Bug 166335 - FILESAVE DOCX Word fails to open roundtripped document (issue with shape guides/glue points)
Summary: FILESAVE DOCX Word fails to open roundtripped document (issue with shape guid...
Status: ASSIGNED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: filters and storage (show other bugs)
Version:
(earliest affected)
25.2.2.2 release
Hardware: All All
: medium normal
Assignee: Tibor Nagy
URL:
Whiteboard:
Keywords: bibisected, bisected, regression
Depends on:
Blocks: OOXML-Shapes DOCX-Corrupted
  Show dependency treegraph
 
Reported: 2025-04-25 13:45 UTC by Aron Budea
Modified: 2025-06-26 06:30 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:


Attachments
Simple repro case (14.20 KB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2025-06-26 06:26 UTC, Phillip
Details
Simple repro case, after round-trip (6.19 KB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2025-06-26 06:27 UTC, Phillip
Details
Partial repro case (15.04 KB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2025-06-26 06:27 UTC, Phillip
Details
Partial repro case, after round-trip in version before issue (6.25 KB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2025-06-26 06:27 UTC, Phillip
Details
Partial repro case, after round-trip in version with issue (6.55 KB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2025-06-26 06:28 UTC, Phillip
Details
Partial repro case, after round-trip in version after issue partially resolved (6.47 KB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2025-06-26 06:28 UTC, Phillip
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Aron Budea 2025-04-25 13:45:40 UTC
Open and save attachment 115291 [details] from bug 91061 back to DOCX, then try opening it in Word.

=> Word fails to open the file cleanly.

Observed using LO 25.8.0.0.alpha0+ (736998ccef0bacdd2bbf038c98dacfbe654f1a4d) / Windows.

If one:
- unzips the saved DOCX,
- executes the following command (can be done in Linux/Cygwin, needs xmllint installed): find . -name "*.xml" -type f -exec xmllint --output '{}' --format '{}' \;
- rezips the result with .docx extension

...then Word points to line 204 of /word/document.xml, which is the end of an <a:custGeom> element.
The element has lots of shape guides/gluepoints.

This is a regression from the following commit in 25.8 (and its 25.2 backport):
https://git.libreoffice.org/core/commit/86d36ee56521438069504fbacff8dc2aff3a1afc
https://cgit.freedesktop.org/libreoffice/core/commit/?id=86d36ee56521438069504fbacff8dc2aff3a1afc
author		Tibor Nagy <tibor.nagy.extern@allotropia.de>	Sun Feb 23 21:35:17 2025 +0100
committer	Nagy Tibor <tibor.nagy.extern@allotropia.de>	Mon Feb 24 14:22:14 2025 +0100

"tdf165262 PPTX export: fix shape export regression"

Those suspicious gluepoints aren't there when exported from a build preceding the regressing commit.
Based on basic research, it looks like "logwidth" isn't an allowed formula element for shape guides, eg.:
<a:gd name="GluePoint1Y" fmla="3048002*logwidth/6096000"/>

List of test files regressing from the same commit:
fdo75230-1.docx
fdo83227-3.docx
forum-mso-en-11007.docx
forum-mso-en-12264.docx
forum-mso-en-12822.docx
forum-mso-en-16347.docx
forum-mso-en-16497.docx
forum-mso-en-17960.docx
forum-mso-en-3360.docx
forum-mso-en-4455.docx
forum-mso-en-4463.docx
forum-mso-en-4464.docx
forum-mso-en4-598647.docx
forum-mso-en4-746483.docx
forum-mso-en4-771610.docx
forum-mso-en-5509.docx
forum-mso-en-5558.docx
forum-mso-en-6088.docx
forum-mso-en-970.docx
forum-mso-en-974.docx
ooo123731-1.docx
tdf91061-1.docx
Comment 1 Aron Budea 2025-05-25 10:25:39 UTC
17 PPTX files as well:

fdo46987-1.pptx
fdo49299-2.pptx
forum-mso-de-71272.pptx
forum-mso-en-5867.pptx
moz1121066-2.pptx
moz1121068-2.pptx
moz1164516-1.pptx
novell742593-1.pptx
ooo121597-1.pptx
tdf100390-3.pptx
tdf106011-1.pptx
tdf111857-4.pptx
tdf126572-3.pptx
tdf59019-6.pptx
tdf65724-6.pptx
tdf90898-4.pptx
tdf92076-2.pptx
Comment 2 Aron Budea 2025-05-25 16:05:39 UTC
And some more. These first started crashing from the regressing commit in the description. The following commit fixed the crash, but the result files are corrupted:
https://git.libreoffice.org/core/commit/61e1e38595e95e228168e8385662fe3bcd4c80e1
author		Caolán McNamara <caolan.mcnamara@collabora.com>	Sun Apr 06 15:34:03 2025 +0100
committer	Caolán McNamara <caolan.mcnamara@collabora.com>	Sun Apr 06 18:24:16 2025 +0200

crashtesting: out of bounds in export of tdf128404-1.ppt to pptx

fdo40483-1.pptx
fdo56864-1.pptx
forum-mso-de-136104.pptx
kde286114-1.pptx
kde334850-1.pptx
novell347597-1.pptx
ooo119582-1.pptx
ooo119583-1.pptx
ooo119584-1.pptx
rhbz615970-1.pptx
tdf112868-1.pptx
tdf127396-1.pptx
tdf128404-1.pptx
tdf136754-2.pptx
tdf95345-1.pptx
Comment 3 Phillip 2025-06-26 06:26:49 UTC
Created attachment 201482 [details]
Simple repro case
Comment 4 Phillip 2025-06-26 06:27:11 UTC
Created attachment 201483 [details]
Simple repro case, after round-trip
Comment 5 Phillip 2025-06-26 06:27:26 UTC
Created attachment 201484 [details]
Partial repro case
Comment 6 Phillip 2025-06-26 06:27:54 UTC
Created attachment 201485 [details]
Partial repro case, after round-trip in version before issue
Comment 7 Phillip 2025-06-26 06:28:11 UTC
Created attachment 201486 [details]
Partial repro case, after round-trip in version with issue
Comment 8 Phillip 2025-06-26 06:28:32 UTC
Created attachment 201487 [details]
Partial repro case, after round-trip in version after issue partially resolved
Comment 9 Phillip 2025-06-26 06:29:47 UTC
I'm having what I believe to be this issue, and figured I should post what I've found in my investigation in case it's at all helpful for y'all to fix this.

To reproduce:
* Open attachment 201482 [details] in LO
* Resave as DOCX: attachment 201483 [details]
* Attempt to open in Word

Error message:
  We're sorry. We can't open repro_post_25.2.4.3.docx because we found a problem with its contents.
  
  The parameter is incorrect.
  
  Location: Part: /word/document.xml, Line: 0, Column: 0

I've reproduced the error in: 25.2.2.2, 25.2.3.2, 25.2.4.3, 25.8.0.0.beta1, and the latest nightly (2025-06-26_05.47.46). This document works without error in 25.2.1.2

In working to reproduce this, I have another doc that failed in 25.2.2.2, but _works_ in 25.2.3.2
* Source doc attachment 201484 [details]
* Round trip through 25.2.1.2 (works) attachment 201484 [details]
* Round trip through 25.2.2.2 (fails) attachment 201485 [details]
* Round trip through 25.2.3.2 (works) attachment 201486 [details]

So I believe that this issue was introduced in 25.2.2.2 and was _partially_ resolved in 25.2.3.2, but in part still remains.

I'm not sure exactly what the cause is, I tried poking around inside the XML but I'm way over my head there. I did notice that, in the doc that is still failing, there are <a:gd> elements with a formula that starts with +- while in the doc that is now working, all the <a:gd> elements start with */ ... and this seems to be consistent with the documents I've checked from customers reporting issues, all the ones that are still failing contain +- formulas. I couldn't begin to tell you what that means, though, I just hope it's useful info.