Bug 120115

Summary:	Crash in: SfxItemSet::GetItemState
Product:	LibreOffice	Reporter:	Telesto <telesto>
Component:	Writer	Assignee:	Not Assigned <libreoffice-bugs>
Status:	VERIFIED FIXED
Severity:	critical	CC:	bjoern.michaelsen, oliver.brinzing, xiscofauli
Priority:	highest	Keywords:	bibisected, bisected, regression
Version:	6.1.0.0.alpha0+
Hardware:	All
OS:	All
See Also:	https://crashreport.libreoffice.org/stats/signature/SfxItemSet::GetItemState(unsigned%20short,bool,SfxPoolItem%20const%20%20) https://bugs.documentfoundation.org/show_bug.cgi?id=121546 https://bugs.documentfoundation.org/show_bug.cgi?id=139715 https://bugs.documentfoundation.org/show_bug.cgi?id=123027
Whiteboard:	target:6.2.0 target:6.1.4
Crash report or crash signature:	["SfxItemSet::GetItemState(unsigned short,bool,SfxPoolItem const * *)"]	Regression By:
Bug Depends on:
Bug Blocks:	118738
Attachments:	Example file stacktrace on a ~libreoffice-6-1 branch (unclean)

Description Telesto 2018-09-25 14:02:21 UTC

Description:
Crash in: SfxItemSet::GetItemState

Steps to Reproduce:
1. Open the attached file
2. CTRL+A + CTRL+C
3. CTRL+N (new writer document normal view)
4. CTRL+V + CTRL+V
5. CTRL+Z + CTRL+Z
6. CTRL+V -> Crash (if not -> happens -> Hold CTRL+V). 

Still nothing -> relaunch and try again or toy around with holding CTRL+V CTRL+Z. It will crash at some point

Actual Results:
Crash

Expected Results:
No crash


Reproducible: Always


User Profile Reset: No



Additional Info:
Found in:
Version: 6.2.0.0.alpha0+
Build ID: 1aa37aa6bee19099b57555a6d839992b054aa405
CPU threads: 4; OS: Windows 6.3; UI render: default; 
TinderBox: Win-x86@42, Branch:master, Time: 2018-09-23_10:17:54
Locale: nl-NL (nl_NL); Calc: CL

Comment 1 Telesto 2018-09-25 14:02:39 UTC

Created attachment 145162 [details]
Example file

Comment 2 Telesto 2018-09-25 14:05:27 UTC

crashreport.libreoffice.org/stats/crash_details/0cea6013-7fea-4e8c-8b55-b10d70b02685

Comment 3 Oliver Brinzing 2018-09-25 14:44:22 UTC

confirming crash with 

Version: 6.1.2.1 (x64)
Build-ID: 65905a128db06ba48db947242809d14d3f9a93fe
CPU-Threads: 4; BS: Windows 10.0; UI-Render: Standard; 
Gebietsschema: de-DE (de_DE); Calc:

Comment 4 MM 2018-09-25 14:58:06 UTC

Confirmed on ubuntu 16.04 x64 with Version: 6.2.0.0.alpha0+
Build ID: 8b1501d80dc9d3f42c351c6e026fa737e116cae5
CPU threads: 2; OS: Linux 4.4; UI render: default; VCL: gtk2; 
TinderBox: Linux-rpm_deb-x86_64@70-TDF, Branch:master, Time: 2018-09-22_22:07:48
Locale: en-US (en_US.UTF-8); Calc: threaded

crashreport.libreoffice.org/stats/crash_details/a4ed4cfd-745f-4bab-be27-9d43034dccd4

Unconfirmed with Version: 6.0.0.0.alpha1+
Build ID: 637d96a25926e299fff5b4cf5a0055b1d171b23b
CPU threads: 2; OS: Linux 4.4; UI render: default; VCL: gtk2; 
TinderBox: Linux-rpm_deb-x86_64@70-TDF, Branch:master, Time: 2017-11-17_23:45:59
Locale: en-US (en_US.UTF-8); Calc: group

Comment 5 Xisco Faulí 2018-09-25 15:15:03 UTC

Regression introduced by:

https://cgit.freedesktop.org/libreoffice/core/commit/?id=1a3b2668d63d00b9ae004c8be883c8e4c0f8996c

author	Bjoern Michaelsen <bjoern.michaelsen@libreoffice.org>	2018-03-13 00:04:04 +0100
committer	Björn Michaelsen <bjoern.michaelsen@libreoffice.org>	2018-03-19 08:20:46 +0100
commit 1a3b2668d63d00b9ae004c8be883c8e4c0f8996c (patch)
tree 0c007c1f909d6b7e8a8f26e3b55deefdb1f323d9
parent be8883bcb250bdbfbb77a76b244d97a30a97d77a (diff)
use sw::WriterMultiListener instead of SwDepend in SwEndNoteInfo

Bisected with: bibisect-linux64-6.1

Adding Cc: to Bjoern Michaelsen

Comment 6 Tomas 2018-09-26 06:42:44 UTC

The crash has been reproduced on the below platform too, I also tried the manual way without shortcuts, I used the menu clicks to copy&paste, create new page etc but resulted into a crash:

Version: 6.1.1.2
Build ID: 5d19a1bfa650b796764388cd8b33a5af1f5baa1b
CPU threads: 1; OS: Linux 4.15; UI render: default; VCL: gtk2; 
Locale: en-US (en_US.UTF-8); Calc: group threaded

Comment 7 Björn Michaelsen 2018-10-14 21:30:11 UTC

Created attachment 145714 [details]
stacktrace on a ~libreoffice-6-1 branch (unclean)

Stacktrace on a unclean -6-1 branch (still had local patches, so please redo if you think its needed, I only had this debug-build).

Comment 8 Björn Michaelsen 2018-10-14 21:40:13 UTC

Also some angry warnings before:
warn:legacy.osl:14357:14357:sw/source/core/layout/findfrm.cxx:1102: <SwFrame::FindPrevCnt_()> - unknown layout situation: current frame should be in page header or page footer
warn:legacy.osl:14357:14357:sw/source/core/layout/findfrm.cxx:1102: <SwFrame::FindPrevCnt_()> - unknown layout situation: current frame should be in page header or page footer
warn:legacy.osl:14357:14357:sw/source/core/layout/findfrm.cxx:1102: <SwFrame::FindPrevCnt_()> - unknown layout situation: current frame should be in page header or page footer
warn:legacy.osl:14357:14357:sw/source/core/layout/findfrm.cxx:1102: <SwFrame::FindPrevCnt_()> - unknown layout situation: current frame should be in page header or page footer
warn:legacy.osl:14357:14357:sw/source/core/layout/findfrm.cxx:1102: <SwFrame::FindPrevCnt_()> - unknown layout situation: current frame should be in page header or page footer
warn:legacy.osl:14357:14357:sw/source/core/layout/tabfrm.cxx:2626: debug assertion: <SwTabFrame::MakeAll()> - format of table lowers suppressed by fix i44910
warn:legacy.osl:14357:14357:sw/source/core/access/acccontext.cxx:1039: invalid visible area for dispose
warn:legacy.osl:14357:14357:sw/source/core/access/acccontext.cxx:459: fire event for disposed frame?
warn:legacy.osl:14357:14357:sw/source/core/layout/findfrm.cxx:1102: <SwFrame::FindPrevCnt_()> - unknown layout situation: current frame should be in page header or page footer
warn:legacy.osl:14357:14357:sw/source/core/layout/findfrm.cxx:1102: <SwFrame::FindPrevCnt_()> - unknown layout situation: current frame should be in page header or page footer
warn:legacy.osl:14357:14357:sw/source/core/layout/findfrm.cxx:1102: <SwFrame::FindPrevCnt_()> - unknown layout situation: current frame should be in page header or page footer
warn:legacy.osl:14357:14357:sw/source/core/layout/findfrm.cxx:1102: <SwFrame::FindPrevCnt_()> - unknown layout situation: current frame should be in page header or page footer
warn:legacy.osl:14357:14357:sw/source/core/layout/findfrm.cxx:1102: <SwFrame::FindPrevCnt_()> - unknown layout situation: current frame should be in page header or page footer
warn:legacy.osl:14357:14357:sw/source/core/layout/tabfrm.cxx:2626: debug assertion: <SwTabFrame::MakeAll()> - format of table lowers suppressed by fix i44910
warn:legacy.osl:14357:14357:sw/source/core/access/acccontext.cxx:459: fire event for disposed frame?
[Thread 0x7fffd1acc700 (LWP 14573) exited]

Comment 9 Björn Michaelsen 2018-10-14 21:45:48 UTC

So cause is likely footnotes in tables. Possibly the problem was already preexisting -- only accidentally exposed by the SwDepend change.

Comment 10 Telesto 2018-10-14 21:50:01 UTC

(In reply to Björn Michaelsen from comment #8)
> Also some angry warnings before:

The debug assertion is quite common, see bug 116293 and bug 119126

Comment 11 Björn Michaelsen 2018-11-10 19:59:28 UTC

https://gerrit.libreoffice.org/#/c/63249/

Comment 12 Commit Notification 2018-11-12 20:04:59 UTC

Bjoern Michaelsen committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/+/e9bf0102783e23cf8b7c609a9a5265ab436dc90e%5E%21

tdf#120115: Dont crash on Footnote/Table undo/redo

It will be available in 6.2.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.

Comment 13 Telesto 2018-11-12 21:26:45 UTC

@Xisco
Quote: "I found another crash testing it but it was already reproducible before the commit introducing tdf#120115 so I'll report it in another ticket."

-> In search for the ticket in question (or is it covered by an existing report)

Comment 14 Xisco Faulí 2018-11-13 08:24:17 UTC

(In reply to Telesto from comment #13)
> @Xisco
> Quote: "I found another crash testing it but it was already reproducible
> before the commit introducing tdf#120115 so I'll report it in another
> ticket."
> 
> -> In search for the ticket in question (or is it covered by an existing
> report)

Hi Telesto,
i'll report it today...

Comment 15 Xisco Faulí 2018-11-13 09:02:00 UTC

Verified in

Version: 6.2.0.0.alpha1+
Build ID: 21b0bd63a41bda1153bb6173ec23ecdd13353999
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US
Calc: threaded

@Bjoern Michaelsen, thanks for fixing this!!

Comment 16 Xisco Faulí 2018-11-20 13:12:12 UTC

(In reply to Xisco Faulí from comment #14)
> (In reply to Telesto from comment #13)
> > @Xisco
> > Quote: "I found another crash testing it but it was already reproducible
> > before the commit introducing tdf#120115 so I'll report it in another
> > ticket."
> > 
> > -> In search for the ticket in question (or is it covered by an existing
> > report)
> 
> Hi Telesto,
> i'll report it today...

Reported in bug 121546 with a bit of delay...

Comment 17 Commit Notification 2018-11-27 20:14:53 UTC

Bjoern Michaelsen committed a patch related to this issue.
It has been pushed to "libreoffice-6-1":

https://git.libreoffice.org/core/+/912c1584cbdb5eaedb079755df1150b95e8f7329%5E%21

tdf#120115: Dont crash on Footnote/Table undo/redo

It will be available in 6.1.4.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.