Issue 99894 - Using the now() XPath function in XForms crashes or lock up OO.o and corrupts your file.
Summary: Using the now() XPath function in XForms crashes or lock up OO.o and corrupts...
Alias: None
Product: gsl
Classification: Code
Component: code (show other issues)
Version: OOo 3.1
Hardware: All All
: P2 Trivial (vote)
Target Milestone: OOo 3.2
Assignee: Frank Schönheit
QA Contact: issues@gsl
Keywords: crash, regression
Depends on:
Reported: 2009-03-04 19:14 UTC by safway
Modified: 2010-04-22 12:09 UTC (History)
6 users (show)

See Also:
Issue Type: PATCH
Latest Confirmation in: ---
Developer Difficulty: ---

Screenshot showing how to recreate crash (96.35 KB, application/pdf)
2009-06-01 20:17 UTC, safway
no flags Details
use the right allocation function (719 bytes, patch)
2009-08-04 09:51 UTC, dtardon
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this issue.
Description safway 2009-03-04 19:14:55 UTC
Details: The now() XPath function works fine by itself in OO.o, but the moment
you try to use it with anything else (such as calculations or other functions),
OO.o either crashes or freezes.

What I have done:
* Tried to use now() with operations such as + and - and OO.o still crashes.
* Tried to use now() with other functions and OO.o still crashes.
* Tried to reference the now() function using XPath nodes and THAT WORKS but is

Rational: OO.o should not need to have one XPath node have the now() value and
require another node to reference that node in order to do any operation.  OO.o
should be able to, for example, work with substring(now(), 1, 4) or
days-from-date(now()) or now()-1 or now()+now() without crashing.

Steps to reproduce:
Open a new XForm
     XML Form Document
Ensure form control toolbar is enabled:
     Form controls
Ensure form design toolbar is enabled:
     Form design
Ensure XML Data Navigator window is enabled:
     Withing Form design toolbar toggle on XML data navigator using icon
Insert a node using the XML data navigator
     In the XML data navigator, click the instance tab
     Right-click the instanceData and select to edit element
     This brings up the edit element window
Alter the element (also called node) data
     From the edit element window go to the Settings section
     Select any of the checkboxes in the Settings section, say calculate
     Click the calculate Condition button
     Type one of the example above such as now()+now() or choose your own using
the now() function
     Poof. . . OO.o is either locked or crashes.
Comment 1 safway 2009-03-04 19:27:34 UTC
I was told by that I should reassign XForm issues to MSC.
Comment 2 eric.savary 2009-03-04 20:19:18 UTC
Reassigned to MSC
Comment 3 safway 2009-05-20 21:50:38 UTC
This is even worse now with OOo version 3.1.  OOo now crashes/locks up when ANY
data changes in the instance tree when you are using now() ANYWHERE in your
XForm.  Even if you use now() all by itself!!!!

Effectively, the standard now() XForm function has become a simple way to crash
OOo and render the entire XForm useless.
Comment 4 safway 2009-05-20 21:54:42 UTC
I hope we really understand the magnitude of this bug.  A user can no longer
even remove the now() funtion from his document if he realizes this is the
problem.  Let me say it another way: He can't fix his broken XForms document. 
It is toast.
Comment 5 safway 2009-05-20 22:08:03 UTC
The only way to recovery from this is to unzip the odt file, search for the
now() function in content.xml, delete it or replace it with another XForm
function, zip up the file again, and finally open it in OOo.
Comment 6 kpalagin 2009-05-30 21:38:41 UTC
I can't repro the crash - please provide detailed steps for the part 
"Click the calculate Condition button
 Type one of the example above such as now()+now() or choose your own using
the now() function"
Comment 7 safway 2009-06-01 20:15:47 UTC
Attached is a PDF screenshot visually showing what I described in my steps. 
Please let me know if this is sufficient or not.
Comment 8 safway 2009-06-01 20:17:25 UTC
Created attachment 62689 [details]
Screenshot showing how to recreate crash
Comment 9 safway 2009-06-02 14:52:22 UTC
Well, after what you said, I decided to download the Windows OO,o 3.1 version
and install it on Windows.  The problem is not manifest under Windows.  I have
changed the OS above to reflect that the problem is manifest under Linux.

The problem manifests itself under both Ubuntu 10.4 Linux and Suse 11.1 Linux.
Comment 10 bigandy 2009-06-03 08:45:08 UTC
Also I've discovered same behavour in OOo 3.00 & 3.01/Fedora10/Centos5.3
Comment 11 kpalagin 2009-06-03 11:35:56 UTC
Confirming as per bigandy.
Comment 12 marc.neumann 2009-07-20 13:17:11 UTC
reassign to fs to have a look into this issue
Comment 13 safway 2009-07-21 15:19:26 UTC
A big Thank You!  Now, let's please not just let it sit here at this stage.  :-)
Comment 14 dtardon 2009-08-04 09:50:53 UTC
The problem is in bad pairing of memory allocation/deallocation functions. I.e.
the xmlChar* string representing date is allocated by rtl_allocateMemory
(xforms_nowFunction() in forms/source/xforms/xpathlib/xpathlib.cxx), but
deallocated by xmlFree on deletion of the representative xmlXPathObject
(xmlXPathFreeObject() in xpath.c).
Comment 15 dtardon 2009-08-04 09:51:33 UTC
Created attachment 63944 [details]
use the right allocation function
Comment 16 kpalagin 2009-08-04 19:38:12 UTC
thanks a ton for your effort!
I assume you already filed Joint Copyright Agreement with Sun?

Herbert, Philipp,
please evaluate the patch so that it would not miss 3.2.
Comment 17 caolanm 2009-08-04 20:39:31 UTC
As a Red Hat employee dtardon is covered by that JCA.
Comment 18 2009-08-05 06:00:45 UTC
The patch looks good to me. Thanks for analyzing this!
The issue is already correctly assigned to FS. I'm sure the fix will get on track for OOo3.2 when he returns 
from his vacation...
Comment 19 Frank Schönheit 2009-08-10 11:50:58 UTC
(back from vacation, sorry for the delay)
Will commit the patch to a 3.2-targeted CWS as soon as I have one available,
which isn't the case currently.
Comment 20 Frank Schönheit 2009-08-13 08:31:18 UTC
patch committed to CWS dba32f - thanks for providing it!
Comment 21 Frank Schönheit 2009-08-20 08:11:14 UTC
verified the patch made it into CWS dba32f
Comment 22 dtardon 2010-04-22 12:09:15 UTC
integrated in DEV300_m58