https://bugs.documentfoundation.org/show_bug.cgi?id=174348
Bug ID: 174348
Summary: CRASH: SIGABRT in ~SwPageDesc /
SfxItemSet::ClearAllItemsImpl when closing Writer
after a MailMerge (UNO API) run
Product: LibreOffice
Version: 24.8.7.2 release
Hardware: x86-64 (AMD64)
OS: Linux (All)
Status: UNCONFIRMED
Severity: normal
Priority: medium
Component: Writer
Assignee: [email protected]
Reporter: [email protected]
Created attachment 209552
--> https://bugs.documentfoundation.org/attachment.cgi?id=209552&action=edit
Symbolized backtrace of the crash (26.8.2, Arch Linux build, debug symbols via
debuginfod)
Description:
After running com.sun.star.text.MailMerge via the UNO API (OutputType=FILE, PDF
export, Calc file as registered data source), LibreOffice crashes with SIGABRT
("Unspecified Application Error") as soon as the office is terminated
(Desktop.terminate()). The mail merge output itself is complete and correct.
Opening and closing the same document without a mail merge does not crash.
Steps to reproduce:
1. Run the attached repro.py with LibreOffice's bundled Python: program/python
repro.py <empty work dir> program/soffice
It creates a 3-row spreadsheet, registers it as data source, creates an
empty Writer document with one database field, runs MailMerge to PDF files and
terminates the office.
2. Alternatively in a clean container with the official TDF build: docker run
--rm -v "$PWD":/repro:ro debian:trixie-slim sh /repro/run.sh 26.8.2
Actual results:
"Unspecified Application Error", soffice exits with code 134 (SIGABRT).
Backtrace (26.8.2, Arch build with debug info) attached:
SwDocShell::~SwDocShell -> SwDoc::~SwDoc -> SwPageDesc::~SwPageDesc ->
SwFormat::~SwFormat -> SfxItemSet::ClearAllItemsImpl -> call into heap address
(use-after-free / double delete of a SwPageDesc?).
Expected results:
Clean shutdown, exit code 0.
Reproducible: Always
Tested with official TDF builds in clean Debian containers (fresh user profile,
no extensions, only fonts-dejavu-core):
- 26.8.2.2 (Debian trixie): crash
- 26.8.1.1 (Debian trixie): crash
- 26.2.7.3 (Debian trixie): crash
- 25.8.7 (Debian trixie): crash
- 24.8.7.2 (Debian bookworm): crash
Also on Arch Linux, libreoffice-fresh 26.8.2 (headless, empty profile and
regular profile): crash.
Version: 26.8.2.2 (X86_64) / Build ID 9dea406ab7695df6325b11b0e19fdca8db4b7276
OS: Linux (Debian trixie/bookworm containers; Arch Linux host)
--
You are receiving this mail because:
You are the assignee for the bug.
