Bug 120750 - Crash applying bold to textbox control
Summary: Crash applying bold to textbox control
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: LibreOffice (show other bugs)
Version:
(earliest affected)
5.3.0.3 release
Hardware: All All
: highest critical
Assignee: Not Assigned
URL:
Whiteboard: target:6.3.0 target:6.2.0.1 target:6.1.5
Keywords: bibisected, bisected, regression
Depends on:
Blocks:
 
Reported: 2018-10-21 10:16 UTC by Maxim Monastirsky
Modified: 2019-01-16 17:04 UTC (History)
5 users (show)

See Also:
Crash report or crash signature: ["frm::RichTextControlImpl::executeAttribute(SfxItemSet const &,SfxItemSet &,long,SfxPoolItem const *,SvtScriptType)"]


Attachments
reproducer (8.76 KB, application/vnd.oasis.opendocument.text)
2018-10-21 10:16 UTC, Maxim Monastirsky
Details
bt with debug symbols (8.59 KB, text/plain)
2018-10-28 21:00 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Maxim Monastirsky 2018-10-21 10:16:57 UTC
Created attachment 145876 [details]
reproducer

1. Open the attached document.
2. Click inside the textbox control.
3. Click on the bold toolbar button => crash.

Used to work in 5.2, broken in 5.3.
Comment 1 Oliver Brinzing 2018-10-21 13:55:56 UTC
crash reproducible with

Version: 6.1.3.1 (x64)
Build-ID: a9670562c26181ec3afbe381c9ff499ae88c98b7
CPU-Threads: 4; BS: Windows 10.0; UI-Render: Standard; 
Gebietsschema: de-DE (de_DE); Calc: group threaded

Version: 6.2.0.0.alpha0+ (x64)
Build ID: 27b0d7237a7e2f32897fa52820c3aa382f6683e9
CPU threads: 4; OS: Windows 10.0; UI render: default; VCL: win; 
Locale: de-DE (de_DE); Calc: threaded
Comment 2 Xisco Faulí 2018-10-21 16:53:17 UTC
Regression introduced by:

https://cgit.freedesktop.org/libreoffice/core/commit/?id=c9493b344a9bd104d0a882f5e9407880c0c63c20

author	Jochen Nitschke <j.nitschke+logerrit@ok.de>	2016-08-28 02:51:40 +0200
committer	Michael Stahl <mstahl@redhat.com>	2016-08-30 13:07:47 +0000
commit c9493b344a9bd104d0a882f5e9407880c0c63c20 (patch)
tree a984f282763eb00038de2aeb88b92e090e91503c
parent 1ae5c5ea82207d90b556e8139ad48ca4ceff9311 (diff)
tdf#96248 delete SfxPoolItems with Which Id >= 4000

Bisected with: bibisect-linux-64-5.3

Adding Cc: to Jochen Nitschke
Comment 3 Aron Budea 2018-10-28 04:50:08 UTC
It might not be related to the crash, but when checking the changed code in the debugger, I noticed pItemArr->maFree was a 36-long vector consisting of 0s. I assume an index should only appear once in there, no?
Comment 4 Julien Nabet 2018-10-28 21:00:18 UTC
Created attachment 146110 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today, I could reproduce this.
Comment 5 Xisco Faulí 2018-12-13 16:32:59 UTC
I've reverted the problematic commit: https://gerrit.libreoffice.org/#/c/65115/
Comment 6 Commit Notification 2018-12-14 11:45:47 UTC
Xisco Fauli committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/+/c5d0d424bd7e78455cb6f9578cf2425ac0787004%5E%21

tdf#120750: Revert "tdf#96248 delete SfxPoolItems with Which Id >= 4000"

It will be available in 6.3.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 7 Commit Notification 2018-12-14 15:41:28 UTC
Xisco Fauli committed a patch related to this issue.
It has been pushed to "libreoffice-6-2":

https://git.libreoffice.org/core/+/f1c47b9ea954342ecffc440784b43cc8cfd99f91%5E%21

tdf#120750: Revert "tdf#96248 delete SfxPoolItems with Which Id >= 4000"

It will be available in 6.2.0.1.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 8 Commit Notification 2018-12-14 17:46:08 UTC
Xisco Fauli committed a patch related to this issue.
It has been pushed to "libreoffice-6-1":

https://git.libreoffice.org/core/+/73c3c3deff69ccd6a2f55952a911738496fb3c32%5E%21

tdf#120750: Revert "tdf#96248 delete SfxPoolItems with Which Id >= 4000"

It will be available in 6.1.5.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.