Apache OpenOffice (AOO) Bugzilla – Issue 89243
writer crashes opening word documents with comments inside
Last modified: 2013-08-07 14:43:03 UTC
Writer crashes when I try to open a document that contains comments created with MS Word. It happens both when I open a document originally created with MS Word, both when I open a document originally created with ooO 3 beta (with comments inside) but modified and saved by MS Word.
Created attachment 53518 [details] Ms word doc with comments that replicates the issue when opened with ooO Writer
Created attachment 53519 [details] ooO doc with comments modified and saved by Ms Word that replicates the issue when opened with ooO
does not crash on Beta, m7,m10 as well as cwsnotes5 on WinXP maybe Mac only issue? mod->morgana: crash happens with attached documents in 3.0 Beta reproducable every time?
Confirmed. The atached document crashs if I try to open it. System: Intel Mac: OS X 10.5.2 OOo Beta 3.0
On 2.3 with X11 works fine. Set keyword: regression
Set me to CC
mod -> pl,ericb: added you guys because I know you have a mac and probably debug symbols in sw:-) Could someone tell me where it crashes and maybe even see why? Does not crash for me in any version I have on Win XP
Issue confirmed I'm currently fixing build issues when debug is enabled on Mac OS X. Once done I'll retry using sw including symbols, and if the crash occurs using this lib, I'll attach the stack on the issue
No Problem with SRC680_m228 Aqua on Leopard
does not crash under Linux as well, crash on MacOS in rgba32_mark_constantmask, here is a trace: http://paste.lisp.org/display/60589 mod->hdu: drawing and glyphs sounds like somewhere in your area, would you have a look?
target 3.0, assigned to hdu
.
What happens is that a child window gets changed, probably because of a new toolbar, then the SwPostItMgr::LayoutPostIts() does its thing, re-layouts its comments and the editengine and its virtual device gets resized by this too. Unfortunately the virtual device gets resized to a bad size (ImpEditEngine::Paint() converted an uninitialized(!!!) Rectangle() from logic->pixel coordinates). The resulting virtual device is not valid and doing any graphics operations on it makes it crash. In GSL we'll add debug assertions against invalid resize requests, but the root cause seems to be layouting problems of the SwPostIt feature @mod: something for you? Or EditEngine guys? Here's the relevant stack of the virtual-device resize to the invalid size: #2 VirtualDevice::SetOutputSizePixel (this=0x13da30b0, rNewSize=@0xbfffb990, bErase=1) #3 ImpEditEngine::Paint (this=0x52d2000, pView=0x13da2c10, rRec=@0xbfffba74, bUseVirtDev=1) at svx/source/editeng/impedit3.cxx:3522 #4 ImpEditEngine::UpdateViews (this=0x52d2000, pCurView=0x13da28e0) at svx/source/editeng/impedit3.cxx:295 #5 ImpEditEngine::FormatAndUpdate (this=0x52d2000, pCurView=0x13da28e0) at svx/source/editeng/impedit3.cxx:3935 #6 ImpEditEngine::SetUpdateMode (this=0x52d2000, bUp=1, pCurView=0x13da28e0, bForceUpdate=0) at svx/source/editeng/impedit3.cxx:3705 #7 EditView::SetEditEngineUpdateMode (this=0x13da28e0, bUpdate=1) at svx/source/editeng/editview.cxx:818 #8 OutlinerView::SetAttribs (this=0x13da2bb0, rAttrs=@0xbfffbc04) at svx/source/outliner/outlvw.cxx:578 #9 SwPostIt::InitControls (this=0x2966bc30) at sw/source/ui/docvw/postit.cxx:595 #10 SwPostIt::SwPostIt (this=0x2966bc30, pParent=0x51d1600, nBits=324, aField=0x1aede560, aMgr=0x1aef2730) at sw/source/ui/docvw/postit.cxx:409 #11 SwPostItMgr::LayoutPostIts (this=0x1aef2730) at sw/source/ui/docvw/PostItMgr.cxx:569 #12 0x245ecad1 in SwView::OuterResizePixel (this=0x1aee83d0, rOfst=@0xbfffbfc8, rSize=@0xbfffbfc0) at sw/source/ui/uiview/viewport.cxx:1262 #13 SfxViewFrame::DoAdjustPosSizePixel () #14 SfxViewFrame::Resize () #15 SfxTopViewFrame::Close () #16 Window::ImplCallResize (this=0x1aecfd10) at vcl/source/window/window.cxx:1091 #17 Window::ImplPosSizeWindow (this=0x1aecfd10, nX=2, nY=2, nWidth=1293, nHeight=759, nFlags=15) at vcl/source/window/window.cxx:3329
Created attachment 53588 [details] original pastebin stacktrace
And here a gdb-debug hint (for DEV300_m12) b impedit3.cxx:3522 cond X (aClipRec.nRight>=0x7ffffff0) with X being the breakpoint number of the above breakpoint.
attached patch should fix the crash mod->hdu: could you verify this on a mac, please
Created attachment 53590 [details] patch
The patch works on Aqua DEV300_m12.
fixed in notes5, removing those ones I added myself from cc thanks everyone for helping
*** Issue 89487 has been marked as a duplicate of this issue. ***
verified on Mac by hdu
*** Issue 90824 has been marked as a duplicate of this issue. ***
*** Issue 90843 has been marked as a duplicate of this issue. ***
seen in m20 -> closing
*** Issue 90925 has been marked as a duplicate of this issue. ***
*** Issue 91103 has been marked as a duplicate of this issue. ***
*** Issue 92721 has been marked as a duplicate of this issue. ***