Bug 114427 - LibreOffice crashes on disposing a frame with a basic macro
Summary: LibreOffice crashes on disposing a frame with a basic macro
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: BASIC (show other bugs)
Version:
(earliest affected)
4.1 all versions
Hardware: All All
: high major
Assignee: Caolán McNamara
URL:
Whiteboard: target:6.2.0 target:6.1.1
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2017-12-12 14:26 UTC by Cor Nouws
Modified: 2018-08-17 07:14 UTC (History)
4 users (show)

See Also:
Crash report or crash signature: ["SdrObject::setUnoShape(com::sun::star::uno::Reference<com::sun::star::uno::XInterface> const &)"]


Attachments
presentation to test (15.87 KB, application/vnd.oasis.opendocument.presentation)
2017-12-12 14:28 UTC, Cor Nouws
Details
bt with debug symbols (10.95 KB, text/plain)
2017-12-12 20:29 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Cor Nouws 2017-12-12 14:26:32 UTC
I'll attach a sample presentation.

Paste the code below in LibreOffice Basis IDE
Run the code.

It should remove the blue frame from the notes page of the second slide.
But it crashes.

Found in Versie: 5.4.3.2
Build ID: 92a7159f7e4af62137622921e809f8546db437e5
CPU-threads: 4; Besturingssysteem:Linux 4.13; UI-render: standaard; VCL: gtk2; 
Locale: nl-NL (nl_NL.UTF-8); Calc: group

Will attach crash ID too
Comment 1 Cor Nouws 2017-12-12 14:27:14 UTC
macro:

Sub TestDeletingFrame3
	dim oAFrame
	'Globalscope.BasicLibraries.LoadLibrary("XrayTool")

	oAFrame = ThisComponent.DrawPages(1).NotesPage.GetByIndex(2)
	'xray oAFrame
	'oAFrame.release()
	oAFrame.String = ""
	oAFrame.Dispose 'crashes
End Sub
Comment 2 Cor Nouws 2017-12-12 14:28:12 UTC
Created attachment 138397 [details]
presentation to test
Comment 3 Xisco Faulí 2017-12-12 15:51:57 UTC
Regression introduced by:

author	Luke Deller <luke@deller.id.au>	2013-04-28 07:06:11 +1000
committer	David Tardon <dtardon@redhat.com>	2013-04-28 11:52:12 +0000
commit	57082b1243e86694b72c5e4fad013bf207bfe81a (patch)
tree	2e461c166beecb5b569c966a2aeceb90995a4b85
parent	2094610175140023cf8f904f8506c189e36dec06 (diff)
fdo#60910: discard UNO shape object in SdrObject::SetPage
The creation of the UNO shape in SdrObject::getUnoShape is influenced
by pPage, so when the page changes we need to discard the cached UNO
shape so that a new one will be created with the new page.

This replaces my first shot at a fix for fdo#60910 which reinstated a
line to discard the custom shape engine (and consequently the UNO shape) in
SdrObjCustomShape::InvalidateRenderGeometry.  That worked but did more
discarding than was necessary.

Bisected with: bibisect-41max

Adding Cc: to Luke Deller
Comment 4 Julien Nabet 2017-12-12 20:29:09 UTC
Created attachment 138403 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated yesterday, I could reproduce this.
I attached a bt with symbols
Comment 5 Julien Nabet 2017-12-12 20:29:45 UTC
Let's increase priority since:
- it's on all platforms
- it's a crash
- it's a regression
Comment 6 Julien Nabet 2017-12-12 20:35:02 UTC
BTW, I had to change this:
oAFrame = ThisComponent.DrawPages(1).NotesPage.GetByIndex(2)
to this:
oAFrame = ThisComponent.DrawPages(1).NotesPage.GetByIndex(1)

since it failed with an out of bounds.
Comment 7 Cor Nouws 2017-12-12 21:09:32 UTC
(In reply to Julien Nabet from comment #6)
> BTW, I had to change this:
> oAFrame = ThisComponent.DrawPages(1).NotesPage.GetByIndex(2)
> to this:
> oAFrame = ThisComponent.DrawPages(1).NotesPage.GetByIndex(1)
> 
> since it failed with an out of bounds.

Ah, the orig version had a blue shape too on the notes page. Sorry for this mistake.
Comment 8 Cor Nouws 2017-12-13 15:42:26 UTC
Solution that does not crash: use the remove method from the page:

(In reply to Cor Nouws from comment #1)

> 	oAFrame.Dispose 'crashes

oDrawPage.Remove(oAFrame)
Comment 9 Caolán McNamara 2018-08-14 20:06:12 UTC
I have a fix to make this not crash
Comment 10 Commit Notification 2018-08-15 07:38:37 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=17838c9c4279ab3e7932d4f383a8b1696491e622

Resolves: tdf#114427 crash when basic used to dispose shape

It will be available in 6.2.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 11 Caolán McNamara 2018-08-15 07:44:02 UTC
6.1 backport in gerrit
Comment 12 Xisco Faulí 2018-08-16 09:55:00 UTC
Hi Caolán,

I don't know if it's related but now I get a crash when closing LibreOffice in

Version: 6.2.0.0.alpha0+
Build ID: 1af7f19224f18e5025352339648db659575eae33
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: threaded

Steps:
1. Open attached document
2. Run


Sub TestDeletingFrame3
	dim oAFrame
	'Globalscope.BasicLibraries.LoadLibrary("XrayTool")

	oAFrame = ThisComponent.DrawPages(1).NotesPage.GetByIndex(1)
	'xray oAFrame
	'oAFrame.release()
	oAFrame.String = ""
	oAFrame.Dispose 'crashes
End Sub

3. Close macro editor
4. Close LibreOffice
Comment 13 Caolán McNamara 2018-08-16 12:35:12 UTC
seems I need to adjust that fix a bit then, no crash here but I can see the problem under valgrind. https://gerrit.libreoffice.org/#/c/59172/
Comment 14 Commit Notification 2018-08-16 15:58:00 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=4f2b25c406b3e63b5d15bf90ad29abb3eb9041a1

tdf#114427 improve fix, wedo need to free it regardless

It will be available in 6.2.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 15 Commit Notification 2018-08-16 20:20:58 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-6-1":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=876a433607831f5c82bb952582c151ac653841e7&h=libreoffice-6-1

Resolves: tdf#114427 crash when basic used to dispose shape

It will be available in 6.1.1.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 16 Xisco Faulí 2018-08-17 07:14:59 UTC
Verified in

Version: 6.2.0.0.alpha0+
Build ID: da7040510d5be27ad7b90ffb0c962535f3375358
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: threaded

@Caolán, Thanks for fixing this!!