Bug 130746

Summary: Writer crashes when Alt+Arrow Up keys are pressed within a table row spanning two pages
Product: LibreOffice Reporter: Otar Magaldadze <omagaldadze>
Component: WriterAssignee: Justin L <jluth>
Status: VERIFIED FIXED    
Severity: major CC: jluth, michael.stahl, serval2412, xiscofauli
Priority: high Keywords: haveBacktrace
Version: Inherited From OOo   
Hardware: All   
OS: All   
See Also: https://crashreport.libreoffice.org/stats/signature/lcl_CalcCellRstHeight
Whiteboard: target:7.0.0 target:6.4.3 target:6.3.6
Crash report or crash signature: ["lcl_CalcCellRstHeight"] Regression By:
Bug Depends on:    
Bug Blocks: 103100    
Attachments: Sample file
bt Windows (windbg)

Description Otar Magaldadze 2020-02-17 20:37:45 UTC 
Description:
Writer crashes when while standing in a table row that spans 2 pages you press Alt-Arrow Up keys.

I have this one reproducible on ArchLinux, installed from their official repos.
Haven't tried reproducing on other distros.

Steps to Reproduce:
1. Open clean new Document
2. At the end of the page insert 2 x 1 table (2 columns and 1 row [Important!])
3. Put cursor in one of the cells and hit Enter until it spans down to the next page
4. Then hit Alter + Arrow Up key combination

Actual Results:
Writer crashed

Expected Results:
At least, not to crash.


Reproducible: Always


User Profile Reset: Yes


OpenGL enabled: Yes

Additional Info:
Version: 6.4.0.3
Build ID: 6.4.0-2
CPU threads: 4; OS: Linux 5.5; UI render: default; VCL: gtk3; 
Locale: en-US (en_US.UTF-8); UI-Language: en-US
Calc: threaded
Comment 1 MM 2020-02-17 21:30:03 UTC 
Confirmed on windows 10 with Version: 6.3.5.2 (x64)
Build ID: dd0751754f11728f69b42ee2af66670068624673
CPU threads: 12; OS: Windows 10.0; UI render: default; VCL: win

Confirmed on mint 19.3 x64 with Version: 6.0.7.3
Build ID: 1:6.0.7-0ubuntu0.18.04.10
CPU threads: 5; OS: Linux 5.3; UI render: default; VCL: gtk3; 
Locale: en-US (en_US.UTF-8); Calc: 

and

Version: 7.0.0.0.alpha0+
Build ID: 4ff12ba6f4639c73587f2bb58afcc3ca6fb30105
CPU threads: 5; OS: Linux 5.3; UI render: default; VCL: gtk3; 
TinderBox: Linux-rpm_deb-x86_64@86-TDF, Branch:master, Time: 2020-01-24_21:09:14
Locale: en-US (en_US.UTF-8); UI-Language: en-US
Calc: threaded
Comment 2 Xisco Faulí 2020-02-18 10:03:13 UTC 
Reproduced in

Version: 5.2.0.0.alpha1+
Build ID: 5b168b3fa568e48e795234dc5fa454bf24c9805e
CPU Threads: 4; OS Version: Linux 4.8; UI Render: default; 
Locale: ca-ES (ca_ES.UTF-8)


Version: 4.3.0.0.alpha1+
Build ID: c15927f20d4727c3b8de68497b6949e72f9e6e9e

Version 4.1.0.0.alpha0+ (Build ID: efca6f15609322f62a35619619a6d5fe5c9bd5a)

LibreOffice 3.3.0 
OOO330m19 (Build:6)
tag libreoffice-3.3.0.4
Comment 3 Xisco Faulí 2020-02-18 10:03:34 UTC 
Created attachment 157973 [details]
Sample file
Comment 4 Julien Nabet 2020-02-18 13:04:54 UTC 
Created attachment 157976 [details]
bt Windows (windbg)

On Win10 with master sources updated today, I could reproduce this.
I attached a bt with symbols.
Comment 5 Xisco Faulí 2020-02-18 13:07:32 UTC 
@Michael, I thought you might be interested in this issue...
Comment 6 Justin L 2020-03-17 18:20:58 UTC 
proposed fix at https://gerrit.libreoffice.org/c/core/+/90661
Comment 7 Commit Notification 2020-03-18 01:50:08 UTC 
Justin Luth committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/81588ff2f0eb55576a5288778be2dfb5b4bc5e81

tdf#130746: avoid nullptr dereference

It will be available in 7.0.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 8 Commit Notification 2020-03-18 13:12:55 UTC 
Xisco Fauli committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/b705be7c8c28c4e1c1263e476b7b9cb0d6cee089

tdf#130746: Add unittest

It will be available in 7.0.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 9 Commit Notification 2020-03-23 13:15:07 UTC 
Justin Luth committed a patch related to this issue.
It has been pushed to "libreoffice-6-4":

https://git.libreoffice.org/core/commit/e73871e273c815461626782b2b055c946c6042d2

tdf#130746: avoid nullptr dereference

It will be available in 6.4.3.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 10 Commit Notification 2020-03-23 13:15:19 UTC 
Justin Luth committed a patch related to this issue.
It has been pushed to "libreoffice-6-3":

https://git.libreoffice.org/core/commit/a108e875a3b07c78a8a2a052fb1bbab9aab28c51

tdf#130746: avoid nullptr dereference

It will be available in 6.3.6.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 11 Xisco Faulí 2020-03-27 13:11:13 UTC 
Verified in

Version: 7.0.0.0.alpha0+
Build ID: 9b784a74a2f09e9eb9a0fd41d58c1f6b47ee6ee6
CPU threads: 4; OS: Linux 4.19; UI render: default; VCL: gtk3; 
Locale: en-US (en_US.UTF-8); UI-Language: en-US
Calc: threaded

@Justin, thanks for fixing this issue! Closing as VERIFIED FIXED