Bug 159719 - SfxItemPool::IsInRange crash: save and reload in Impress or Draw
Summary: SfxItemPool::IsInRange crash: save and reload in Impress or Draw
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Impress (show other bugs)
(earliest affected) alpha0+
Hardware: x86-64 (AMD64) Linux (All)
: medium normal
Assignee: Armin Le Grand
Whiteboard: target:24.8.0
Keywords: bibisected, bisected, haveBacktrace, regression
: 159763 (view as bug list)
Depends on:
Blocks: Dev-related
  Show dependency treegraph
Reported: 2024-02-14 14:42 UTC by Buovjaga
Modified: 2024-04-08 18:11 UTC (History)
7 users (show)

See Also:
Crash report or crash signature:

GDB trace of crash (8.56 KB, text/plain)
2024-02-14 14:42 UTC, Buovjaga

Note You need to log in before you can comment on or make changes to this bug.
Description Buovjaga 2024-02-14 14:42:03 UTC
Created attachment 192562 [details]
GDB trace of crash

Use a debug build and save and reload a blank document in Impress or Draw and you will see a crash.

#0  0x00007a87925cbc4b in SfxItemPool::IsInRange (this=0x9999999999999999, nWhich=5508) at include/svl/itempool.hxx:308
Comment 1 Xisco Faulí 2024-02-14 15:06:41 UTC
Reproduced in

Version: (X86_64) / LibreOffice Community
Build ID: d677ed49bb975dbf3f810d27a5c6477e6df07cf2
CPU threads: 8; OS: Linux 6.1; UI render: default; VCL: gtk3
Locale: es-ES (es_ES.UTF-8); UI: en-US
Calc: threaded
Comment 2 Julien Nabet 2024-02-16 08:54:30 UTC
On pc Debian x86-64 with master sources updated today, I could reproduce this.

I don't reproduce this with LO Debian package
=> regression

Armin: one for you?
Comment 3 Julien Nabet 2024-02-18 13:40:52 UTC
*** Bug 159763 has been marked as a duplicate of this bug. ***
Comment 4 Gabor Kelemen (allotropia) 2024-03-20 14:48:42 UTC
Bibisect shows this started in:


commit ae7807c889c19145f89cec40afac82eee191837c (HEAD, refs/bisect/bad)
Author: Armin Le Grand (allotropia) <armin.le.grand.extern@allotropia.de>
Date:   Wed Jan 10 20:07:47 2024 +0100

    ITEM: No longer register Items at Pool

Indeed it happens only in dbgutil build, when the saved Impress file is reloaded.
Comment 5 Armin Le Grand 2024-03-29 16:47:36 UTC
Tried with

Version: (X86_64) / LibreOffice Community
Build ID: aef28c23adc87b8e26eacb56c7dbcf652e907fb9
CPU threads: 16; OS: Linux 6.5; UI render: default; VCL: gtk3
Locale: en-US (en_US.UTF-8); UI: en-US
Calc: threaded

on fresh master, gcc build on linux using

I tried:
- start LO
- new Impress
- save
- use menu 'reload'

-start LO
- new Impress
- save
- close
- load

...and also with restart LO and load

-> could not reproduce, sorry.
Comment 6 Armin Le Grand 2024-03-29 17:25:59 UTC
Looking at the attached stack: LineNumbers do not fit to master.
getTargetPool calls getTargetPool -> 1st IsInRange was false.
Uses mpSecondary for next call to getTargetPool, that gets us to a wrong this ptr -> mpSecondary is not initialized (?)

mpSecondary is a
    rtl::Reference<SfxItemPool>     mpSecondary;
and gets initialized in both constructors using
, mpSecondary()
(not really needed, but is even done) so should contain nullptr.

Another possibility may be SfxRequest_Impl::~SfxRequest_Impl: it destroys a set SfxPoolItemHolder aRetVal using the remembered pool. If that pool is already deleted that may happen (but would have led to problems before?).

There is also SfxRequest_Impl::SetPool that may change the pool member. In that case aRetVal *should* be reset which is not done yet. OTOH that was
    std::unique_ptr<SfxPoolItem> pRetVal; // Return value belongs to itself
before, so ~SfxPoolItem would have been called in the same situation, but would indeed *survive* without/changed/deleted pool. Hmmm...

Need to reproduce - any tipps..?
Comment 7 Julien Nabet 2024-03-29 18:26:43 UTC
(In reply to Armin Le Grand from comment #6)
> Need to reproduce - any tipps..?
You can try Regina's description (see https://bugs.documentfoundation.org/show_bug.cgi?id=159763#c0)
Comment 8 Armin Le Grand 2024-04-03 10:29:50 UTC
Thanks for the tipp, but also could not reproduce -> no hint until now...
Have tried multiple times again, with empty & reaload, current master, Regina's BugDoc, ... no crash here
Comment 9 Armin Le Grand 2024-04-05 09:00:02 UTC
Anyone? I can still not reproduce, guessing around...
Maybe someone has another stack?
Is someone willing who can reproduce to check if I offer a patch...?
Comment 10 Buovjaga 2024-04-05 11:27:08 UTC
(In reply to Armin Le Grand from comment #9)
> Anyone? I can still not reproduce, guessing around...
> Maybe someone has another stack?
> Is someone willing who can reproduce to check if I offer a patch...?

Sure, I can build your patch and check.
Comment 11 Armin Le Grand 2024-04-08 09:06:02 UTC
could you please try https://gerrit.libreoffice.org/c/core/+/165883
Comment 12 Commit Notification 2024-04-08 15:17:42 UTC
Armin Le Grand (allotropia) committed a patch related to this issue.
It has been pushed to "master":


tdf#159719 reset SfxPoolItemHolder when Pool changes

It will be available in 24.8.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:

Affected users are encouraged to test the fix and report feedback.
Comment 13 Armin Le Grand 2024-04-08 18:11:22 UTC
@ilmari.lauhakangas@libreoffice.org: Thanks for checking!