Bug 118042 - LibreOffice crashes after clicking "Target in document" button in the Hyperlink dialog
Summary: LibreOffice crashes after clicking "Target in document" button in the Hyperli...
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
6.1.0.0.beta1+
Hardware: All All
: medium normal
Assignee: Julien Nabet
URL:
Whiteboard: target:6.2.0 target:6.1.0.1
Keywords: bibisectRequest, haveBacktrace, regression
Depends on:
Blocks: Hyperlink
  Show dependency treegraph
 
Reported: 2018-06-06 19:32 UTC by Muhammet Kara
Modified: 2018-06-12 09:46 UTC (History)
5 users (show)

See Also:
Crash report or crash signature:


Attachments
bt with debug symbols (10.43 KB, text/plain)
2018-06-06 20:06 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Muhammet Kara 2018-06-06 19:32:39 UTC
How to reproduce:
1. Create a new document with Writer
2. Ctrl + K to pen the Hyperlink dialog
3. Go to the Document tab on the left
4. Click the button to the right of the Target box, under the "Target in Document" section

Happens in Writer. Works in "Version: 6.0.5.1", so a regression.

Found in master:
Version: 6.2.0.0.alpha0+
Build ID: 7c666e66b7f176bd8910e64f6008ff24151b37a5
CPU threads: 8; OS: Linux 4.16; UI render: default; VCL: gtk2; 
TinderBox: Linux-rpm_deb-x86_64@70-TDF-dbg, Branch:master, Time: 2018-06-06_02:03:28
Locale: en-US (en_US.UTF-8); Calc: group threaded
Comment 1 Julien Nabet 2018-06-06 20:06:26 UTC
Created attachment 142573 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today + enable-dbgutil, I got an assert.
Comment 2 Julien Nabet 2018-06-06 20:18:33 UTC
Noel: I noticed it crashes because of line 686:
    686                     { OUString(UNO_LINK_DISPLAY_BITMAP), 0,     cppu::UnoType<css::awt::XBitmap>::get(), PropertyAttribute::READONLY, 0xff},
    687                     { OUString(UNO_LINK_DISPLAY_NAME), 0,   cppu::UnoType<OUString>::get(), PropertyAttribute::READONLY, 0xbf},

Just wonder what's the meaning of 0xff and 0xbf, I noticed that a lot of 0xff had been changed to 0xbf with https://cgit.freedesktop.org/libreoffice/core/commit/?id=ae5f89fdcccb2cf74256b04771249fc8afca879
Comment 3 Julien Nabet 2018-06-06 20:27:13 UTC
This patch fixes the assert and I don't have a crash:
diff --git a/sw/source/core/unocore/unomap.cxx b/sw/source/core/unocore/unomap.cxx
index 8445e08f935d..3dffbe6859fc 100644
--- a/sw/source/core/unocore/unomap.cxx
+++ b/sw/source/core/unocore/unomap.cxx
@@ -683,7 +683,7 @@ const SfxItemPropertyMapEntry* SwUnoPropertyMapProvider::GetPropertyMapEntries(s
             {
                 static SfxItemPropertyMapEntry const aLinkTargetMap_Impl[] =
                 {
-                    { OUString(UNO_LINK_DISPLAY_BITMAP), 0,     cppu::UnoType<css::awt::XBitmap>::get(), PropertyAttribute::READONLY, 0xff},
+                    { OUString(UNO_LINK_DISPLAY_BITMAP), 0,     cppu::UnoType<css::awt::XBitmap>::get(), PropertyAttribute::READONLY, 0xbf},
                     { OUString(UNO_LINK_DISPLAY_NAME), 0,   cppu::UnoType<OUString>::get(), PropertyAttribute::READONLY, 0xbf},
                     { OUString(), 0, css::uno::Type(), 0, 0 }
                 };

Now, since I don't know the meaning of 0xbf/0xff, I hesitate to submit this on gerrit.
Comment 4 Noel Grandin 2018-06-07 06:30:38 UTC
that fix is correct, in the past the code was setting 0x40 in that field to indicate that the field is METRIC i.e. needs conversion.

I fixed that in ae5f89fdcccb2cf74256b04771249fc8afca8794, but obviously missed that one.

Want to push a fix?
Comment 5 Julien Nabet 2018-06-07 06:50:06 UTC
(In reply to Noel Grandin from comment #4)
> ...
> Want to push a fix?

No pb but I'll be able to do it only when get back to home. If someone wants to do it before, fine for me too.
Comment 6 Commit Notification 2018-06-07 18:32:50 UTC
Julien Nabet committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=fccc7aebb5285e36530b14001e37b33b586365f9

tdf#118042: fix crash on Target box in Hyperlink dialog

It will be available in 6.2.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 7 Julien Nabet 2018-06-07 18:34:06 UTC
For 6.1: https://gerrit.libreoffice.org/#/c/55443/ is on review.
Comment 8 Commit Notification 2018-06-07 19:11:53 UTC
Julien Nabet committed a patch related to this issue.
It has been pushed to "libreoffice-6-1":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=243b73546c0c0b291f5e05405ad24e48df625d64&h=libreoffice-6-1

tdf#118042: fix crash on Target box in Hyperlink dialog

It will be available in 6.1.0.1.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 9 Xisco Faulí 2018-06-12 09:46:31 UTC
Verified in

Version: 6.2.0.0.alpha0+
Build ID: 4c6e11886a9d396bf7be18e9e3209a73c6e303ad
CPU threads: 4; OS: Linux 4.13; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group threaded

@Julien, Thanks for fixing this!!