Issue 99894

Summary: Using the now() XPath function in XForms crashes or lock up OO.o and corrupts your file.
Product: gsl Reporter: safway <valdenlonghurst>
Component: codeAssignee: Frank Schönheit <frank.schoenheit>
Status: CLOSED FIXED QA Contact: issues@gsl <issues>
Severity: Trivial    
Priority: P2 CC: bigandy, dtardon, hdu, issues, kpalagin, philipp.lohmann
Version: OOo 3.1Keywords: crash, regression
Target Milestone: OOo 3.2   
Hardware: All   
OS: All   
Issue Type: PATCH Latest Confirmation in: ---
Developer Difficulty: ---
Attachments:
Description Flags
Screenshot showing how to recreate crash
none
use the right allocation function none

Description safway 2009-03-04 19:14:55 UTC
Details: The now() XPath function works fine by itself in OO.o, but the moment
you try to use it with anything else (such as calculations or other functions),
OO.o either crashes or freezes.

What I have done:
* Tried to use now() with operations such as + and - and OO.o still crashes.
* Tried to use now() with other functions and OO.o still crashes.
* Tried to reference the now() function using XPath nodes and THAT WORKS but is
roundabout.

Rational: OO.o should not need to have one XPath node have the now() value and
require another node to reference that node in order to do any operation.  OO.o
should be able to, for example, work with substring(now(), 1, 4) or
days-from-date(now()) or now()-1 or now()+now() without crashing.

Steps to reproduce:
Open a new XForm
     File
     New
     XML Form Document
Ensure form control toolbar is enabled:
     View
     Toolbars
     Form controls
Ensure form design toolbar is enabled:
     View
     Toolbars
     Form design
Ensure XML Data Navigator window is enabled:
     Withing Form design toolbar toggle on XML data navigator using icon
Insert a node using the XML data navigator
     In the XML data navigator, click the instance tab
     Right-click the instanceData and select to edit element
     This brings up the edit element window
Alter the element (also called node) data
     From the edit element window go to the Settings section
     Select any of the checkboxes in the Settings section, say calculate
     Click the calculate Condition button
     Type one of the example above such as now()+now() or choose your own using
the now() function
     Poof. . . OO.o is either locked or crashes.
Comment 1 safway 2009-03-04 19:27:34 UTC
I was told by es@openoffice.org that I should reassign XForm issues to MSC.
Comment 2 eric.savary 2009-03-04 20:19:18 UTC
Reassigned to MSC
Comment 3 safway 2009-05-20 21:50:38 UTC
This is even worse now with OOo version 3.1.  OOo now crashes/locks up when ANY
data changes in the instance tree when you are using now() ANYWHERE in your
XForm.  Even if you use now() all by itself!!!!

Effectively, the standard now() XForm function has become a simple way to crash
OOo and render the entire XForm useless.
Comment 4 safway 2009-05-20 21:54:42 UTC
I hope we really understand the magnitude of this bug.  A user can no longer
even remove the now() funtion from his document if he realizes this is the
problem.  Let me say it another way: He can't fix his broken XForms document. 
It is toast.
Comment 5 safway 2009-05-20 22:08:03 UTC
The only way to recovery from this is to unzip the odt file, search for the
now() function in content.xml, delete it or replace it with another XForm
function, zip up the file again, and finally open it in OOo.
Comment 6 kpalagin 2009-05-30 21:38:41 UTC
safway,
I can't repro the crash - please provide detailed steps for the part 
"Click the calculate Condition button
 Type one of the example above such as now()+now() or choose your own using
the now() function"
Comment 7 safway 2009-06-01 20:15:47 UTC
Attached is a PDF screenshot visually showing what I described in my steps. 
Please let me know if this is sufficient or not.
Comment 8 safway 2009-06-01 20:17:25 UTC
Created attachment 62689 [details]
Screenshot showing how to recreate crash
Comment 9 safway 2009-06-02 14:52:22 UTC
Well, after what you said, I decided to download the Windows OO,o 3.1 version
and install it on Windows.  The problem is not manifest under Windows.  I have
changed the OS above to reflect that the problem is manifest under Linux.

The problem manifests itself under both Ubuntu 10.4 Linux and Suse 11.1 Linux.
Comment 10 bigandy 2009-06-03 08:45:08 UTC
Also I've discovered same behavour in OOo 3.00 & 3.01/Fedora10/Centos5.3
Comment 11 kpalagin 2009-06-03 11:35:56 UTC
Confirming as per bigandy.
Keywords.
Comment 12 marc.neumann 2009-07-20 13:17:11 UTC
reassign to fs to have a look into this issue
Comment 13 safway 2009-07-21 15:19:26 UTC
A big Thank You!  Now, let's please not just let it sit here at this stage.  :-)
Comment 14 dtardon 2009-08-04 09:50:53 UTC
The problem is in bad pairing of memory allocation/deallocation functions. I.e.
the xmlChar* string representing date is allocated by rtl_allocateMemory
(xforms_nowFunction() in forms/source/xforms/xpathlib/xpathlib.cxx), but
deallocated by xmlFree on deletion of the representative xmlXPathObject
(xmlXPathFreeObject() in xpath.c).
Comment 15 dtardon 2009-08-04 09:51:33 UTC
Created attachment 63944 [details]
use the right allocation function
Comment 16 kpalagin 2009-08-04 19:38:12 UTC
dtardon,
thanks a ton for your effort!
I assume you already filed Joint Copyright Agreement with Sun?

Herbert, Philipp,
please evaluate the patch so that it would not miss 3.2.
TIA.
WBR,
KP.
Comment 17 caolanm 2009-08-04 20:39:31 UTC
As a Red Hat employee dtardon is covered by that JCA.
Comment 18 hdu@apache.org 2009-08-05 06:00:45 UTC
The patch looks good to me. Thanks for analyzing this!
The issue is already correctly assigned to FS. I'm sure the fix will get on track for OOo3.2 when he returns 
from his vacation...
Comment 19 Frank Schönheit 2009-08-10 11:50:58 UTC
(back from vacation, sorry for the delay)
Will commit the patch to a 3.2-targeted CWS as soon as I have one available,
which isn't the case currently.
Comment 20 Frank Schönheit 2009-08-13 08:31:18 UTC
patch committed to CWS dba32f - thanks for providing it!
Comment 21 Frank Schönheit 2009-08-20 08:11:14 UTC
verified the patch made it into CWS dba32f
Comment 22 dtardon 2010-04-22 12:09:15 UTC
integrated in DEV300_m58