Bug Hunting Session
Bug 117228 - EDITING: crash in SfxItemSet::GetItemState(unsigned short, bool, SfxPoolItem const**) when pasting comment of closed document
Summary: EDITING: crash in SfxItemSet::GetItemState(unsigned short, bool, SfxPoolItem ...
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
6.1.0.0.alpha0+
Hardware: All All
: highest critical
Assignee: Henry Castro
URL:
Whiteboard: target:6.1.0 target:6.2.0 target:6.1.0.1
Keywords: bibisected, bisected, regression
: 117545 117546 (view as bug list)
Depends on:
Blocks: 116998
  Show dependency treegraph
 
Reported: 2018-04-25 11:18 UTC by Eike Rathke
Modified: 2018-07-05 15:53 UTC (History)
5 users (show)

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Eike Rathke 2018-04-25 11:18:32 UTC
1. open two new Calc documents
2. add some comment to any cell in one document
3. copy that cell to clipboard
4. close the document without saving
5. paste on any cell in the second document => crash

This is almost identical to bug 104967 that was fixed by forgetting some caption details owned by the closed document, the crash is just some calls below ScPostIt::CreateCaption() now.

However, in master/6.1 in ScDocument::~ScDocument() asking ScDocument::IsClipboardSource() returns false because in ScModule::GetClipDoc() SfxViewShell::Current() returns nullptr, which it didn't before. Some logic when view shells are destroyed seem to have changed meanwhile. The effect is that ClosingClipboardSource() is not called anymore and the caption and item set items are not forgotten and still point to drawing details of the already closed document.

Hence, asking for bibisect to find the culprit.
Comment 1 Xisco Faulí 2018-04-25 12:30:46 UTC
Regression introduced by:

author	Henry Castro <hcastro@collabora.com>	2017-08-12 19:46:27 -0400
committer	Henry Castro <hcastro@collabora.com>	2017-12-08 13:06:57 +0100
commit	1b7a8277aa3e9f73ccdf15e933a1ee3b42849a44 (patch)
tree	64474c3499c36d31f0ea13d348245a6bea6abbe6
parent	630be5751029fc8ebf5a8784fb1c07894a0e1600 (diff)
sc lok: 1 view has 1 clipboard to transfer data
In tiled rendering case, each view copy and paste
the contents of the clipboard associated with the view

Bisected with: bibisect-linux64-6.1

Adding Cc: to Henry Castro
Comment 2 Eike Rathke 2018-04-25 15:41:58 UTC
Thanks a lot!

@Henry: can you fix that please?
Comment 3 Commit Notification 2018-05-23 11:20:31 UTC
Henry Castro committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=a2e6f31c6f90e446d1462e7c80f6b1317f7825bc

tdf#117228: crash in SfxItemSet::GetItemState...

It will be available in 6.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 4 Eike Rathke 2018-05-23 11:28:34 UTC
Fixes the copy case, but when the comment is visible (shown) in step #3 cutting the comment instead of copying then closing the document and pasting into another document still crashes. If you'd like to investigate that?
Comment 5 Eike Rathke 2018-05-23 13:01:34 UTC
Sigh.. it also crashes if the original sequence is repeated, i.e.

1. open two new Calc documents
2. add some comment to any cell in one document
3. copy that cell to clipboard
4. close the document without saving
5. paste on any cell in the second document
6. create new third Calc document
7. copy cell from second document to clipboard
8. close second document
9. paste to third document => crash
Comment 6 Henry Castro 2018-05-23 13:21:38 UTC
Thanks. 

Oh Interesting ...

I have to finish some javascript clean ups. I will work on it tomorrow :)
Comment 7 Telesto 2018-05-23 19:48:13 UTC
*** Bug 117545 has been marked as a duplicate of this bug. ***
Comment 8 Telesto 2018-05-23 19:50:49 UTC
*** Bug 117546 has been marked as a duplicate of this bug. ***
Comment 9 Henry Castro 2018-06-05 15:45:06 UTC
Hi Eike,

Sorry I could not reproduce the crash. I have followed the steps,

>> 8. close second document

I tried:
 + saving the document.
 + creating 3 views with Window->New Window.
 + the steps of duplicate Bug 117545
Comment 10 Eike Rathke 2018-06-05 17:19:07 UTC
Not new view windows, three Calc *documents*
Comment 11 Henry Castro 2018-06-05 17:58:53 UTC
I also tried creating documents. I was using File->New->Spreadsheet

But I did reproduce https://bugs.documentfoundation.org/show_bug.cgi?id=117997
I think It should be related to this one.
Comment 12 Xisco Faulí 2018-06-06 15:59:26 UTC
I can't reproduce the steps from comment 5

Version: 6.1.0.0.beta1+
Build ID: 8b96445766efe237eb47608ade6c147673466e2e
CPU threads: 4; OS: Linux 4.13; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group threaded
Comment 13 Telesto 2018-06-06 17:42:09 UTC
I still repro comment 1 (with a small tweak)

1. Open a Calc document (Document 1)
2. Insert a comment with some comment to - in my case - A1
3. Copy that cell to clipboard
4. Open a new calc document
5. Close Document 1 without saving
6. Paste in Document 2 -> Crash


Version: 6.2.0.0.alpha0+
Build ID: 7530424771c84d50f1e7e9ec5eba0bffc91d655a
CPU threads: 4; OS: Windows 6.3; UI render: default; 
TinderBox: Win-x86@42, Branch:master, Time: 2018-06-06_05:38:42
Locale: nl-NL (nl_NL); Calc: CL
Comment 14 Xisco Faulí 2018-06-07 08:57:59 UTC
(In reply to Telesto from comment #13)
> I still repro comment 1 (with a small tweak)
> 
> 1. Open a Calc document (Document 1)
> 2. Insert a comment with some comment to - in my case - A1
> 3. Copy that cell to clipboard
> 4. Open a new calc document
> 5. Close Document 1 without saving
> 6. Paste in Document 2 -> Crash


Confirmed in

Version: 6.1.0.0.beta1+
Build ID: 8b96445766efe237eb47608ade6c147673466e2e
CPU threads: 4; OS: Linux 4.13; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group threaded
Comment 15 Henry Castro 2018-06-08 21:33:31 UTC
Hi,

I submitted a patch to gerrit https://gerrit.libreoffice.org/#/c/55490/,
according to my tests I got no more crash with tdf#117997 and tdf#117228.

I will appreciate your help testing if there are more side effects

Thanks
Comment 16 Commit Notification 2018-06-26 12:25:21 UTC
Henry Castro committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=b6b1ded0a0539e7be1b5338de378a3276a6ff445

sc: replace ScCaptionPtr with std::shared_ptr, tdf#117997, tdf#117228

It will be available in 6.2.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 17 Commit Notification 2018-07-04 19:56:38 UTC
Henry Castro committed a patch related to this issue.
It has been pushed to "libreoffice-6-1":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=ee7638061e787e6a1c37b2d3be1c14852cbc3381&h=libreoffice-6-1

sc: replace ScCaptionPtr with std::shared_ptr, tdf#117997, tdf#117228

It will be available in 6.1.0.1.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 18 Xisco Faulí 2018-07-05 15:51:28 UTC
Verified in

Versión: 6.1.0.1
Id. de compilación: 378e26bd4f22a135cef5fa17afd5d4171d8da21a
Subprocs. CPU: 1; SO: Windows 6.1; Repres. IU: predet.; 
Configuración regional: es-ES (es_ES); Calc: group threaded

@Henry, Thanks for fixing this!! Should it be closed as RESOLVED FIXED ?