Bug 151630 - LibreOffice crashes when saving this file as .docx
Summary: LibreOffice crashes when saving this file as .docx
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
(earliest affected) release
Hardware: All All
: medium normal
Assignee: Not Assigned
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks: Crash
  Show dependency treegraph
Reported: 2022-10-18 21:40 UTC by berwyn
Modified: 2024-02-09 22:20 UTC (History)
7 users (show)

See Also:
Crash report or crash signature:

Document that causes the crash. It is a Greek grammar summary. (88.54 KB, application/vnd.oasis.opendocument.text)
2022-10-18 21:43 UTC, berwyn
bt + console logs (16.87 KB, text/plain)
2022-10-19 14:39 UTC, Julien Nabet

Note You need to log in before you can comment on or make changes to this bug.
Description berwyn 2022-10-18 21:40:56 UTC
LibreOffice crashes when saving this file as .docx

Steps to Reproduce:
1. Open the attached document
2. Save as .docx

Actual Results:
Libreoffice just closes without any messages. It does not create the .docx file.

Expected Results:
It should have created the .docx and should not have crashed.

Reproducible: Always

User Profile Reset: No

Additional Info:
Version: / LibreOffice Community
Build ID: 40(Build:3)
CPU threads: 8; OS: Linux 5.4; UI render: default; VCL: gtk3
Locale: en-NZ (en_NZ.UTF-8); UI: en-US
Ubuntu package version: 1:7.4.2~rc3-0ubuntu0.20.04.1~lo1
Calc: threaded
Comment 1 berwyn 2022-10-18 21:43:32 UTC
Created attachment 183124 [details]
Document that causes the crash. It is a Greek grammar summary.
Comment 2 Telesto 2022-10-19 12:17:54 UTC
Version: / LibreOffice Community
Build ID: 7a89eae97a970939174d59aa58147eaa194acaee
CPU threads: 8; OS: Mac OS X 12.3.1; UI render: Skia/Raster; VCL: osx
Locale: nl-NL (nl_NL.UTF-8); UI: en-US
Calc: threaded
Comment 3 Julien Nabet 2022-10-19 14:39:57 UTC
Created attachment 183132 [details]
bt + console logs

On pc Debian x86-64 with master sources updated today, I could reproduce this.
I attached bt with console logs.
Comment 4 Julien Nabet 2022-10-19 14:52:05 UTC
It's related to: 35732c84b05e4f6e50349796636beb01f2a09907
tdf#121509 DOCX export: fix corrupt shape anchoring in textbox
    MSO doesn't support shapes anchored to character in a textbox.
    Convert these shapes by re-anchoring them to the anchor
    point of the textbox (also recalculating their positions in
    simple cases), so Word can now open the exported document.
Comment 5 Julien Nabet 2022-10-19 14:58:40 UTC
Quick and dirty patch which prevents LO from crashing but add some glitch at right of first page (and perhaps others):
diff --git a/sw/source/filter/ww8/docxattributeoutput.cxx b/sw/source/filter/ww8/docxattributeoutput.cxx
index f6c8ff6902b9..0aeb8e6d3827 100644
--- a/sw/source/filter/ww8/docxattributeoutput.cxx
+++ b/sw/source/filter/ww8/docxattributeoutput.cxx
@@ -6760,6 +6760,7 @@ void DocxAttributeOutput::OutputFlyFrame_Impl(const ww8::Frame& rFrame, const Po
+                it = m_vPostponedFlys.begin();
                 it = m_vPostponedFlys.erase(it);

It seems WriteFlyFrame may change m_vPostponedFlys:
#0  DocxAttributeOutput::OutputFlyFrame_Impl(ww8::Frame const&, Point const&) (this=0x56546ebd99f0, rFrame=...) at sw/source/filter/ww8/docxattributeoutput.cxx:6796
#1  0x00007fa7d53c0a7d in AttributeOutputBase::OutputFlyFrame(ww8::Frame const&) (this=0x56546ebd99f0, rFormat=...) at sw/source/filter/ww8/wrtw8nds.cxx:3497
#2  0x00007fa7d53c050c in SwWW8AttrIter::OutFlys(int) (this=0x7ffc34f27dd8, nSwPos=0) at sw/source/filter/ww8/wrtw8nds.cxx:749
#3  0x00007fa7d53cb8f8 in MSWordExportBase::OutputTextNode(SwTextNode&) (this=0x7ffc34f2fd70, rNode=...) at sw/source/filter/ww8/wrtw8nds.cxx:2431
#4  0x00007fa7d53d3f68 in MSWordExportBase::OutputContentNode(SwContentNode&) (this=0x7ffc34f2fd70, rNode=...) at sw/source/filter/ww8/wrtw8nds.cxx:3561
#5  0x00007fa7d5478509 in MSWordExportBase::WriteText() (this=0x7ffc34f2fd70) at sw/source/filter/ww8/wrtww8.cxx:2813
#6  0x00007fa7d52852f7 in DocxSdrExport::writeDMLTextFrame(ww8::Frame const*, int, bool) (this=0x56546eb33400, pParentFrame=0x7ffc34f2a158, nAnchorId=59, bTextBoxOnly=true)
    at sw/source/filter/ww8/docxsdrexport.cxx:1975
#7  0x00007fa7d51918a5 in DocxAttributeOutput::WriteTextBox(com::sun::star::uno::Reference<com::sun::star::drawing::XShape>) (this=0x56546ebd99f0, xShape=uno::Reference to (SwXShape *) 0x56546ba15500)
    at sw/source/filter/ww8/docxattributeoutput.cxx:6916
#8  0x00007fa7d6111324 in oox::drawingml::ShapeExport::WriteTextBox(com::sun::star::uno::Reference<com::sun::star::uno::XInterface> const&, int, bool)
     (this=0x7ffc34f2ba08, xIface=uno::Reference to (SwXShape *) 0x56546ba15500, nXmlNamespace=5807, bWritePropertiesAsLstStyles=false) at oox/source/export/shapes.cxx:2034
#9  0x00007fa7d6115d88 in oox::drawingml::ShapeExport::WriteCustomShape(com::sun::star::uno::Reference<com::sun::star::drawing::XShape> const&)
    (this=0x7ffc34f2ba08, xShape=uno::Reference to (SwXShape *) 0x56546ba15500) at oox/source/export/shapes.cxx:1112
#10 0x00007fa7d6112a3e in oox::drawingml::ShapeExport::WriteShape(com::sun::star::uno::Reference<com::sun::star::drawing::XShape> const&)
    (this=0x7ffc34f2ba08, xShape=uno::Reference to (SwXShape *) 0x56546ba15500) at oox/source/export/shapes.cxx:2008
#11 0x00007fa7d524e8e6 in DocxExport::OutputDML(com::sun::star::uno::Reference<com::sun::star::drawing::XShape> const&) (this=0x7ffc34f2fd70, xShape=uno::Reference to (SwXShape *) 0x56546ba15500)
    at sw/source/filter/ww8/docxexport.cxx:515
#12 0x00007fa7d528051b in DocxSdrExport::writeDMLDrawing(SdrObject const*, SwFrameFormat const*, int) (this=0x56546eb33400, pSdrObject=0x56546b94fb20, pFrameFormat=0x56546b970080, nAnchorId=58)
    at sw/source/filter/ww8/docxsdrexport.cxx:1437
#13 0x00007fa7d5281987 in DocxSdrExport::writeDMLAndVMLDrawing(SdrObject const*, SwFrameFormat const&, int) (this=0x56546eb33400, sdrObj=0x56546b94fb20, rFrameFormat=..., nAnchorId=58)
    at sw/source/filter/ww8/docxsdrexport.cxx:1586
#14 0x00007fa7d518fa5b in DocxAttributeOutput::WriteFlyFrame(ww8::Frame const&) (this=0x56546ebd99f0, rFrame=...) at sw/source/filter/ww8/docxattributeoutput.cxx:6621
#15 0x00007fa7d5190835 in DocxAttributeOutput::OutputFlyFrame_Impl(ww8::Frame const&, Point const&) (this=0x56546ebd99f0, rFrame=...) at sw/source/filter/ww8/docxattributeoutput.cxx:6764
Comment 6 Aron Budea 2022-10-20 00:31:13 UTC
(In reply to Julien Nabet from comment #4)
> It's related to: 35732c84b05e4f6e50349796636beb01f2a09907
> tdf#121509 DOCX export: fix corrupt shape anchoring in textbox

Yes, it's a regression from that fix.
Comment 7 Tex2002ans 2024-02-09 22:20:40 UTC
Followed comment 0 exactly.


- https://crashreport.libreoffice.org/stats/crash_details/fc32bdd8-2e54-4c43-82bb-a63a096ace5f


Version: (X86_64) / LibreOffice Community
Build ID: da48488a73ddd66ea24cf16bbc4f7b9c08e9bea1
CPU threads: 8; OS: Windows 10.0 Build 22631; UI render: Skia/Vulkan; VCL: win
Locale: en-US (en_US); UI: en-US
Calc: CL threaded