Bug 85185 - COLOR PICKER: Selecting a custom color crashes LibO
Summary: COLOR PICKER: Selecting a custom color crashes LibO
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: LibreOffice (show other bugs)
(earliest affected) Master
Hardware: Other All
: medium normal
Assignee: Matthew Francis
Whiteboard: BSA target:4.4.0
Depends on:
Blocks: Color-Picker-Widget
  Show dependency treegraph
Reported: 2014-10-18 21:29 UTC by Yousuf Philips (jay) (retired)
Modified: 2014-10-21 13:26 UTC (History)
2 users (show)

See Also:
Crash report or crash signature:

linux backtrace (19.15 KB, text/plain)
2014-10-18 21:29 UTC, Yousuf Philips (jay) (retired)
linux backtrace (2) (6.96 KB, text/plain)
2014-10-19 07:53 UTC, Matthew Francis

Note You need to log in before you can comment on or make changes to this bug.
Description Yousuf Philips (jay) (retired) 2014-10-18 21:29:55 UTC
Created attachment 108043 [details]
linux backtrace

1) Open Writer
2) Click on the font color drop down
3) Click the color picker button at the bottom of the drop down
4) Select some random color
5) Press OK button
6) Crash

Build ID: 3b6ee58652d99accd610425264114d1d5b3330df
TinderBox: Linux-rpm_deb-x86@45-TDF, Branch:master, Time: 2014-10-15_21:41:26
Comment 1 tommy27 2014-10-19 06:13:16 UTC
no crash under Win7x64 with
Build ID: 3e2bd1e4022e25b77bcc8eba5e02c1adc57008a1
TinderBox: Win-x86@42, Branch:master, Time: 2014-10-16_01:04:13

is the crash specific to the font color picker or does it happen with highlighting and backgrond color pickers as well?
Comment 2 Matthew Francis 2014-10-19 07:50:02 UTC
Confirmed on 4.4 master on Linux and OSX

-> NEW
Comment 3 Matthew Francis 2014-10-19 07:53:58 UTC
Created attachment 108053 [details]
linux backtrace (2)

More detailed backtrace from gdb - appears to show a corrupt string in an argument going some way back up the stack
Comment 4 Matthew Francis 2014-10-19 08:27:50 UTC
In the middle of PaletteManager::PopupColorPicker(...), while control wanders off to the popup through aColorDialog.Execute(), the SvxColorWindow_Impl from which the call is made is destroyed, and along with it the OUString that was passed-by-reference as "const OUString& aCommand"