Bug 118354 - CRASH: Draw just closes if to try select table in file
Summary: CRASH: Draw just closes if to try select table in file
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Draw (show other bugs)
Version:
(earliest affected)
6.1.0.0.beta2+
Hardware: All All
: highest critical
Assignee: Armin Le Grand (allotropia)
URL:
Whiteboard: target:6.2.0 target:6.1.0.2 target:7.0.0
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks: Regressions-AW080
  Show dependency treegraph
 
Reported: 2018-06-24 19:50 UTC by Roman Kuznetsov
Modified: 2020-05-20 08:25 UTC (History)
5 users (show)

See Also:
Crash report or crash signature: ["OutlinerParaObject::OutlinerParaObject(OutlinerParaObject const &)"]


Attachments
Example file (11.38 KB, application/vnd.oasis.opendocument.graphics)
2018-06-24 19:51 UTC, Roman Kuznetsov
Details
bt with debug symbols (8.15 KB, text/plain)
2018-06-26 18:38 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Roman Kuznetsov 2018-06-24 19:50:20 UTC
Description:
Draw just closes if to try select table in file from attach.

Without crash report.

Steps to Reproduce:
1. Open file from attach
2. Try select a table 
3. Draw closes

Actual Results:
Draw closes

Expected Results:
Draw works 


Reproducible: Always


User Profile Reset: No



Additional Info:
Comment 1 Roman Kuznetsov 2018-06-24 19:51:29 UTC
Created attachment 143077 [details]
Example file
Comment 2 Roman Kuznetsov 2018-06-24 19:53:05 UTC
Version: 6.1.0.0.beta2+ (x64)
Build ID: fe1a23b5c49c94410a604c8d4a6f50f43d575403
CPU threads: 4; OS: Windows 10.0; UI render: GL; 
TinderBox: Win-x86_64@42, Branch:libreoffice-6-1, Time: 2018-06-17_06:31:41
Locale: ru-RU (ru_RU); Calc: CL
Comment 3 Susan Gessing 2018-06-24 20:23:52 UTC
Was NOT able to reproduce in:

Version: 6.0.5.2 (x64)
Build ID: 54c8cbb85f300ac59db32fe8a675ff7683cd5a16
CPU threads: 4; OS: Windows 6.3; UI render: GL; 
Locale: en-US (en_US); Calc: CL
Windows 8.1

WAS able to reproduce in:

Version: 6.2.0.0.alpha0+
Build ID: b1740fba0d1e6e3d69c3781734509317f42a0e4f
CPU threads: 4; OS: Windows 6.3; UI render: GL; 
TinderBox: Win-x86@42, Branch:master, Time: 2018-06-15_08:49:04
Locale: en-US (en_US); Calc: CL
Windows 8.1
Comment 4 Xisco Faulí 2018-06-25 10:27:07 UTC
Regression introduced by:

author	Armin Le Grand <Armin.Le.Grand@cib.de (CIB)>	2018-03-01 15:54:32 +0100
committer	Armin Le Grand <Armin.Le.Grand@cib.de>	2018-04-07 00:28:30 +0200
commit dfefe448c41921f2f1e54d3f69b8b9e89031d055 (patch)
tree 1aace31054b5740e2faffcbc5de66a791be27f7d
parent eba4d5b2b76cefde90cb3d6638c736f435023a45 (diff)
SOSAW080: Added first bunch of basic changes to helpers

Bisected with: bibisect-linux64-6.1

Adding Cc: to Armin Le Grand
Comment 5 Julien Nabet 2018-06-26 18:38:36 UTC
Created attachment 143146 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today, I got a crash just when clicking on the table.
Comment 6 Armin Le Grand (allotropia) 2018-07-18 11:56:03 UTC
Good catch - in Cell::replaceContentAndFormating a request for OutlinerParaObject in the underlying class SdrText is dereferenced without testing if it exists. This *can* be nullptr.
Seems as if the 'old' cloning mechanism never stumbled over this - nonetheless a long-existing error. Added fix to gerrit...
Comment 7 Commit Notification 2018-07-18 13:41:00 UTC
Armin Le Grand committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=c28ec6d9fbb21b363102faac0171de2754ea5d75

tdf#118354 Do not dereference non-exsisting Object

It will be available in 6.2.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 8 Xisco Faulí 2018-07-18 16:05:57 UTC
Verified in

Version: 6.2.0.0.alpha0+
Build ID: 95b00f1bfa341003af23e150d316d943d47909cf
CPU threads: 4; OS: Linux 4.13; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group threaded

@Armin, thanks for fixing this!!

Should it be backported to 6.1 ?
Comment 9 Armin Le Grand (allotropia) 2018-07-19 07:50:06 UTC
@Xisco: Yes. conflict on jenkins cherry-pick, have to do handish...
Comment 10 Commit Notification 2018-07-19 09:30:15 UTC
Armin Le Grand committed a patch related to this issue.
It has been pushed to "libreoffice-6-1":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=1663326d292a6ed89215b7a188054a2e27d7832f&h=libreoffice-6-1

tdf#118354 Do not dereference non-exsisting Object

It will be available in 6.1.0.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 11 Commit Notification 2020-04-06 13:44:27 UTC
Xisco Fauli committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/4361e87deff63bd7dca2c5c22372379254912a0c

tdf#118354: Add unittest

It will be available in 7.0.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.