Issue 122752 - Windows 8 Selecting text and copying to system clipboard causes application crash.
Windows 8 Selecting text and copying to system clipboard causes application c...
Status: VERIFIED FIXED
Product: General
Classification: Code
Component: code
4.0.0-dev
PC Windows 8
: P3 critical (vote)
: 4.0.0
Assigned To: hdu@apache.org
:
Depends on:
Blocks: 122426
  Show dependency treegraph
 
Reported: 2013-07-15 13:52 UTC by Samer Mansour
Modified: 2013-07-24 15:04 UTC (History)
9 users (show)

See Also:
Issue Type: DEFECT
Latest Confirmation on: ---
Developer Difficulty: ---
jsc: 4.0.0_release_blocker+


Attachments
move the iterator check inside the nextFormat loop (751 bytes, patch)
2013-07-15 17:37 UTC, hdu@apache.org
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this issue.
Description Samer Mansour 2013-07-15 13:52:56 UTC
Windows 8 Selecting text and using 'Cut' or ctrl + x cause application crash.

Happens in Calc, Writer and Impress. Reproducible every time.

Windows Error Help:
- - - - - - -

Problem signature:
  Problem Event Name:	BEX
  Application Name:	soffice.bin
  Application Version:	4.0.9702.500
  Application Timestamp:	51de9766
  Fault Module Name:	MSVCR90.dll
  Fault Module Version:	9.0.30729.6871
  Fault Module Timestamp:	4fee6073
  Exception Offset:	0006ccd5
  Exception Code:	c0000417
  Exception Data:	00000000
  OS Version:	6.2.9200.2.0.0.256.48
  Locale ID:	1033
  Additional Information 1:	d125
  Additional Information 2:	d1257caeb996c0077d70d144f7b67b70
  Additional Information 3:	d91b
  Additional Information 4:	d91b46fe48d3d5e2c8712958c05612e0

Read our privacy statement online:
  http://go.microsoft.com/fwlink/?linkid=190175

If the online privacy statement is not available, please read our privacy statement offline:
  C:\Windows\system32\en-US\erofflps.txt
Comment 1 Samer Mansour 2013-07-15 13:57:38 UTC
Using 'Edit' -> 'Cut' or 'Copy' (ctrl + x or c) will cause bug to occur not just on cut.  I thought to test copy after i already submitted for cut.

Paste works from notepad.exe to Writer, calc, etc. though.
Comment 2 Regina Henschel 2013-07-15 14:24:29 UTC
Please give us the exact version number. You find it in Help > About OpenOffice. You can copy and paste it from that window.
Comment 3 Samer Mansour 2013-07-15 14:34:40 UTC
AOO400m3(Build:9702)  -  Rev. 1502185
2013-07-10 14:15:55 (Mi, 10 Jul 2013)
Comment 4 Rob Weir 2013-07-15 14:42:47 UTC
I am not seeing this on Windows 8, 32-bit, a fresh install.

This is with the en-US version of Windows.

I created a new document in Writer, added some text, simple attributes, etc.  I then selected content, did a cut via control-X.  No crash.  Tried with Edit/Cut.  No crash.  Tried copy as well, and paste.  No crash.

Samer, could you give the exact minimal steps needed to reproduce for you?  For example:

1) Launch Writer

2) Enter "hello world"

3) Control-A to select all text

4) Control-X to cut text

Would something as minimal as that cause a crash for you?  If not, what other steps are required?
Comment 5 Kay 2013-07-15 14:46:05 UTC
Changed hardware spec. This seems to be Windows 8 only at the moment. Not reproducible on Linux, other OS setups at the moment.
Comment 6 Samer Mansour 2013-07-15 14:49:45 UTC
Rob your 4 steps should reproduce the error. Writer or calc.

I am running 64-bit windows 8.  Can anyone verify if this exists on windows 7 64-bit as well?
Comment 7 hdu@apache.org 2013-07-15 14:56:23 UTC
> AOO400m3(Build:9702)  -  Rev. 1502185
> 2013-07-10 14:15:55 (Mi, 10 Jul 2013)

What's strange is that revision 1502185 was committed one day later on July 11th.
Comment 8 r4zoli 2013-07-15 14:59:16 UTC
I not have en_US version installed, I use Hungarian hu_HU version of RC. I tested on windows 8 64bit version, no crash with Writer, or Calc in Rob's 4th step.
Comment 9 Regina Henschel 2013-07-15 15:13:10 UTC
Do you had installed other versions before? If yes, do you uninstall them? If yes, do you have removed all reminders in AppData\Roaming and in \Program File(x86) ?
Comment 10 Rob Weir 2013-07-15 15:25:02 UTC
No crash on Windows 7 64-bit.

Again, this is a VMWare image of a fresh Windows 7 install, all updated applied.  There was no previous AOO 3.4.1 installed.  It sounds like Samer's machine was an upgrade from 3.4.1?   I can try that to see if it makes a difference.

Also, could you do a Windows Update on your machine and see if it is recommending any critical updates?  Don't apply them yet, but make a list of which KB's it is recommending (or get a screen shot)  That might be a difference.
Comment 11 Samer Mansour 2013-07-15 15:29:04 UTC
Do you had installed other versions before? 
 --Yes I did install 4.0.0 over 3.4.1 without separately uninstalling.
If yes, do you uninstall them? 
 --Yes, The 4.0.0 windows installed mentioned it was removing previous versions during installation.

If yes, do you have removed all reminders in AppData\Roaming and in \Program File(x86) ?

No I did not alter anything manually, these are the folders that were not removed during the upgrade install on windows 8 64-bit: http://postimg.org/image/xa0zkylvr/

If you would like me to remove files manually, please indicate folder level to remove and I will re-run the steps to verify possible issue.

Rob:
No outstanding patches in Windows Update at the time of testing.
Comment 12 Rob Weir 2013-07-15 15:45:29 UTC
I installed on a Windows 8 64-bit machine, with no previous AOO on it.

I did a bunch of copy/cut/paste operations, plain text.  I did get it to crash once.  It was not directly on a clipboard operation, but a few seconds later when I was bringing up a menu.   

I restarted a few more times and could not get it to happen again :-(
Comment 13 Samer Mansour 2013-07-15 16:08:45 UTC
This issue happens immediately upon clicking copy or cut, or using the keyboard shortcuts.

Deleting old OpenOffice 3 folders in AppData\Roaming and in \Program File(x86)  did not help solve this issue.
Comment 14 Rob Weir 2013-07-15 16:12:09 UTC
You say it occurs "immediately".  So if you cut, do you even see the contents removed from the page?  Or does it crash even before the page is redrawn?
Comment 15 Samer Mansour 2013-07-15 16:22:31 UTC
Before its re-drawn. 

This is odd now:

What I did since my last post was I sent the OO3 folders listed above to recycle bin, I started up AOO4 ran the steps, it crashed immediately. Posted it didn't help.  I then restored the 2 folders from the recycle bin back so that it undid my folder deletes.

Then It tried to create a vine video with my smartphone of the error and its not occuring anymore.
Comment 16 Rob Weir 2013-07-15 16:42:08 UTC
I've made it crash twice, but it is a delayed crash, not immediately upon doing a copy operation.  However, that delay might be due to the debug environment on my machine that takes some time to load.

In any case I've sent Herbert a stack trace I got.
Comment 17 hdu@apache.org 2013-07-15 17:37:03 UTC
Created attachment 81084 [details]
move the iterator check inside the nextFormat loop

The stack sent showed a problem in CFormatEtcContainer::nextFormatEtc() with accessing beyond the container bounds. The check was outside of the loop. The related method CFormatEtcContainer::nextFormatEtc() checks each loop though, so this might be a good idea here too.
Comment 18 V Stuart Foote 2013-07-16 01:39:15 UTC
On Windows 8, 64-bit.

AOO400m3(Build:9702)  -  Rev. 1502185
2013-07-10 14:15:55 (Mi, 10 Jul 2013)

So same RC build installed cleanly, i.e. no prior version (3.4.1 or 4.0 dev) of OpenOffice present.

All copy/paste and insert actions stable in both Writer and Calc. Unable to make it crash with any mix or speed of copy-paste-cut-insert actions. Saved-closed-opened-copied to new or existing documents.

So, looks like a WFM--with a clean install on Windows 8, 64-bit.
Comment 19 hdu@apache.org 2013-07-16 08:35:41 UTC
As the stack seen in Rob's reproduction of the crash points to a problem in Window's FORMATETC enumeration http://support.microsoft.com/kb/2541119 could be related. 

Googling for related problems finds #fdo64235#. In case that is not fixed yet it would be interesting to know whether the patch I suggested solves that issue.
Comment 20 hdu@apache.org 2013-07-16 10:55:00 UTC
(In reply to hdu@apache.org from comment #17)
> The related method CFormatEtcContainer::nextFormatEtc() checks each loop

CFormatEtcContainer::skipFormatEtc() was the related method that checks each loop iteration
Comment 21 jsc 2013-07-16 12:26:28 UTC
grant showstopper flag

I think it is critical that it is known as potential problem and the fix seems to work fine for Rob who were not able to reproduce the issue with the fix.
Comment 22 SVN Robot 2013-07-16 12:42:20 UTC
"hdu" committed SVN revision 1503684 into branches/AOO400:
#i122752# check iterator in each iteration of CFormatEtcContainer::nextFormat...
Comment 23 hdu@apache.org 2013-07-16 12:56:28 UTC
Everyone able to reproduce the problem please verify. There are indications that the problem might be better reproducible if the Windows File Explorer is open.
Comment 24 Samer Mansour 2013-07-16 13:22:23 UTC
Windows File Explorer reproduces the issue, I thought it was my eclipse instance open!

1) Open Windows File Explorer, can be minimized to task bar.

2) Launch Writer

3) Enter "hello world"

4) Control-A to select all text

5) Control-X to cut text

Here is the issue reproduced in video: https://t.co/VLAyfSGwQC

Replacing sysdtrans.dll (sent to me by Herbert Duerr) into X:\Program Files (x86)\OpenOffice 4\program fixes the issue, the application error does not appear.
Comment 25 SVN Robot 2013-07-16 13:33:51 UTC
"hdu" committed SVN revision 1503709 into trunk:
#i122752# check iterator in each iteration of CFormatEtcContainer::nextFormat...
Comment 26 hdu@apache.org 2013-07-18 13:46:15 UTC
Verified by Samer and Rob.