Apache OpenOffice (AOO) Bugzilla – Issue 125071
When saving as doc, odt file crashes and immediately recovers
Last modified: 2017-05-20 10:35:10 UTC
Created attachment 83528 [details] File I was saving as .doc format to share with a Microsoft Word user Using administrative install of 4.2.0-dev_1600106. When doing a save as to Microsoft Wrod 97/2000/XP (.doc) format the odt file crashes and immediately recovers. Saving to .doc format is never accomplished. Steps to cause problem Open or create a writer document add some text file->save as choose Micrsoft Word 97/2000/XP (.doc) click save Expected Result: file saves in .doc format Actual Result: odt file crashes and immediately recovers.
I saw a similar problem with tonight's buildbot build r1601656 when some of the autotests such as "fvt.uno.sw.DocumentTest:testSaveAsDocument()" failed because of such a crash. Shortly before the crash it said: "formats.cxx:462 Do no longer use SvxBrushItem, instead use [XATTR_FILL_FIRST..XATTR_FILL_LAST] FillAttributes (simple fallback is in place and used)". I'll attach a crash backtrace which shows an access violation at main/sw/source/core/attr/format.cxx:481 when it assigns zero to *ppItem, which unfortunately is NULL. The crash stack and the error message suggest that the changes for issue 124638 might have caused this regression.
Created attachment 83537 [details] relevant part of the save-as-doc crash stack
Created attachment 83538 [details] check SwFmt::GetItemState()'s ppItem for NULL The SwFmt::GetItemState() method shoud check its ppItem pointer argument before assigning something into it, because NULL is the default value according to main/sw/inc/format.hxx and thus is allowed. The suggested patch solves the crash for both Keith's sample document and for the autotests, but debug logging still emits warnings like "Unhandled SfxPoolItem with id X" which hint at a deeper problem.
take over for patch review and further investigations
Created attachment 83542 [details] check SwFmt::GetItemState()'s ppItem for NULL
Comment on attachment 83542 [details] check SwFmt::GetItemState()'s ppItem for NULL adjusted patch looks good - bring it into trunk
"hdu" committed SVN revision 1602097 into trunk: #i125071# check SwFmt::GetItemState()'s ppItem parameter for NULL
The crash is fixed with the commit above. I suggest to fix the other problems with FillAttributes and unhandled SfxPoolItems in an own bug or in issue 124638.