Bug 90357 - CRASH: Draw crashes on inserting individual slides from Impress
Summary: CRASH: Draw crashes on inserting individual slides from Impress
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Draw (show other bugs)
Version:
(earliest affected)
4.3.2.2 release
Hardware: x86-64 (AMD64) Linux (All)
: high major
Assignee: Armin Le Grand
URL:
Whiteboard: target:5.0.0
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2015-03-30 21:29 UTC by Katarina Behrens
Modified: 2015-12-17 08:50 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:


Attachments
file for bug reproduction (519.97 KB, application/vnd.oasis.opendocument.presentation)
2015-11-10 09:00 UTC, Armin Le Grand
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Katarina Behrens 2015-03-30 21:29:32 UTC
So there's this really obscure functionality hardly anyone uses: inserting individual slides from Impress file into Draw as new pages. Therefore, this bug's no biggie, few users are ever going to run into it.

How to reproduce
1. New Draw document (or an existing one, doesn't matter)
2. Menu Insert -> File
3. Pick an Impress (.odp) document. A dialog with a tree widget representing Impress file pops up
4. Open top-level tree item and pick one slide (or multiple slides, while holding down Shift key) to insert
5. Click OK. Another dialog pops up, asking to scale the inserted slides or somesuch ...
6. Click Yes or No, doesn't matter
7. Observe the crash

I can reproduce this w/ master build and LibO 4.3.2 (or whatever's that in Fedora 21). I can't reproduce with LibO 3.6 => regression

I have a backtrace and a sample document (not sure if this happens with any Impress document or only this particular one) which I'm going to attach later, but now I'm going to sleep
Comment 1 Robinson Tryon (qubit) 2015-03-31 15:59:09 UTC
TESTING with 4.4.1.2 + Ubuntu 14.04

(In reply to Katarina Behrens from comment #0)
> How to reproduce
> 1. New Draw document (or an existing one, doesn't matter)
> 2. Menu Insert -> File
> 3. Pick an Impress (.odp) document. A dialog with a tree widget representing
> Impress file pops up

Yep

> 4. Open top-level tree item and pick one slide (or multiple slides, while
> holding down Shift key) to insert
> 5. Click OK. Another dialog pops up, asking to scale the inserted slides or
> somesuch ...
> 6. Click Yes or No, doesn't matter

Ok

> 7. Observe the crash
> 

NOREPRO. Presentation page is imported w/o problems.

Can you repro in 4.4. or 4.5? Seems like it may be fixed by now, or perhaps it only crashes on particular types of ODP files?
Status -> NEEDINFO
Comment 2 Katarina Behrens 2015-03-31 19:41:20 UTC
Hi Robinson :)

actually I used your presentation template for LibO 2014 Bern conference (this one here: https://wiki.documentfoundation.org/File:Sample-Impress-Template_Bern2014_rtryon.odp ).

I can make master build of LibO and stock Fedora 21 LibO 4.3.2 crash reproducibly inserting slides from that file into Draw. I didn't try all possible combos, but e.g. a slide titled 'Shapes' crashes always.
Comment 3 Katarina Behrens 2015-03-31 19:42:02 UTC
gdb backtrace: 

#0  0x00007fffb6402c68 in std::__cxx1998::vector<SdrObject*, std::allocator<SdrObject*> >::size (this=0x8) at /usr/include/c++/4.9.2/bits/stl_vector.h:655
#1  0x00007fffb66b1668 in SdrObjList::GetObjCount (this=0x0) at /build/libo-work/svx/source/svdraw/svdpage.cxx:679
#2  0x00007fffc289c239 in SdDrawDocument::InsertBookmarkAsPage (this=0x157db20, rBookmarkList=..., pExchangeList=0x7fffffffafb0, bLink=false, bReplace=false, nInsertPos=3, 
    bNoDialogs=false, pBookmarkDocSh=0x0, bCopy=true, bMergeMasterPages=true, bPreservePageNames=false) at /build/libo-work/sd/source/core/drawdoc3.cxx:932
#3  0x00007fffc2acc15c in sd::FuInsertFile::InsSDDinDrMode (this=0x44a9ff0, pMedium=0x4bfde10) at /build/libo-work/sd/source/ui/func/fuinsfil.cxx:389
#4  0x00007fffc2acb6a5 in sd::FuInsertFile::DoExecute (this=0x44a9ff0, rReq=...) at /build/libo-work/sd/source/ui/func/fuinsfil.cxx:271
#5  0x00007fffc2aca229 in sd::FuInsertFile::Create (pViewSh=0x1641d50, pWin=0x1642640, pView=0x165a9a0, pDoc=0x157db20, rReq=...) at /build/libo-work/sd/source/ui/func/fuinsfil.cxx:89
#6  0x00007fffc2d57607 in sd::DrawViewShell::FuTemporary (this=0x1641d50, rReq=...) at /build/libo-work/sd/source/ui/view/drviews2.cxx:1183
#7  0x00007fffc2d990ac in SfxStubGraphicViewShellFuTemporary (pShell=0x1641d50, rReq=...) at /build/libo-work/workdir/SdiTarget/sd/sdi/sdgslots.hxx:1387
#8  0x00007ffff3b1157e in SfxShell::CallExec (this=0x1641d50, pFunc=0x7fffc2d99089 <SfxStubGraphicViewShellFuTemporary(SfxShell*, SfxRequest&)>, rReq=...)
    at /build/libo-work/include/sfx2/shell.hxx:210
#9  0x00007ffff3b08a2c in SfxDispatcher::Call_Impl (this=0x1625db0, rShell=..., rSlot=..., rReq=..., bRecord=true) at /build/libo-work/sfx2/source/control/dispatch.cxx:258
#10 0x00007ffff3b0b91b in SfxDispatcher::_Execute (this=0x1625db0, rShell=..., rSlot=..., rReq=..., eCallMode=SfxCallMode::RECORD) at /build/libo-work/sfx2/source/control/dispatch.cxx:856
#11 0x00007ffff3af4a13 in SfxBindings::Execute_Impl (this=0x161b750, aReq=..., pSlot=0x7fffc3521d40 <aGraphicViewShellSlots_Impl+30528>, pShell=0x1641d50)
    at /build/libo-work/sfx2/source/control/bindings.cxx:1273
#12 0x00007ffff3b7d038 in SfxDispatchController_Impl::dispatch (this=0x19250f0, aURL=..., aArgs=empty uno::Sequence, rListener=empty uno::Reference)
Comment 4 Katarina Behrens 2015-03-31 19:56:21 UTC
Hah, so the trick is to click on 'No' ( = do not scale) in step 6. I wrongly assumed it doesn't matter. Clicking on 'Yes' inserts the slide fine, no crashes
Comment 5 Robinson Tryon (qubit) 2015-04-01 13:17:11 UTC
(In reply to Katarina Behrens from comment #2)
> Hi Robinson :)
> 
> actually I used your presentation template for LibO 2014 Bern conference
> (this one here:
> https://wiki.documentfoundation.org/File:Sample-Impress-
> Template_Bern2014_rtryon.odp ).

Ah, excellent! Arguably the best presentation I've ever made ;-)

(In reply to Katarina Behrens from comment #4)
> Hah, so the trick is to click on 'No' ( = do not scale) in step 6. I wrongly
> assumed it doesn't matter. Clicking on 'Yes' inserts the slide fine, no
> crashes

I'll retest now with 4.3.2.2.

(In reply to Katarina Behrens from comment #0)
> 1. New Draw document (or an existing one, doesn't matter)

Creating a new document

> 2. Menu Insert -> File
>
3. Open my "Bern 2014" ODP file
> A dialog with a tree widget representing
> Impress file pops up
> 4. Open top-level tree item and pick one slide (or multiple slides, while
> holding down Shift key) to insert

Selecting the 1st slide only ('First Slide Example')

> 5. Click OK. Another dialog pops up, asking to scale the inserted slides or
> somesuch ...

"The format of the new pages will be adapted..."

> 6. (updated) Click No
> 7. Observe the crash

Kaboom!
(Crash CONFIRMED)

Crash also confirmed with 4.4.1.2
Status -> NEW
Whiteboard -> bibisectRequest
Summary -> (CRASH prefix)
Version -> 4.3.2.2

I generally toss all crashes into the MAB bin, but as this is a "really obscure functionality hardly anyone uses," I'll set Priority/Severity to high/major.
Comment 6 Matthew Francis 2015-04-13 09:17:42 UTC
This began at the below commit.
Adding Cc: to muthusuba@gmail.com; Could you possibly take a look at this one? Thanks

commit a4cd841541a729d7b8126d27d91fa28e30b01403
Author: Muthu Subramanian <sumuthu@collabora.com>
Date:   Thu Feb 13 16:10:47 2014 +0530

    n#757432: Styles (rename &) copy to different decks.
    
    While copying slides to different slide decks,
    styles were not being copied if there is already one
    with the same name. This patch renames and copies those
    to keep the formatting intact.
    
    Change-Id: I66f71493f1fd658eed43e39aa7ae7ee7b5463b34
Comment 7 Commit Notification 2015-04-19 12:42:22 UTC
Muthu Subramanian committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=174f205fa24ccf72e9a479d6be901144418f899e

tdf#90357: Fix crash while pasting into draw from impress.

It will be available in 5.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 8 Katarina Behrens (CIB) 2015-04-20 08:45:09 UTC
Hi Muthu, 

so I came up w/ similar band-aid fix for this crash myself :) But unfortunately, it only hides the bug, doesn't really fix it. 

After inserting the slides into Draw, click Undo and ta-da -> it crashes again. This is what I see on the command line: 

warn:legacy.tools:10251:1:svx/source/svdraw/svdmodel.cxx:2000: SdrModel::GetMasterPage: Access out of range (!)
/usr/include/c++/4.9.2/debug/vector:357:error: attempt to subscript 
    container with out-of-bounds index 8, but container only holds 5 
    elements.

so I assume than in the process of copying and renaming the slides, some container somewhere should've been resized but it ain't
Comment 9 Katarina Behrens (CIB) 2015-04-20 09:11:15 UTC
> so I assume than in the process of copying and renaming the slides, some
> container somewhere should've been resized but it ain't

... renaming the styles, I wanted to say :)
Comment 10 Muthu Subramanian 2015-04-20 14:38:55 UTC
@bubli: hmm...it doesn't crash for me...maybe I'm missing some steps, please?
I did: copy from impress, paste into draw (chose option 'yes' once and 'no' the other item). and did 'undo' - things were fine.

Can you check the master pages (in draw) once before you do 'undo' - if you see anything wrong there?

[btw, that (pushed) fix is required (whether or not there are other crashes) ]
Comment 11 Armin Le Grand 2015-11-04 16:59:20 UTC
Tried on Win7 with LO 5.1.0.0.alpha1+ with and without scaling, both works well.
Comment 12 Katarina Behrens (CIB) 2015-11-04 18:26:57 UTC
@Armin: Did you also try insert and then undo? (see comment #8) 

Anyway, crash on insert has been verified fixed by Muthu's band-aid fix from comment #7. Crash on undo (if it doesn't happen anymore) might be fixed by this guy: http://cgit.freedesktop.org/libreoffice/core/commit/?id=f8b975995c5d0dc6a9fc8febba0667fe24542ad2 but I haven't tried myself
Comment 13 Armin Le Grand 2015-11-09 14:33:05 UTC
@Katarina: Not initially (thanks for the hint), but now - works on my local win version. Will try more complicated ones...
Comment 14 Armin Le Grand 2015-11-09 14:43:18 UTC
Found now a reliably crashing combination, taking a look...
Comment 15 Armin Le Grand 2015-11-10 09:00:55 UTC
Created attachment 120441 [details]
file for bug reproduction

To reliably reproduce,
- new draw
- insert/file this attachment
- undo -> crash
Comment 16 Armin Le Grand 2015-11-10 09:06:33 UTC
Found the problematic part, during cloning the page(s) undo gets created in a state where a page is already in the new model, nut has a masterpage from the old model. Undo remembers the MP by index, so this index may not exist in the new model -> execute undo crashes.
To solve, remove MP before creating the undo to mimic more what happens - setting the MP for this page the first time.
This fixes the crash and undo is possible. Next problem coming up is that redo will abandon some styles set at the objects in the example from comment 15, this is due to the undo stack still not being complete when adding pages, but that is another bug.
Preparing fix...
Comment 17 Armin Le Grand 2015-11-10 09:32:11 UTC
Wrote follow-up task tdf#95721 for the errors in undo.
Comment 18 Muthu Subramanian 2015-11-11 04:58:41 UTC
@Armin: Would that be a different bug, please?
Comment 19 Armin Le Grand 2015-11-11 09:28:20 UTC
@Muthu: Yes, tdf#95721 is created, describes the missing style undos.
Comment 20 Commit Notification 2015-11-12 11:00:19 UTC
Armin Le Grand committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=1266429e91a56bcce59a7b98523e8edb8b22ed18

tdf#90357 create correct undo action

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 21 Robinson Tryon (qubit) 2015-12-17 08:50:35 UTC
Migrating Whiteboard tags to Keywords: (bibisected)
[NinjaEdit]