Bug 144565 - Crash in: SfxItemSet::Clone(bool,SfxItemPool *)
Summary: Crash in: SfxItemSet::Clone(bool,SfxItemPool *)
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
7.0.0.3 release
Hardware: All All
: high major
Assignee: Michael Stahl (allotropia)
URL:
Whiteboard: target:7.4.0 target:7.3.0.0.beta2 tar...
Keywords: bibisected, bisected, regression
Depends on:
Blocks:
 
Reported: 2021-09-17 07:22 UTC by Martin Sourada
Modified: 2021-12-24 09:37 UTC (History)
5 users (show)

See Also:
Crash report or crash signature: ["SfxItemSet::Clone(bool,SfxItemPool *)"]


Attachments
Problematic file (839.90 KB, application/vnd.oasis.opendocument.text)
2021-09-17 07:22 UTC, Martin Sourada
Details
data source (400 bytes, text/csv)
2021-09-17 07:23 UTC, Martin Sourada
Details
bt with debug symbols (5.13 KB, text/plain)
2021-09-18 10:37 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Sourada 2021-09-17 07:22:50 UTC
Created attachment 175090 [details]
Problematic file

This bug was filed from the crash reporting server and is br-8fcda1ca-3c3c-458e-b00b-8d21893fe9f7.
=========================================

Happens with one of the files my students created during Mail Merge lesson. Crashes when trying to generate merged documents. Crash is from 7.2.1.2, originaly problem happened in 7.1.5.2

Attached is both the problematic file and database source (cannot seem to get properly attached to the document, it needs to be loaded anew, under the name Adresy, as Text *.csv with UTF-8 encoding, for the connection to work).
Comment 1 Martin Sourada 2021-09-17 07:23:51 UTC
Created attachment 175091 [details]
data source

Source data (diplom-umisteni.csv, encoding utf-8)
Comment 2 Mike Kaganski 2021-09-17 08:42:17 UTC
Repro with current master: Version: 7.3.0.0.alpha0+ (x64) / LibreOffice Community
Build ID: d3e1d30ac7099584552ebf9c96dd21fdf7b1d9c9
CPU threads: 12; OS: Windows 10.0 Build 19043; UI render: Skia/Raster; VCL: win
Locale: ru-RU (ru_RU); UI: en-US
Calc: CL

and with Version: 7.0.0.3 (x64)
Build ID: 8061b3e9204bef6b321a21033174034a5e2ea88e
CPU threads: 12; OS: Windows 10.0 Build 19043; UI render: Skia/Raster; VCL: win
Locale: ru-RU (ru_RU); UI: en-US
Calc: CL

No crash with Version: 6.0.0.3 (x64)
Build ID: 64a0f66915f38c6217de274f0aa8e15618924765
CPU threads: 12; OS: Windows 10.0; UI render: GL; 
Locale: ru-RU (ru_RU); Calc: CL
Comment 3 Xisco Faulí 2021-09-17 12:29:36 UTC
Regression introduced by:

https://cgit.freedesktop.org/libreoffice/core/commit/?id=166b5010b402a41b192b1659093a25acf9065fd9

author	Michael Stahl <Michael.Stahl@cib.de>	2020-04-02 17:18:37 +0200
committer	Michael Stahl <michael.stahl@cib.de>	2020-04-03 17:20:22 +0200
commit	166b5010b402a41b192b1659093a25acf9065fd9 (patch)
tree	58a783dfc1800c604979380c121337ada3e5ad6f
parent	27aa4b16bf704d0246595750daf57b57ff2577b3 (diff)
tdf#130685 sw_redlinehide: fix copying to position following redline

Bisected with: bibisect-linux64-7.0

Adding Cc: to Michael Stahl
Comment 4 Julien Nabet 2021-09-18 10:37:38 UTC
Created attachment 175102 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today + gen rendering, I got a crash but when using printing and the bt is different.
I put it just as info since it must be another bug but did I miss something to reproduce the original pb unless it's Windows only?

Also, gdb shows this:
    i_pSetupData=0x92c6350, i_rController=...) at vcl/unx/generic/print/genprnpsp.cxx:1162
1162	                                    size_t nBytesWritten = fwrite(buffer.data(), 1, nBytesRead, fp);
(gdb) p buffer
$1 = std::__debug::vector of length 65536, capacity 65536 = {-123 '\205', 113 'q', -94 '\242', 19 '\023', -36 '\334', 103 'g', 127 '\177', 56 '8', 23 '\027', -32 '\340', -45 '\323', 65 'A', -5 '\373', 
  -1 '\377', -118 '\212', -4 '\374', 60 '<', 55 '7', 20 '\024', 116 't', -124 '\204', 113 'q', -37 '\333', -61 '\303', 51 '3', -81 '\257', 110 'n', 60 '<', 16 '\020', 78 'N', 98 'b', 88 'X', 80 'P', 
  -120 '\210', 58 ':', 39 '\'', -113 '\217', -92 '\244', 0 '\000', 5 '\005', 4 '\004', 12 '\f', 28 '\034', 96 '`', -30 '\342', -32 '\340', 11 '\v', -31 '\341', -32 '\340', 43 '+', -122 '\206', -63 '\301', 
  21 '\025', 73 'I', -92 '\244', 35 '#', 10 '\n', -81 '\257', 8 '\b', -83 '\255', 94 '^', 3 '\003', -52 '\314', 24 '\030', 49 '1', 31 '\037', -49 '\317', -101 '\233', 29 '\035', 25 '\031', -30 '\342', 43 '+', 
  -7 '\371', 17 '\021', 1 '\001', -54 '\312', 100 'd', 69 'E', -52 '\314', -119 '\211', 24 '\030', -17 '\357', 115 's', 50 '2', 117 'u', -2 '\376', 23 '\027', 26 '\032', -64 '\300', -72 '\270', 30 '\036', 
  19 '\023', 11 '\v', 68 'D', 3 '\003', -113 '\217', 101 'e', 34 '"', -127 '\201', -108 '\224', 15 '\017', 12 '\f', 39 '\'', -87 '\251', -128 '\200', 47 '/', -41 '\327', 72 'H', -80 '\260', 31 '\037', 
  -109 '\223', 72 'H', 78 'N', -88 '\250', -96 '\240', -22 '\352', 61 '=', -96 '\240', 60 '<', 97 'a', -114 '\216', -117 '\213', 4 '\004', -100 '\234', -119 '\211', 84 'T', 36 '$', 124 '|', -4 '\374', 
  -124 '\204', -101 '\233', 87 'W', 64 '@', -64 '\300', 72 'H', 20 '\024', -78 '\262', 17 '\021', 67 'C', 127 '\177', -119 '\211', -75 '\265', 75 'K', 66 'B', 18 '\022', -9 '\367', 118 'v', 104 'h', 81 'Q', 
  -67 '\275', 91 '[', 94 '^', -67 '\275', 119 'w', 121 'y', -97 '\237', 19 '\023', -101 '\233', 7 '\a', -108 '\224', -16 '\360', -76 '\264', -40 '\330', 51 '3', 120 'x', -42 '\326', -63 '\301', 68 'D', 9 '\t', 
  -7 '\371', 67 'C', -55 '\311', 15 '\017', -48 '\320', 48 '0', 40 '(', 37 '%', -87 '\251', 19 '\023', 55 '7', 102 'f', -28 '\344', -11 '\365', -83 '\255', -93 '\243', -28 '\344', 38 '&', -124 '\204', 
  -68 '\274', -36 '\334', 24 '\030', -20 '\354', -55 '\311', 109 'm', 3 '\003', 91 '[', -96 '\240', -78 '\262', -128 '\200', -78 '\262'...}
(gdb) p nBytesRead
$2 = 65536
(gdb) p buffer.size()
$3 = 65536

Does it mean buffer is corrupted, if yes why? if not, what's the pb then?
Comment 5 Commit Notification 2021-12-16 17:18:38 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/42448f48bb48a13d6618a181b12840db6d85c574

tdf#144565 sw_redlinehide: fix mailmerge when flys anchored at last node

It will be available in 7.4.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 6 Commit Notification 2021-12-17 10:26:32 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-7-3":

https://git.libreoffice.org/core/commit/729a880865fa221e399c6ce46bf8cb553812216a

tdf#144565 sw_redlinehide: fix mailmerge when flys anchored at last node

It will be available in 7.3.0.0.beta2.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 7 Michael Stahl (allotropia) 2021-12-17 10:28:45 UTC
fixed on master
Comment 8 Commit Notification 2021-12-24 09:37:41 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-7-2-5":

https://git.libreoffice.org/core/commit/6df93ba3fd93110b5d5678446d9a97b034edfc28

tdf#144565 sw_redlinehide: fix mailmerge when flys anchored at last node

It will be available in 7.2.5.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.