Bug 108867

Summary: Assertion failed when adding/removing/adding text box to a shape
Product: LibreOffice Reporter: Gabor Kelemen (allotropia) <kelemeng>
Component: WriterAssignee: Michael Stahl (allotropia) <michael.stahl>
Status: RESOLVED FIXED    
Severity: major CC: aron.budea, michael.stahl, serval2412, vmiklos
Priority: medium Keywords: haveBacktrace
Version: 6.0.0.0.alpha0+   
Hardware: All   
OS: All   
Whiteboard: target:6.0.0 target:5.4.1 target:5.3.6
Crash report or crash signature: Regression By:
Bug Depends on:    
Bug Blocks: 105537    
Attachments: bt with debug symbols

Description Gabor Kelemen (allotropia) 2017-06-29 18:19:14 UTC
On a debug build choose Insert -> Shape -> any shape.
Right click on the shape and choose Add Text Box.
Right click on it again and choose Remove Text Box.
Right click on the shape again and choose Add Text Box. -> crash with 

soffice.bin: /home/gabor/src/core/sw/source/core/layout/atrfrm.cxx:2532: void SwFrameFormat::SetOtherTextBoxFormat(SwFrameFormat*): Assertion `nullptr == m_pOtherTextBoxFormat' failed.
Comment 1 Julien Nabet 2017-06-30 05:19:01 UTC
Created attachment 134404 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated yesterday (7d2f53b874e586df6631f21fabb87aa5e45c36a3), I could reproduce this.
I attached bt with symbols
Comment 2 Julien Nabet 2017-06-30 08:02:54 UTC
Just wonder if this line
m_rDoc.DelFrameFormat( pFormat );

(see http://opengrok.libreoffice.org/xref/core/sw/source/core/doc/DocumentLayoutManager.cxx#316)

shouldn't be put outside the else block and so executed all the time.

Gabor: I'm not at home to test this, perhaps you could give it a try on local?

First, you might want to add some  temporary trace on http://opengrok.libreoffice.org/xref/core/sw/source/core/doc/DocumentLayoutManager.cxx#243 to confirm we go in "if" block.
Comment 3 Julien Nabet 2017-06-30 20:57:48 UTC
After having added trace, we indeed go in "if" block quoted in my previous comment but putting "m_rDoc.DelFrameFormat( pFormat );" outside else block doesn't fix anything.

I tested this:
diff --git a/sw/source/core/doc/textboxhelper.cxx b/sw/source/core/doc/textboxhelper.cxx
index 9a88ba9dea4e..c782128f1faa 100644
--- a/sw/source/core/doc/textboxhelper.cxx
+++ b/sw/source/core/doc/textboxhelper.cxx
@@ -123,7 +123,10 @@ void SwTextBoxHelper::destroy(SwFrameFormat* pShape)
 
         // Delete the associated TextFrame.
         if (pFormat)
+        {
             pShape->GetDoc()->getIDocumentLayoutAccess().DelLayoutFormat(pFormat);
+            pShape->SetOtherTextBoxFormat(nullptr);
+        }
     }
 }

I don't reproduce the crash but perhaps just hiding it.
Michael: any thoughts?
Comment 4 Commit Notification 2017-07-21 10:10:51 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=2e486daff35ab16e810bfdafb24b19bcbf2fe8cd

tdf#108867 sw: fix dangling text box frame format pointers in Undo

It will be available in 6.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 5 Michael Stahl (allotropia) 2017-07-21 10:38:03 UTC
it looks like the fancy text boxes were missing code to maintain these other-format pointers on Undo

fixed on master
Comment 6 Commit Notification 2017-07-25 18:17:44 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-5-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=40fbde8f75cbda538eccec558cdb8c0c0a659c31&h=libreoffice-5-4

tdf#108867 sw: fix dangling text box frame format pointers in Undo

It will be available in 5.4.1.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 7 Commit Notification 2017-07-27 20:37:06 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-5-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=b39cb50c6afb47f39b21c3fb3ea913b902632924&h=libreoffice-5-3

tdf#108867 sw: fix dangling text box frame format pointers in Undo

It will be available in 5.3.6.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.