Bug 108887 - Crash in: SfxItemPool::GetDefaultItem(unsigned short)
Summary: Crash in: SfxItemPool::GetDefaultItem(unsigned short)
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
4.0.0.3 release
Hardware: All All
: highest major
Assignee: Dennis Francis
QA Contact:
URL:
Whiteboard: target:6.0.0 target:5.4.1
Keywords: bibisected, bisected, regression
: 109292 (view as bug list)
Depends on:
Blocks:
 
Reported: 2017-07-01 12:25 UTC by Telesto
Modified: 2017-08-01 14:11 UTC (History)
6 users (show)

See Also:
Crash report or crash signature: ["SfxItemPool::GetDefaultItem(unsigned short)"]


Attachments
Example file (11.74 KB, application/vnd.oasis.opendocument.spreadsheet)
2017-07-01 12:25 UTC, Telesto
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Telesto 2017-07-01 12:25:52 UTC
Created attachment 134425 [details]
Example file

This bug was filed from the crash reporting server and is br-c0c82391-5686-4477-be72-026f89b03482.
=========================================

1. Open the attached file
2. Copy the formula somewhere around C6
3. Close Calc (gray cross)
4. Open New calc document
5. Paste -> Crash
Comment 1 m.a.riosv 2017-07-01 14:30:30 UTC
Repro.
Version: 5.4.0.1 (x64)
Build ID: 962a9c4e2f56d1dbdd354b1becda28edd471f4f2
CPU threads: 4; OS: Windows 6.19; UI render: GL; 
Locale: es-ES (es_ES); Calc: group
Comment 2 raal 2017-07-02 15:49:56 UTC
regression, no crash in Version 4.1.0.0.alpha0
Comment 3 raal 2017-07-03 17:31:15 UTC
commit 36d197c0646cd054145c7edcd7fb906b13c610a8
Author: Matthew Francis <mjay.francis@gmail.com>
Date:   Fri Sep 18 10:21:27 2015 +0800

    source-hash-c55d52262ea1d5f869a9528fd051ee19e687f1cc
    
    commit c55d52262ea1d5f869a9528fd051ee19e687f1cc
    Author:     Kohei Yoshida <kohei.yoshida@gmail.com>
    AuthorDate: Fri Jan 18 14:36:33 2013 -0500
    Commit:     Kohei Yoshida <kohei.yoshida@gmail.com>
    CommitDate: Fri Jan 18 14:41:42 2013 -0500
    
        fdo#58988, fdo#58562: Populate draw clip document with data for charts.
    
        Without populating the clip document, copying a chart (or charts) into
        clipboard makes the charts lose all their referenced data, which causes
        the pasted chart to appear empty.
    
        Change-Id: I3675f76baed19b48cec403964c19df00725a044b
Comment 4 raal 2017-07-03 17:32:01 UTC
the same commit as in bug 108881

*** This bug has been marked as a duplicate of bug 108881 ***
Comment 5 Telesto 2017-07-20 09:46:28 UTC
Back to NEW, still reproducible with:
Version: 6.0.0.0.alpha0+
Build ID: b8e26ebe2c37640212ef663a483cddf1639af742
CPU threads: 4; OS: Windows 6.19; UI render: default; 
TinderBox: Win-x86@39, Branch:master, Time: 2017-07-20_07:15:12
Locale: nl-NL (nl_NL); Calc: CL
Comment 6 Xisco Faulí 2017-07-20 13:53:28 UTC
Hi Dennis,
I guess the fix for this is semilar to what you did for charts in bug 108881 but for formulas, isn't it ?
Comment 7 Dennis Francis 2017-07-20 14:52:13 UTC
(In reply to Xisco Faulí from comment #6)
> Hi Dennis,
> I guess the fix for this is semilar to what you did for charts in bug 108881
> but for formulas, isn't it ?

I think so, I will work on it next.
Comment 8 Telesto 2017-07-20 15:26:16 UTC
Only for the record, the crashing is not limited to Formula's. The crashing is happening for (nearly) all OLE-objects I tested in Calc (for example):
* LibreofficeDev 6.0 Spreadsheet
* LibreofficeDev 6.0 Drawing
* LibreofficeDev 6.0 Presentation

Steps to reproduce
1. Open Calc
2. Insert -> Object -> Ole-Object -> Insert a new Ole-object (for example spreadsheet)
3. Cut/Copy the Object
3. Close Calc (gray cross)
4. Open New calc document
5. Paste -> Crash

-------------
I also noticed a crash when copying LibreOfficeDev 6.0 Chart OLE-object (cutting it is working fine) 
1. Open Calc
2. Insert -> Object -> Ole-Object -> Insert LibreOfficeDec 6.0 Chart (create new)
3. Copy the Object Chart -> Crash
Comment 9 Dennis Francis 2017-07-21 11:58:37 UTC
Submitted a patch on this for review @ https://gerrit.libreoffice.org/40278
Comment 10 Xisco Faulí 2017-07-24 07:43:57 UTC
*** Bug 109292 has been marked as a duplicate of this bug. ***
Comment 11 Commit Notification 2017-07-27 19:32:16 UTC
Dennis Francis committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=04461743d75f8cffb5906ab52d772089c44a7780

tdf#108887 : Move the code of ScDrawView::CheckOle()...

It will be available in 6.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 12 Jean-Baptiste Faure 2017-07-28 21:16:16 UTC
Thank you very much for this fix. Do you plan to backport it to 5.4 branch?

Best regards. JBF
Comment 13 Dennis Francis 2017-07-31 05:13:47 UTC
I will soon get the patch for 5-4 in gerrit after testing.
Comment 14 Dennis Francis 2017-07-31 07:04:34 UTC
submitted @ https://gerrit.libreoffice.org/#/c/40579/ for libreoffice-5-4 branch
Comment 15 Commit Notification 2017-07-31 20:54:01 UTC
Dennis Francis committed a patch related to this issue.
It has been pushed to "libreoffice-5-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=5b7a08939986da68b44d92099c7a9ac47351675c&h=libreoffice-5-4

tdf#108887 : Move the code of ScDrawView::CheckOle()...

It will be available in 5.4.1.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.