Bug 151654 - CRASH in SdrLayerIDSet::IsSet(o3tl::strong_int<short,SdrLayerIDTag>)
Summary: CRASH in SdrLayerIDSet::IsSet(o3tl::strong_int<short,SdrLayerIDTag>)
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Impress (show other bugs)
Version:
(earliest affected)
7.4.0.0 alpha0+
Hardware: All Windows (All)
: high major
Assignee: Not Assigned
URL:
Whiteboard: target:7.5.0 target:7.4.3
Keywords: bibisected, bisected, regression
Depends on:
Blocks: Crash
  Show dependency treegraph
 
Reported: 2022-10-20 10:27 UTC by Xisco Faulí
Modified: 2023-04-24 15:08 UTC (History)
5 users (show)

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Xisco Faulí 2022-10-20 10:27:18 UTC
I can only reproduce this issue on Windows

Steps to reproduce:
1. Open Impress
2. Type hello
3. Select the text
4. Duplicate slide from the menu so the text is still in edit mode. Slide - Duplicate
5. Repeat step 4 5-6 times

-> Crash

Reproduced in

Version: 7.5.0.0.alpha0+ (x64) / LibreOffice Community
Build ID: 922b79a0f5a9151a6870ba395abcac5b54055275
CPU threads: 16; OS: Windows 6.3 Build 9600; UI render: Skia/Raster; VCL: win
Locale: en-GB (en_GB); UI: en-US
Calc: threaded
Comment 1 Xisco Faulí 2022-10-20 10:28:03 UTC
Regression introduced by:

author	Mike Kaganski <mike.kaganski@collabora.com>	2021-09-07 12:16:24 +0200
committer	Mike Kaganski <mike.kaganski@collabora.com>	2022-02-23 16:00:28 +0100
commit f4a62e5479b47d90d6de518f38a97ac0b5322c54 (patch)
tree ff1a90880f5ed9de959a66b447b0b182c32fea94
parent 4751853b19dabfb57963c58183b0c3557328b3b8 (diff)
SdrLayerID must be based on sal_Int16

Bisected with: win64-7.4

Adding Cc: to Mike Kaganski
Comment 2 Mike Kaganski 2022-10-30 20:29:50 UTC
I couldn't repro using Version: 7.5.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 824b70fc473f96fca480f3d0d64f63234666db2b
CPU threads: 12; OS: Windows 10.0 Build 19044; UI render: Skia/Raster; VCL: win
Locale: en-US (ru_RU); UI: en-US
Calc: CL threaded

I tried several times, each time repeating step 4 until there were 15-25 copies.
Comment 3 Telesto 2022-10-30 20:46:23 UTC
I can't reproduce comment 0, but I do reproduce this
1. Open Impress (without template)
2. Enter a 'textbox' and type Hello
3. CTRL+A
4. Menubar -> Slide ->  Duplicate slide 
5. Type something
6. Exit the Textbox by clicking somewhere on the slide -> Crash
7. Repeat 1-6: Notice a dangling soffice.bin after the crash (but similar bug is reported already)

Version: 7.5.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 9cd0f4c2d25462feba0ffcbd906c199273821243
CPU threads: 4; OS: Windows 6.3 Build 9600; UI render: Skia/Raster; VCL: win
Locale: nl-NL (nl_NL); UI: en-US
Calc: CL threaded
Comment 4 Mike Kaganski 2022-10-31 05:25:17 UTC
https://gerrit.libreoffice.org/c/core/+/142054 addresses comment #3.
Comment 5 Commit Notification 2022-10-31 06:57:16 UTC
Mike Kaganski committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/7fc2aefc09956bee0353575d2bacca2d5b556b04

tdf#151654 related: dereference after nullptr check

It will be available in 7.5.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 6 Commit Notification 2022-11-01 19:07:44 UTC
Mike Kaganski committed a patch related to this issue.
It has been pushed to "libreoffice-7-4":

https://git.libreoffice.org/core/commit/300ad9206743c8c216a90d7d4d55f5b0477889ad

tdf#151654 related: dereference after nullptr check

It will be available in 7.4.3.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 7 Kevin Suo 2022-11-02 07:34:27 UTC
Updated version to 7.4.0.0 alpha0+ according to the bisected commit.
Comment 8 Xisco Faulí 2023-04-24 15:06:39 UTC
I can't reproduce it in

Version: 7.5.1.2 (X86_64) / LibreOffice Community
Build ID: fcbaee479e84c6cd81291587d2ee68cba099e129
CPU threads: 1; OS: Windows 10.0 Build 19044; UI render: Skia/Raster; VCL: win
Locale: en-US (en_US); UI: en-US
Calc: threaded

Closing.
@Mike, thanks for fixing this issue!!
Comment 9 Xisco Faulí 2023-04-24 15:08:44 UTC
According to https://crashreport.libreoffice.org/stats/signature/SdrLayerIDSet::IsSet(o3tl::strong_int%3Cshort,SdrLayerIDTag%3E)#summary, this crash hasn't been reported since 7.4.3