Description: LibreOffice crashes when saving this file as .docx Steps to Reproduce: 1. Open the attached document 2. Save as .docx Actual Results: Libreoffice just closes without any messages. It does not create the .docx file. Expected Results: It should have created the .docx and should not have crashed. Reproducible: Always User Profile Reset: No Additional Info: Version: 7.4.2.3 / LibreOffice Community Build ID: 40(Build:3) CPU threads: 8; OS: Linux 5.4; UI render: default; VCL: gtk3 Locale: en-NZ (en_NZ.UTF-8); UI: en-US Ubuntu package version: 1:7.4.2~rc3-0ubuntu0.20.04.1~lo1 Calc: threaded
Created attachment 183124 [details] Document that causes the crash. It is a Greek grammar summary.
Confirm Version: 7.5.0.0.alpha0+ / LibreOffice Community Build ID: 7a89eae97a970939174d59aa58147eaa194acaee CPU threads: 8; OS: Mac OS X 12.3.1; UI render: Skia/Raster; VCL: osx Locale: nl-NL (nl_NL.UTF-8); UI: en-US Calc: threaded
Created attachment 183132 [details] bt + console logs On pc Debian x86-64 with master sources updated today, I could reproduce this. I attached bt with console logs.
It's related to: 35732c84b05e4f6e50349796636beb01f2a09907 tdf#121509 DOCX export: fix corrupt shape anchoring in textbox MSO doesn't support shapes anchored to character in a textbox. Convert these shapes by re-anchoring them to the anchor point of the textbox (also recalculating their positions in simple cases), so Word can now open the exported document.
Quick and dirty patch which prevents LO from crashing but add some glitch at right of first page (and perhaps others): diff --git a/sw/source/filter/ww8/docxattributeoutput.cxx b/sw/source/filter/ww8/docxattributeoutput.cxx index f6c8ff6902b9..0aeb8e6d3827 100644 --- a/sw/source/filter/ww8/docxattributeoutput.cxx +++ b/sw/source/filter/ww8/docxattributeoutput.cxx @@ -6760,6 +6760,7 @@ void DocxAttributeOutput::OutputFlyFrame_Impl(const ww8::Frame& rFrame, const Po { m_nEmbedFlyLevel++; WriteFlyFrame(*it); + it = m_vPostponedFlys.begin(); it = m_vPostponedFlys.erase(it); m_nEmbedFlyLevel--; } It seems WriteFlyFrame may change m_vPostponedFlys: #0 DocxAttributeOutput::OutputFlyFrame_Impl(ww8::Frame const&, Point const&) (this=0x56546ebd99f0, rFrame=...) at sw/source/filter/ww8/docxattributeoutput.cxx:6796 #1 0x00007fa7d53c0a7d in AttributeOutputBase::OutputFlyFrame(ww8::Frame const&) (this=0x56546ebd99f0, rFormat=...) at sw/source/filter/ww8/wrtw8nds.cxx:3497 #2 0x00007fa7d53c050c in SwWW8AttrIter::OutFlys(int) (this=0x7ffc34f27dd8, nSwPos=0) at sw/source/filter/ww8/wrtw8nds.cxx:749 #3 0x00007fa7d53cb8f8 in MSWordExportBase::OutputTextNode(SwTextNode&) (this=0x7ffc34f2fd70, rNode=...) at sw/source/filter/ww8/wrtw8nds.cxx:2431 #4 0x00007fa7d53d3f68 in MSWordExportBase::OutputContentNode(SwContentNode&) (this=0x7ffc34f2fd70, rNode=...) at sw/source/filter/ww8/wrtw8nds.cxx:3561 #5 0x00007fa7d5478509 in MSWordExportBase::WriteText() (this=0x7ffc34f2fd70) at sw/source/filter/ww8/wrtww8.cxx:2813 #6 0x00007fa7d52852f7 in DocxSdrExport::writeDMLTextFrame(ww8::Frame const*, int, bool) (this=0x56546eb33400, pParentFrame=0x7ffc34f2a158, nAnchorId=59, bTextBoxOnly=true) at sw/source/filter/ww8/docxsdrexport.cxx:1975 #7 0x00007fa7d51918a5 in DocxAttributeOutput::WriteTextBox(com::sun::star::uno::Reference<com::sun::star::drawing::XShape>) (this=0x56546ebd99f0, xShape=uno::Reference to (SwXShape *) 0x56546ba15500) at sw/source/filter/ww8/docxattributeoutput.cxx:6916 #8 0x00007fa7d6111324 in oox::drawingml::ShapeExport::WriteTextBox(com::sun::star::uno::Reference<com::sun::star::uno::XInterface> const&, int, bool) (this=0x7ffc34f2ba08, xIface=uno::Reference to (SwXShape *) 0x56546ba15500, nXmlNamespace=5807, bWritePropertiesAsLstStyles=false) at oox/source/export/shapes.cxx:2034 #9 0x00007fa7d6115d88 in oox::drawingml::ShapeExport::WriteCustomShape(com::sun::star::uno::Reference<com::sun::star::drawing::XShape> const&) (this=0x7ffc34f2ba08, xShape=uno::Reference to (SwXShape *) 0x56546ba15500) at oox/source/export/shapes.cxx:1112 #10 0x00007fa7d6112a3e in oox::drawingml::ShapeExport::WriteShape(com::sun::star::uno::Reference<com::sun::star::drawing::XShape> const&) (this=0x7ffc34f2ba08, xShape=uno::Reference to (SwXShape *) 0x56546ba15500) at oox/source/export/shapes.cxx:2008 #11 0x00007fa7d524e8e6 in DocxExport::OutputDML(com::sun::star::uno::Reference<com::sun::star::drawing::XShape> const&) (this=0x7ffc34f2fd70, xShape=uno::Reference to (SwXShape *) 0x56546ba15500) at sw/source/filter/ww8/docxexport.cxx:515 #12 0x00007fa7d528051b in DocxSdrExport::writeDMLDrawing(SdrObject const*, SwFrameFormat const*, int) (this=0x56546eb33400, pSdrObject=0x56546b94fb20, pFrameFormat=0x56546b970080, nAnchorId=58) at sw/source/filter/ww8/docxsdrexport.cxx:1437 #13 0x00007fa7d5281987 in DocxSdrExport::writeDMLAndVMLDrawing(SdrObject const*, SwFrameFormat const&, int) (this=0x56546eb33400, sdrObj=0x56546b94fb20, rFrameFormat=..., nAnchorId=58) at sw/source/filter/ww8/docxsdrexport.cxx:1586 #14 0x00007fa7d518fa5b in DocxAttributeOutput::WriteFlyFrame(ww8::Frame const&) (this=0x56546ebd99f0, rFrame=...) at sw/source/filter/ww8/docxattributeoutput.cxx:6621 #15 0x00007fa7d5190835 in DocxAttributeOutput::OutputFlyFrame_Impl(ww8::Frame const&, Point const&) (this=0x56546ebd99f0, rFrame=...) at sw/source/filter/ww8/docxattributeoutput.cxx:6764
(In reply to Julien Nabet from comment #4) > It's related to: 35732c84b05e4f6e50349796636beb01f2a09907 > tdf#121509 DOCX export: fix corrupt shape anchoring in textbox Yes, it's a regression from that fix.
Followed comment 0 exactly. CRASH: - https://crashreport.libreoffice.org/stats/crash_details/fc32bdd8-2e54-4c43-82bb-a63a096ace5f in: Version: 24.2.0.3 (X86_64) / LibreOffice Community Build ID: da48488a73ddd66ea24cf16bbc4f7b9c08e9bea1 CPU threads: 8; OS: Windows 10.0 Build 22631; UI render: Skia/Vulkan; VCL: win Locale: en-US (en_US); UI: en-US Calc: CL threaded