Bug Hunting Session
Bug 61016 - FILEOPEN: Open docx result in crash/STL assertion due to recursive calls to deleteMark
Summary: FILEOPEN: Open docx result in crash/STL assertion due to recursive calls to d...
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
4.1.0.0.alpha0+ Master
Hardware: All Linux (All)
: high critical
Assignee: Michael Stahl (CIB)
URL:
Whiteboard: BSA target:4.1.0 target:4.0.2
Keywords: regression
Depends on:
Blocks:
 
Reported: 2013-02-17 18:25 UTC by Jorendc
Modified: 2013-03-01 08:48 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:


Attachments
Backtrace log (69.78 KB, text/x-log)
2013-02-17 18:25 UTC, Jorendc
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Jorendc 2013-02-17 18:25:13 UTC
Created attachment 74997 [details]
Backtrace log

Problem description: Open 52774 (Bug 42253) file result in crash

Steps to reproduce:
1. Download https://bugs.freedesktop.org/attachment.cgi?id=52774
2. Open this file using LibreOffice master 

Tested using Linux Mint 14 x64 LibreOffice Version 4.1.0.0.alpha0+ (Build ID: c16e9f4ed97f65357e9986f46ad88ee9f223799)

Current behavior: Crash

Expected behavior: like in version LibreOffice 4.0.0 release, no crash

              
Operating System: Linux (Other)
Version: 4.1.0.0.alpha0+ Master
Last worked in: 4.0.0.3 release
Comment 1 Jorendc 2013-02-17 18:30:56 UTC
This is possible a duplicate of Bug 61000, but I'm not that sure (see backtrace log):

#3  0x00007ffff6ccb192 in __GI___assert_fail (assertion=0x7fffc7472290 "!\"Incorrect argument to UNO call\"", file=0x7fffc7472248 "/home/joren/core/writerfilter/source/dmapper/NumberingManager.cxx", line=650, function=0x7fffc7476800 <writerfilter::dmapper::ListDef::CreateNumberingRules(writerfilter::dmapper::DomainMapper&, com::sun::star::uno::Reference<com::sun::star::lang::XMultiServiceFactory>)::__PRETTY_FUNCTION__> "void writerfilter::dmapper::ListDef::CreateNumberingRules(writerfilter::dmapper::DomainMapper&, com::sun::star::uno::Reference<com::sun::star::lang::XMultiServiceFactory>)") at assert.c:103
Comment 2 Brenda Granados 2013-02-18 15:25:19 UTC
Hi, I opened this document using Version 4.0.1.0+ (Build ID: 3e8af168ca227529b752abb9c7aecc42be4a229) and there was no crash. I am using Ubuntu 12.04.
Comment 3 Joel Madero 2013-02-19 03:20:31 UTC
Indeed, master it's broken.

New
Agree with critical, think it should be high though so I upped it a bit :-D


Thanks Joren for the backtrace
Comment 4 Michael Stahl (CIB) 2013-02-19 18:08:23 UTC
assertion was added in fb68711fc3fbab99e47cc94f5abd27b1425bc468
Comment 5 Not Assigned 2013-02-28 13:11:22 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=5bf6797e81d54177508d3eb370e8242e3b58a3f8

fdo#61016: sw::marks::MarkManager: delay deletion of text fieldmarks



The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 6 Michael Stahl (CIB) 2013-02-28 13:33:15 UTC
it didn't crash like the description says here, but differently,
with a STL assertion from recursive calls of MarkManager::deleteMark
via TextFieldmark::ReleaseDoc deleting its dummy character,
leading to invalidated iterators in the upper deleteMarks stack frame.

fixed on master
Comment 7 Not Assigned 2013-03-01 08:48:08 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-4-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=282b920c933337384560b3d2f6a10b156fa5316b&h=libreoffice-4-0

fdo#61016: sw::marks::MarkManager: delay deletion of text fieldmarks


It will be available in LibreOffice 4.0.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.