Bug 48569 - LibreOffice crashes when saving frames anchored as-character to .docx format
Summary: LibreOffice crashes when saving frames anchored as-character to .docx format
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
3.5 Daily
Hardware: All All
: medium critical
Assignee: Not Assigned
QA Contact:
URL:
Whiteboard: target:3.7.0 target:3.6.4 target:3.5.8
Keywords: regression
Depends on:
Blocks: mab3.6
  Show dependency treegraph
 
Reported: 2012-04-11 13:48 UTC by Alvaro Vivanco
Modified: 2012-10-18 09:23 UTC (History)
8 users (show)

See Also:
Crash report or crash signature:


Attachments
file in .odt (433.43 KB, application/vnd.oasis.opendocument.text)
2012-04-11 13:48 UTC, Alvaro Vivanco
Details
bt + console logs on master (12.30 KB, text/plain)
2012-09-07 20:46 UTC, Julien Nabet
Details
smaller reproducer (13.53 KB, application/vnd.oasis.opendocument.text)
2012-10-02 13:41 UTC, Caolán McNamara
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Alvaro Vivanco 2012-04-11 13:48:32 UTC
Created attachment 59816 [details]
file in .odt

To "save as" a odt file (with indices, styles, etc.) in Doc or docx format, LibreOffice is closed. It occurs in a single file "Tesis-final-rev-alva-odt.odt"
Comment 1 JJ Palacios 2012-05-28 02:58:56 UTC
Confirmed. LibreOffice closes unexpectedly when you try to save as .docx (Microsoft Word 2007/2010 XML) but work so fine if you try to save as .doc (Microsft Word 97/2000/XP/2003).
It looks like a problem with format conversion ".docx (Microsoft Word 2007/2010 XML)".
Comment 2 Joel Madero 2012-09-04 21:28:56 UTC
Confirmed with 3.7.0.0.alpha0 + (Build ID d801a8f). 

Setting as NEW, Prioritizing, Changing Title to only include .docx, nominating for most annoying bug
Comment 3 Julien Nabet 2012-09-07 20:46:11 UTC
Created attachment 66814 [details]
bt + console logs on master

On pc Debian x86-64 with master sources updated today, I reproduced the problem.
Attached bt + console logs.
Comment 4 Joel Madero 2012-09-07 20:51:42 UTC
Adding Michael.

@Michael - can you look into this one or recommend someone who might be able to?
Comment 5 Charles McCullough 2012-09-21 20:35:31 UTC
Confirmed Version 3.6.0.4 (Build ID: 932b512) on Windows XP.  I just tested the first attachment, and it does crash as stated when attempting to save in .docx format...
Comment 6 Roman Eisele 2012-09-22 09:14:10 UTC
(In reply to comment #5)
> Confirmed Version 3.6.0.4 (Build ID: 932b512) on Windows XP.

... and also REPRODUCIBLE with
* LibreOffice 3.5.6.2 (Build ID: e0fbe70-dcba98b-297ab39-994e618-0f858f0)
* LibreOffice 3.6.2.1 (Build ID: ba822cc)
on Mac OS X 10.6.8 (Intel). The stack trace is very similar to Julien’s Debian stack trace (just not as detailed), therefore I don’t attach it here.

→ Changed Platform to “All”.
Comment 7 Caolán McNamara 2012-10-02 13:41:19 UTC
Created attachment 67995 [details]
smaller reproducer
Comment 8 Caolán McNamara 2012-10-02 15:03:23 UTC
its straightforward why we crash. DocxAttributeOutput::m_pParentFrame is set to the address of something on the stack which doesn't exist when we go to use it.

Fixing it would be easier if I know what we were trying to do in .docx export of text frames.
Comment 9 Not Assigned 2012-10-11 11:27:53 UTC
Caolan McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=60a93729c95d31edab50a905236faa9e38a81556

Resolves: fdo#48569 crash on export to .docx of inline anchored frame



The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 10 Not Assigned 2012-10-12 16:18:55 UTC
Caolan McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-3-6":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=a010c4eaea6d6c45621a11d035f76266b0a5147c&g=libreoffice-3-6

Resolves: fdo#48569 crash on export to .docx of inline anchored frame


It will be available in LibreOffice 3.6.4.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 11 Not Assigned 2012-10-12 16:30:05 UTC
Caolan McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-3-5":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=1f865ac8e35326b01c9f3cb96fea313b53eb812b&g=libreoffice-3-5

Resolves: fdo#48569 crash on export to .docx of inline anchored frame


It will be available in LibreOffice 3.5.8.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 12 Joel Madero 2012-10-12 17:08:50 UTC
have we decided to do a 3.5.8? My understanding was 3.5.7 was end of 3.5?
Comment 13 Michael Meeks 2012-10-12 17:18:10 UTC
Worth having fixes there - in case we need to do a security release etc. :-)
Comment 14 Roman Eisele 2012-10-18 09:23:35 UTC
VERIFIED as FIXED:

While I can reproduce the crash on Mac OS X 10.6.8 (Intel) with
  LOdev 3.7.0.0.alpha0+ (build ID: 1ae1bca; pull time: 2012-10-09 04:37:06)
I can no longer reproduce it with
  LOdev 3.7.0.0.alpha0+ (build ID: c252694; pull time: 2012-10-12 22:05:41),
the first available daily build after the patch was committed.

Thank you very much for fixing this issue successfully!