Download it now!
Bug 130792 - Draw crashes when trying to add a point in a multiline ( steps in comment 8 )
Summary: Draw crashes when trying to add a point in a multiline ( steps in comment 8 )
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Draw (show other bugs)
Version:
(earliest affected)
6.2.0.0.alpha1+
Hardware: All All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard: target:7.0.0 target:6.4.5
Keywords: bibisected, bisected, regression
Depends on:
Blocks:
 
Reported: 2020-02-20 06:57 UTC by Yves57
Modified: 2020-05-05 18:07 UTC (History)
4 users (show)

See Also:
Crash report or crash signature: ["SdrDragObjOwn::SdrDragObjOwn"]


Attachments
Draw including a multilines form (8.05 KB, application/vnd.oasis.opendocument.graphics)
2020-02-20 10:01 UTC, Yves57
Details
before and after (with patch) (1.08 MB, video/x-matroska)
2020-04-28 15:49 UTC, Xisco Faulí
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Yves57 2020-02-20 06:57:35 UTC
Description:
I have a closed multiline in a draw. I want to add a point to it.
I select the tool in toolbar, place the mouse cursur near a line, hit Ctrl and left mouse button. Get the crash.

libreoffice


Fatal exception: Signal 11
Stack:
/usr/lib64/libreoffice/program/libuno_sal.so.3(+0x3aa10)[0x7fd0d13a8a10]
/usr/lib64/libreoffice/program/libuno_sal.so.3(+0x3abd8)[0x7fd0d13a8bd8]
/lib64/libc.so.6(+0x3caf0)[0x7fd0d10e8af0]
/usr/lib64/libreoffice/program/libsvxcorelo.so(_ZN7E3dView10BegDragObjERK5PointP12OutputDeviceP6SdrHdlsP13SdrDragMethod+0xaa)[0x7fd0cefe5c2a]
/usr/lib64/libreoffice/program/libsvxcorelo.so(_ZN11SdrDragView17ImpBegInsObjPointEbRK5PointbP12OutputDevice+0x22c)[0x7fd0cf09a64c]
/usr/lib64/libreoffice/program/../program/libsdlo.so(+0x406ad2)[0x7fd0a4771ad2]
/usr/lib64/libreoffice/program/../program/libsdlo.so(+0x5be861)[0x7fd0a4929861]
/usr/lib64/libreoffice/program/../program/libsdlo.so(+0x56c02e)[0x7fd0a48d702e]
/usr/lib64/libreoffice/program/libvcllo.so(+0x3bbd47)[0x7fd0cdcccd47]
/usr/lib64/libreoffice/program/libvcllo.so(+0x3bc234)[0x7fd0cdccd234]
/usr/lib64/libreoffice/program/libvcllo.so(+0x3bd457)[0x7fd0cdcce457]
/usr/lib64/libreoffice/program/libvclplug_gtk3_kde5lo.so(+0xf3445)[0x7fd0b9b5a445]
/usr/lib64/libreoffice/program/libvclplug_gtk3_kde5lo.so(+0xf4830)[0x7fd0b9b5b830]
/lib64/libgtk-3.so.0(+0x3b52fb)[0x7fd0b97042fb]
/lib64/libgobject-2.0.so.0(g_closure_invoke+0x19d)[0x7fd0cbfe6d8d]
/lib64/libgobject-2.0.so.0(+0x26d35)[0x7fd0cbff9d35]
/lib64/libgobject-2.0.so.0(g_signal_emit_valist+0x466)[0x7fd0cc002276]
/lib64/libgobject-2.0.so.0(g_signal_emit+0x82)[0x7fd0cc0031b2]
/lib64/libgtk-3.so.0(+0x3644e4)[0x7fd0b96b34e4]
/lib64/libgtk-3.so.0(+0x22de66)[0x7fd0b957ce66]
/lib64/libgtk-3.so.0(gtk_main_do_event+0x863)[0x7fd0b957eef3]
/lib64/libgdk-3.so.0(+0x392d5)[0x7fd0b928e2d5]
/lib64/libgdk-3.so.0(+0x690d2)[0x7fd0b92be0d2]
/lib64/libglib-2.0.so.0(g_main_context_dispatch+0x135)[0x7fd0cbf01665]
/lib64/libglib-2.0.so.0(+0x4d9e8)[0x7fd0cbf019e8]
/lib64/libglib-2.0.so.0(g_main_context_iteration+0x2c)[0x7fd0cbf01a6c]
/usr/lib64/libreoffice/program/libvclplug_gtk3_kde5lo.so(+0xa02d3)[0x7fd0b9b072d3]
/usr/lib64/libreoffice/program/libvcllo.so(+0x6182e2)[0x7fd0cdf292e2]
/usr/lib64/libreoffice/program/libvcllo.so(_ZN11Application7ExecuteEv+0x35)[0x7fd0cdf2ae85]
/usr/lib64/libreoffice/program/libsofficeapp.so(+0x31ce3)[0x7fd0d12dece3]
/usr/lib64/libreoffice/program/libvcllo.so(_Z10ImplSVMainv+0x52)[0x7fd0cdf31342]
/usr/lib64/libreoffice/program/libsofficeapp.so(soffice_main+0x7e)[0x7fd0d130531e]
/usr/lib64/libreoffice/program/soffice.bin[0x40106b]
/lib64/libc.so.6(__libc_start_main+0xeb)[0x7fd0d10d2b0b]
/usr/lib64/libreoffice/program/soffice.bin[0x4010aa]


Steps to Reproduce:
1. Draw a closed multiline
2. Select Point edition mode
3. Select Points insertion tool
4. Clic near the form with holding Ctrl
5. get the crash

Actual Results:
get the crash

Expected Results:
No Crash, point inserted


Reproducible: Always


User Profile Reset: No


OpenGL enabled: Yes

Additional Info:
Libreoffice provided by Mageia 7
Version: 6.2.8.2
Build ID: 6.2.8.2-1.mga7
Threads CPU : 4; OS : Linux 5.4; UI Render : par défaut; VCL: gtk3_kde5; 
Locale : fr-FR (fr_FR.UTF-8); Langue IHM : fr-FR
Calc: threaded
Comment 1 Roman Kuznetsov 2020-02-20 09:42:06 UTC
Yves, 

-can you attach a file example with your "closed multiline" here?

-can you try use more new LibreOffice version from libreoffice.org/download?
Comment 2 Yves57 2020-02-20 10:01:26 UTC
Created attachment 158030 [details]
Draw including a multilines form
Comment 3 Yves57 2020-02-20 10:03:20 UTC
I added a file example.
For a try with another release, I will try later.
Another user confirmed the crash with the same release.
Comment 4 QA Administrators 2020-02-21 02:50:43 UTC Comment hidden (obsolete)
Comment 5 Xisco Faulí 2020-02-21 15:34:22 UTC
Version: 7.0.0.0.alpha0+
Build ID: d7cab304e7dd22fd12443a1ee3b6a9c463bf9a3d
CPU threads: 4; OS: Linux 4.19; UI render: default; VCL: gtk3; 
Locale: en-US (en_US.UTF-8); UI-Language: en-US
Calc: threaded

Could you please try to reproduce it with the latest version of LibreOffice from https://www.libreoffice.org/download/libreoffice-fresh/ ?
I have set the bug's status to 'NEEDINFO'. Please change it back to 'UNCONFIRMED' if the bug is still present in the latest version.
Comment 6 Yves57 2020-02-21 17:22:58 UTC
Hello,
I can reproduce the crash with the just downloaded version.
crashreport.libreoffice.org/stats/crash_details/4cb63c1e-12f8-4b3e-ae0c-ea6273f5e56d

Note that the form has to be closed No crash occurs if the form is open.
Comment 7 Regina Henschel 2020-02-21 19:17:07 UTC
If I follow the steps, the insert mode is left immediately, when I press Ctrl-key. No crash.

But when I do these steps it crashes:
Start with insert a point and keep mouse button down. You see preview lines for the to be inserted point.
Press Ctrl-key, still mouse button down.
Release mouse button, still pressing Ctrl-key. A point is inserted.
Still pressing Ctrl-key, click somewhere in the shape.
Crash

Tested with Version: 7.0.0.0.alpha0+ (x64)
Build ID: cf96cb11e2a46c452a273ded1c66c556118983cf
CPU threads: 8; OS: Windows 10.0 Build 18362; UI render: default; VCL: win; 
Locale: de-DE (en_US); UI-Language: en-US
Calc: threaded
Comment 8 Xisco Faulí 2020-04-06 15:38:25 UTC
Can reproduce it. Steps:

1. Open attached document
2. Press F9
3. Select the shape
4. Click on insert point in toolbar
5. Click on the shape while holding Ctrl

Regression introduced by:

https://cgit.freedesktop.org/libreoffice/core/commit/?id=b4fc996520b47a6212661a9de3a1c72ccfc379a4

author	Noel Grandin <noel.grandin@collabora.co.uk>	2018-09-21 15:30:02 +0200
committer	Noel Grandin <noel.grandin@collabora.co.uk>	2018-09-25 13:57:36 +0200
commit	b4fc996520b47a6212661a9de3a1c72ccfc379a4 (patch)
tree	2dcb66d687dcdd1d91a75f9e498ca04742a7c564
parent	c30bdfbd22807e3f0c77f13a246ec243153ad7ae (diff)
loplugin:useuniqueptr in SdrHdlList

Bisected with: bibisect-linux64-6.2

Adding Cc: to Noel Grandin
Comment 9 Xisco Faulí 2020-04-06 15:54:52 UTC
Also reproduced in

Versión: 6.4.2.2 (x86)
Id. de compilación: 4e471d8c02c9c90f512f7f9ead8875b57fcb1ec3
Subprocs. CPU: 2; SO: Windows 6.1 Service Pack 1 Build 7601; Repres. IU: predet.; VCL: win; 
Configuración regional: es-ES (es_ES); Idioma de IU: es-ES
Calc: threaded
Comment 10 Xisco Faulí 2020-04-28 15:49:55 UTC
Created attachment 160034 [details]
before and after (with patch)
Comment 11 Regina Henschel 2020-04-28 17:42:43 UTC
I think the case distinction in /include/svx/svdhdl.hxx#462 is lost.

before b4fc996520b47a6212661a9de3a1c72ccfc379a4
SdrHdl* GetHdl(size_t nNum) const { return nNum<aList.size() ? aList[nNum] : nullptr; }

after
SdrHdl* GetHdl(size_t nNum) const { return maList[nNum].get(); }
Comment 12 Regina Henschel 2020-04-28 22:27:30 UTC
There seems to be an error in addition. The Ctrl-key toggles snap/no-snap when inserting glue points, but similar is broken (removed?) for inserting a path point. I see it working in OOo3.2.1, but not in AOO4.
If currently Ctrl-key is used, flow goes into the then-case in SdrPathObj::NbcInsPoint. And there a new one-point polygon is added to the selected polypolygon instead adding the point to the existing polygon in the else-case.
Comment 13 Noel Grandin 2020-04-29 06:18:46 UTC
(In reply to Regina Henschel from comment #11)
> I think the case distinction in /include/svx/svdhdl.hxx#462 is lost.
> 

Yes that was deliberate, to flush out code calling getHdl with a bad parameter.

I'll just revert that part since the svx code is such a nightmare it doesn't seem possible to fix properly (someone else is welcome to try and prove me wrong)
Comment 14 Commit Notification 2020-05-01 16:07:47 UTC
Noel Grandin committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/31a44b5d08a1419aa1693996376514db577a5e01

tdf#130792 Draw crashes when trying to add a point in a multiline

It will be available in 7.0.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 15 Xisco Faulí 2020-05-05 14:57:27 UTC
Verified in

Version: 7.0.0.0.alpha0+
Build ID: 017f90788c330d2e35a9c05a5...
CPU threads: 4; OS: Linux 4.19; UI render: default; VCL: gtk3; 
Locale: en-US (en_US.UTF-8); UI: en-US
Calc: threaded

@Noel, thanks for fixing this issue!
Comment 16 Commit Notification 2020-05-05 18:07:29 UTC
Noel Grandin committed a patch related to this issue.
It has been pushed to "libreoffice-6-4":

https://git.libreoffice.org/core/commit/ee74bd26ef3cd6522ed1687ee2ddc573fba36fff

tdf#130792 Draw crashes when trying to add a point in a multiline

It will be available in 6.4.5.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.