Steps to reproduce: 1. Open attachment 72790 [details] from bug 47782 ( at least in my case, I reproduce the crash more reliable cleaning the profile and using GEN: rm -rf instdir/user/ && SAL_USE_VCLPLUGIN=gen instdir/program/soffice /home/xisco/Downloads/fdo47782-1.docx ) -> it crashes Reproduced in Version: 26.2.0.0.alpha0+ (X86_64) / LibreOffice Community Build ID: e7c3b635387a4b207998a70fec46328642966d71 CPU threads: 8; OS: Linux 6.1; UI render: default; VCL: x11 Locale: es-ES (es_ES.UTF-8); UI: en-US Calc: threaded
Regression introduced by: commit 4e469136136aed27df73a77080262b26b85f37f1 [log] author Caolán McNamara <caolan.mcnamara@collabora.com> Thu Aug 07 21:49:54 2025 +0100 committer Caolán McNamara <caolan.mcnamara@collabora.com> Fri Aug 08 09:46:03 2025 +0200 tree b77c095762f3a08b428bad990d9268b206e91645 parent 6e870c040bb0f550c126f0fdeb2b9cd497658dd0 [diff] cid#1660822 Different smart pointers managing same raw pointer Bisected with: linux64-26.2
I found other documents also affected by the same issue: - attachment 52901 [details] from bug 42371 - attachment 43749 [details] from bug 34663 - attachment 58874 [details] from bug 47720 - attachment 46642 [details] from bug 34268
I think this messy function required a previous "GetPara" to reset its state so that a following SetPara did the right thing. And by dropping the GetPara and making SetPara return the old para at that point we skip the important bit. I think I can fix this, but this is a subtle tricky thing. So I suggest I revert the 25-8 backport of the regression commit and leave that branch as it was and try this follow up in trunk and monitor for future problems.
(In reply to Caolán McNamara from comment #3) > I think this messy function required a previous "GetPara" to reset its state > so that a following SetPara did the right thing. And by dropping the GetPara > and making SetPara return the old para at that point we skip the important > bit. I think I can fix this, but this is a subtle tricky thing. So I suggest > I revert the 25-8 backport of the regression commit and leave that branch as > it was and try this follow up in trunk and monitor for future problems. it sounds like a good plan. libreoffice-25-8 commit reverted in https://gerrit.libreoffice.org/c/core/+/189955
oh, we reverted it at the same time. I abandoned mine in favour of https://gerrit.libreoffice.org/c/core/+/189954
Caolán McNamara committed a patch related to this issue. It has been pushed to "master": https://git.libreoffice.org/core/commit/5cdefeef2a079430fc32bace349bdc53ab740779 Resolves: tdf#168017 fix a crash loading some documents It will be available in 26.2.0. The patch should be included in the daily builds available at https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: https://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Xisco Fauli committed a patch related to this issue. It has been pushed to "master": https://git.libreoffice.org/core/commit/2b376f97b77815a1f28d441841ac7e09d5beae79 tdf#168017: sw_ooxmlexport16: Add test It will be available in 26.2.0. The patch should be included in the daily builds available at https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: https://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.