

It will be available in 6.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 12 Commit Notification 2017-07-19 19:01:25 UTC
Dennis Francis committed a patch related to this issue.
It has been pushed to "libreoffice-5-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=013cc39448b00a450d040ddc8828aa9ab3004e3d&h=libreoffice-5-4

tdf#108881 : do not assume that chart objects always...

It will be available in 5.4.1.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 13 Telesto 2017-07-20 08:23:33 UTC
I can confirm the fix is working with:
Version: 6.0.0.0.alpha0+
Build ID: b8e26ebe2c37640212ef663a483cddf1639af742
CPU threads: 4; OS: Windows 6.19; UI render: default; 
TinderBox: Win-x86@39, Branch:master, Time: 2017-07-20_07:15:12
Locale: nl-NL (nl_NL); Calc: CL

However, bug 108887 (marked as dupe of this one) still exists.
Comment 14 Xisco Faulí 2017-07-20 08:25:26 UTC
Hi Telesto,
Thanks for verifying this one.
Please, go ahead and reopen the other one.