Bug Hunting Session
Bug 97374 - FILEOPEN: Impress crashes loading a file with Page Title field
Summary: FILEOPEN: Impress crashes loading a file with Page Title field
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Impress (show other bugs)
Version:
(earliest affected)
5.1.0.0.alpha0+ Master
Hardware: x86-64 (AMD64) other
: high major
Assignee: Not Assigned
URL:
Whiteboard: target:5.2.0 target:5.1.2
Keywords: haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2016-01-26 08:48 UTC by Rosemary Sebastian
Modified: 2016-10-25 19:11 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:


Attachments
odp file that contains a page title field (12.11 KB, application/vnd.oasis.opendocument.presentation)
2016-01-26 08:48 UTC, Rosemary Sebastian
Details
bt with debug symbols (19.21 KB, text/plain)
2016-01-27 22:21 UTC, Julien Nabet
Details
valgrind log (40.89 KB, application/x-bzip)
2016-01-28 19:14 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Rosemary Sebastian 2016-01-26 08:48:51 UTC
Created attachment 122213 [details]
odp file that contains a page title field

Steps that lead to crash:
1. Open LibreOffice Impress
2. Choose Insert -> Field -> Page Title
3. Save the file with .odp extension
4. Close the file
If you try to open the file again, Impress crashes. A sample file has been attached.
Comment 1 Joel Madero 2016-01-27 19:41:17 UTC
Bodhi Moksha
Version: 5.2.0.0.alpha0+
Build ID: 182375f7a90ca53919fd2892f7856aee4d678dd0
CPU Threads: 2; OS Version: Linux 3.16; UI Render: default; 
Locale: en-US (en_US.UTF-8)


I can open the file without a problem.


What OS are you using? Does it happen with fresh stable build? How about 5.2 daily? 

Marking as NEEDINFO - if you still see the problem in master and answer the above please set to UNCONFIRMED. Thanks
Comment 2 Julien Nabet 2016-01-27 22:21:53 UTC
Created attachment 122240 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today (+dbgutil), I reproduced the crash from the reporter's file and from a brand new file following initial description.
Comment 3 Julien Nabet 2016-01-27 22:25:38 UTC
With LO Debian package 5.0.5.1, I don't reproduce this with a brand new file.
I also tested to open the file generated from 5.0.5.1 with master sources build, I got a crash too.
=> regression => increase importance
Comment 4 Julien Nabet 2016-01-27 23:03:01 UTC
Oliver: I'm not sure at all, so really just a guess, but by taking a look to bt, I wonder if it might be due to http://cgit.freedesktop.org/libreoffice/core/commit/?id=d3c7c9ea81ee7c617f8cee5b645621088aea215b, any thoughts?
Comment 5 Oliver Specht (CIB) 2016-01-28 11:40:25 UTC
I cannot reproduce it on a centos with a current master and _no_ dbgutil.
Comment 6 Julien Nabet 2016-01-28 12:00:43 UTC
Thank you Oliver for your feedback.
I'll try to get a Valgrind trace to provide more info about this one.

Rosemary Sebastian: just for information, do you also use debug mode?
Comment 7 Rosemary Sebastian 2016-01-28 13:46:22 UTC
(In reply to Joel Madero from comment #1)
> Bodhi Moksha
> Version: 5.2.0.0.alpha0+
> Build ID: 182375f7a90ca53919fd2892f7856aee4d678dd0
> CPU Threads: 2; OS Version: Linux 3.16; UI Render: default; 
> Locale: en-US (en_US.UTF-8)
> 
> 
> I can open the file without a problem.
> 
> 
> What OS are you using? Does it happen with fresh stable build? How about 5.2
> daily? 
> 
> Marking as NEEDINFO - if you still see the problem in master and answer the
> above please set to UNCONFIRMED. Thanks

Sorry that I didn't mention my OS. I use Ubuntu 15.04.
Comment 8 Rosemary Sebastian 2016-01-28 13:50:30 UTC
(In reply to Julien Nabet from comment #6)
> Thank you Oliver for your feedback.
> I'll try to get a Valgrind trace to provide more info about this one.
> 
> Rosemary Sebastian: just for information, do you also use debug mode?

No I don't use any debug mode.
Comment 9 Julien Nabet 2016-01-28 19:14:10 UTC
Created attachment 122263 [details]
valgrind log

I reproduced the crash with master sources updated today so I retrieved a Valgrind trace.
Comment 10 Oliver Specht (CIB) 2016-01-29 08:59:50 UTC
On the valgrind stack I can see a lot of accessibility::... calls
Are there any accessibility tools or extensions active? I don't have that symbols on the stack.
Comment 11 Julien Nabet 2016-01-30 11:57:23 UTC
(In reply to Oliver Specht from comment #10)
> On the valgrind stack I can see a lot of accessibility::... calls
> Are there any accessibility tools or extensions active? I don't have that
> symbols on the stack.

Except if I missed something, there's nothing enabled about accessibility on my laptop.
Comment 12 Oliver Specht (CIB) 2016-02-01 15:13:21 UTC
The only way for me to crash was to open a Writer document before which makes SfxViewShell::Current() return a Writer view shell which ends in an access to a (SdDrawDocument* pDoc == nullptr

Prio to 
commit 2970ec843820a72d73a91cc11fc353e5b9fde5fd
Author: Noel Grandin <noelgrandin@gmail.com>
Date:   Sun Jul 12 21:13:57 2015 +0200

    editeng: make Link<> usage typed
    
    Change-Id: Iec36c7e4f4fbc2ee2ee25d4d0c8488340ba7d8c4
    Reviewed-on: https://gerrit.libreoffice.org/16968
    Tested-by: Jenkins <ci@libreoffice.org>
    Reviewed-by: Noel Grandin <noelgrandin@gmail.com>
The crashing line was:

- DocumentType eDocType = pDoc ? pDoc->GetDocumentType() : DOCUMENT_TYPE_IMPRESS;
- aRepresentation = ( ( eDocType == DOCUMENT_TYPE_IMPRESS )

That suggests that pDoc can be a nullptr. 
Fix is in https://gerrit.libreoffice.org/#/c/22006/
Comment 13 Commit Notification 2016-02-02 08:45:31 UTC
Oliver Specht committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=90dfa7cbcaf32aab6005b94b393c7c409ff1af8f

tdf#97374: prevent crash while updating SvxPageTitleField

It will be available in 5.2.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 14 Rosemary Sebastian 2016-02-03 01:16:05 UTC
(In reply to Oliver Specht from comment #12)
> The only way for me to crash was to open a Writer document before which
> makes SfxViewShell::Current() return a Writer view shell which ends in an
> access to a (SdDrawDocument* pDoc == nullptr
> 
> Prio to 
> commit 2970ec843820a72d73a91cc11fc353e5b9fde5fd
> Author: Noel Grandin <noelgrandin@gmail.com>
> Date:   Sun Jul 12 21:13:57 2015 +0200
> 
>     editeng: make Link<> usage typed
>     
>     Change-Id: Iec36c7e4f4fbc2ee2ee25d4d0c8488340ba7d8c4
>     Reviewed-on: https://gerrit.libreoffice.org/16968
>     Tested-by: Jenkins <ci@libreoffice.org>
>     Reviewed-by: Noel Grandin <noelgrandin@gmail.com>
> The crashing line was:
> 
> - DocumentType eDocType = pDoc ? pDoc->GetDocumentType() :
> DOCUMENT_TYPE_IMPRESS;
> - aRepresentation = ( ( eDocType == DOCUMENT_TYPE_IMPRESS )
> 
> That suggests that pDoc can be a nullptr. 
> Fix is in https://gerrit.libreoffice.org/#/c/22006/

Thanks. Now I can open the file without crashing.
Comment 15 Commit Notification 2016-02-12 20:42:08 UTC
Oliver Specht committed a patch related to this issue.
It has been pushed to "libreoffice-5-1":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=8d3fe0bce57633c9540c58ee05314e15ff51e2b8&h=libreoffice-5-1

tdf#97374: prevent crash while updating SvxPageTitleField

It will be available in 5.1.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.