Bug 155323

This was originally reported as <https://bugzilla.redhat.com/show_bug.cgi?id=2122948> "Reproducible crash in Writer" (against LO 7.3 on Fedora; see there for the reproducer core.3329743.odt), but is also reproducible with a recent non-Fedora upstream master build towards LO 7.6:

> Steps to Reproduce:
> 1. ooffice core.3329743.odt
> 2. Select line "Další podrobnosti o prodávaném vozidle (parametry, výbava, příslušenství):" incl. 6 next dash-empty lines.
> 3. Delete them by delete+backspace.
> 4. Type CTRL-S.

A recent master backtrace leading to the failed assert at

> sw/source/core/text/redlnitr.cxx:157: bool (anonymous namespace)::HideIterator::Next(): Assertion `pFieldmark' failed.

is

> #6  0x00007fff5031476f in (anonymous namespace)::HideIterator::Next() (this=0x7fff8be38260) at sw/source/core/text/redlnitr.cxx:157
> #7  0x00007fff50309f4b in sw::CheckParaRedlineMerge(SwTextFrame&, SwTextNode&, sw::FrameMode) (rFrame=..., rTextNode=..., eMode=sw::FrameMode::New) at sw/source/core/text/redlnitr.cxx:288
> #8  0x00007fff5041d93a in SwTextFrame::SwTextFrame(SwTextNode*, SwFrame*, sw::FrameMode) (this=0x51400070ea40, pNode=0x516000e61c80, pSib=0x51300038e040, eMode=sw::FrameMode::New)
>     at sw/source/core/text/txtfrm.cxx:793
> #9  0x00007fff5041dbec in sw::MakeTextFrame(SwTextNode&, SwFrame*, sw::FrameMode) (rNode=..., pSibling=0x51300038e040, eMode=sw::FrameMode::New) at sw/source/core/text/txtfrm.cxx:801
> #10 0x00007fff50901643 in SwTextNode::MakeFrame(SwFrame*) (this=0x516000e61c80, pSib=0x51300038e040) at sw/source/core/txtnode/ndtxt.cxx:287
> #11 0x00007fff4e3ed46b in SwContentNode::MakeFramesForAdjacentContentNode(SwContentNode&) (this=0x5160004c5f80, rNode=...) at sw/source/core/docnode/node.cxx:1403
> #12 0x00007fff4e4381e0 in SwNodes::ChgNode(SwNodeIndex const&, o3tl::strong_int<int, Tag_SwNodeOffset>, SwNodeIndex&, bool) (this=0x50d000354af0, rDelPos=SwNodeIndex (node 132), nSz=..., rInsPos=SwNodeIndex (node 138), bNewFrames=true)
>     at sw/source/core/docnode/nodes.cxx:384
> #13 0x00007fff4e453ae6 in SwNodes::MoveNodes(SwNodeRange const&, SwNodes&, SwNode&, bool) (this=0x50d000354af0, aRange=..., rNodes=..., rPos=..., bNewFrames=true) at sw/source/core/docnode/nodes.cxx:862
> #14 0x00007fff4e46fc5a in SwNodes::MoveRange(SwPaM&, SwPosition&, SwNodes&) (this=0x50d000354af0, rPam=SwPaM = {...}, rPos=SwPosition (node 138, offset 0), rNodes=...) at sw/source/core/docnode/nodes.cxx:1667
> #15 0x00007fff4d8ec772 in sw::DocumentContentOperationsManager::MoveRange(SwPaM&, SwPosition&, SwMoveFlags) (this=0x503000393340, rPaM=SwPaM = {...}, rPos=SwPosition (node 138, offset 0), eMvFlags=SwMoveFlags::ALLFLYS)
>     at sw/source/core/doc/DocumentContentOperationsManager.cxx:2499
> #16 0x00007fff4d63835e in SwRangeRedline::MoveFromSection(unsigned long) (this=0x512001e56140, nMyPos=29) at sw/source/core/doc/docredln.cxx:1844
> #17 0x00007fff4d631dd2 in SwRangeRedline::Show(unsigned short, unsigned long, bool) (this=0x512001e56140, nLoop=1, nMyPos=29, bForced=false) at sw/source/core/doc/docredln.cxx:1323
> #18 0x00007fff4daafdc6 in sw::DocumentRedlineManager::SetRedlineFlags(RedlineFlags) (this=0x5100000faf40, eMode=49) at sw/source/core/doc/DocumentRedlineManager.cxx:1187
> #19 0x00007fff526a5961 in SwXMLWriter::Write_(SfxItemSet const*) (this=0x50c0025fedc0, pMediumItemSet=0x5070010e37f0) at sw/source/filter/xml/wrtxml.cxx:435
> #20 0x00007fff526a8be5 in SwXMLWriter::WriteMedium(SfxMedium&) (this=0x50c0025fedc0, aTargetMedium=...) at sw/source/filter/xml/wrtxml.cxx:470
> #21 0x00007fff525b6501 in StgWriter::Write(SwPaM&, com::sun::star::uno::Reference<com::sun::star::embed::XStorage> const&, rtl::OUString const*, SfxMedium*)
>     (this=0x50c0025fedc0, rPaM=SwPaM = {...}, rStg=uno::Reference to (OStorage *) 0x51200206adc8, pFName=0x0, pMedium=0x503000ea78a0) at sw/source/filter/writer/writer.cxx:493
> #22 0x00007fff526a91bc in SwXMLWriter::Write(SwPaM&, SfxMedium&, rtl::OUString const*) (this=0x50c0025fedc0, rPaM=SwPaM = {...}, rMed=..., pFileName=0x0) at sw/source/filter/xml/wrtxml.cxx:477
> #23 0x00007fff51dcd785 in SwWriter::Write(tools::SvRef<Writer> const&, rtl::OUString const*) (this=0x7fff8bd0f5a0, rxWriter=..., pRealFileName=0x0) at sw/source/filter/basflt/shellio.cxx:868
> #24 0x00007fff52a2e9e1 in SwDocShell::SaveAs(SfxMedium&) (this=0x514000035a40, rMedium=...) at sw/source/uibase/app/docsh.cxx:546
> #25 0x00007fffe2b4f49a in SfxObjectShell::SaveAsOwnFormat(SfxMedium&) (this=0x514000035a40, rMedium=...) at sfx2/source/doc/objstor.cxx:3256
> #26 0x00007fffe2b0e2f6 in SfxObjectShell::SaveTo_Impl(SfxMedium&, SfxItemSet const*) (this=0x514000035a40, rMedium=..., pSet=0x7fff8bdff9b0) at sfx2/source/doc/objstor.cxx:1457
> #27 0x00007fffe2b3adbc in SfxObjectShell::DoSave_Impl(SfxItemSet const*) (this=0x514000035a40, pArgs=0x7fff8bdff9b0) at sfx2/source/doc/objstor.cxx:2622
> #28 0x00007fffe2b3e397 in SfxObjectShell::Save_Impl(SfxItemSet const*) (this=0x514000035a40, pSet=0x7fff8bdff9b0) at sfx2/source/doc/objstor.cxx:2701
> #29 0x00007fffe2ce3071 in SfxBaseModel::storeSelf(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (this=0x51a000667e80, aSeqArgs=uno::Sequence of length 2 = {...})
>     at sfx2/source/doc/sfxbasemodel.cxx:1679
> #30 0x00007fffe299218f in SfxStoringHelper::GUIStoreModel(com::sun::star::uno::Reference<com::sun::star::frame::XModel> const&, std::basic_string_view<char16_t, std::char_traits<char16_t> >, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue>&, bool, SignatureState, bool)
>     (this=0x5070010dc1d0, xModel=uno::Reference to (SwXTextDocument *) 0x51a000667f10, aSlotName=u"Save", aArgsSequence=uno::Sequence of length 2 = {...}, bPreselectPassword=false, nDocumentSignatureState=SignatureState::NOSIGNATURES, bIsAsync=false) at sfx2/source/doc/guisaveas.cxx:1517
> #31 0x00007fffe2a755e0 in SfxObjectShell::ExecFile_Impl(SfxRequest&) (this=0x514000035a40, rReq=...) at sfx2/source/doc/objserv.cxx:1047
> #32 0x00007fffe2a63255 in SfxStubSfxObjectShellExecFile_Impl(SfxShell*, SfxRequest&) (pShell=0x514000035a40, rReq=...) at workdir/SdiTarget/sfx2/sdi/sfxslots.hxx:220
> #33 0x00007fffe19507fe in SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, bool) (this=0x502000917550, rShell=..., rSlot=..., rReq=..., bRecord=true) at sfx2/source/control/dispatch.cxx:254
> #34 0x00007fffe19536d9 in SfxDispatcher::PostMsgHandler(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >) (this=0x502000917550, pReq=std::unique_ptr<SfxRequest> = {...})
>     at sfx2/source/control/dispatch.cxx:992
> #35 0x00007fffe1a30137 in std::__invoke_impl<void, void (SfxDispatcher::*&)(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >), SfxDispatcher*&, std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> > >(std::__invoke_memfun_deref, void (SfxDispatcher::*&)(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >), SfxDispatcher*&, std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >&&)
>     (__f=@0x5030015709c0: (void (SfxDispatcher::*)(class SfxDispatcher * const, class std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >)) 0x7fffe1952cd0 <SfxDispatcher::PostMsgHandler(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >)>, __t=@0x5030015709d0: 0x502000917550, __args=...) at /home/sbergman/gcc/trunk/inst/include/c++/14.0.0/bits/invoke.h:74
> #36 0x00007fffe1a2fc79 in std::__invoke<void (SfxDispatcher::*&)(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >), SfxDispatcher*&, std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> > >(void (SfxDispatcher::*&)(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >), SfxDispatcher*&, std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >&&)
>     (__fn=@0x5030015709c0: (void (SfxDispatcher::*)(class SfxDispatcher * const, class std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >)) 0x7fffe1952cd0 <SfxDispatcher::PostMsgHandler(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >)>, __args=@0x5030015709d0: 0x502000917550, __args=...) at /home/sbergman/gcc/trunk/inst/include/c++/14.0.0/bits/invoke.h:96
> #37 0x00007fffe1a2fa8b in std::_Bind<void (SfxDispatcher::*(SfxDispatcher*, std::_Placeholder<1>))(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >)>::__call<void, std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >&&, 0ul, 1ul>(std::tuple<std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >&&>&&, std::_Index_tuple<0ul, 1ul>) (this=0x5030015709c0, __args=...) at /home/sbergman/gcc/trunk/inst/include/c++/14.0.0/functional:506
> #38 0x00007fffe1a2f717 in std::_Bind<void (SfxDispatcher::*(SfxDispatcher*, std::_Placeholder<1>))(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >)>::operator()<std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >, void>(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >&&) (this=0x5030015709c0, __args=...) at /home/sbergman/gcc/trunk/inst/include/c++/14.0.0/functional:591
> #39 0x00007fffe1a2f5cd in std::__invoke_impl<void, std::_Bind<void (SfxDispatcher::*(SfxDispatcher*, std::_Placeholder<1>))(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >)>&, std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> > >(std::__invoke_other, std::_Bind<void (SfxDispatcher::*(SfxDispatcher*, std::_Placeholder<1>))(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >)>&, std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >&&) (__f=..., __args=...) at /home/sbergman/gcc/trunk/inst/include/c++/14.0.0/bits/invoke.h:61
> #40 0x00007fffe1a2f47d in std::__invoke_r<void, std::_Bind<void (SfxDispatcher::*(SfxDispatcher*, std::_Placeholder<1>))(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >)>&, std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> > >(std::_Bind<void (SfxDispatcher::*(SfxDispatcher*, std::_Placeholder<1>))(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >)>&, std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >&&)
>     (__fn=..., __args=...) at /home/sbergman/gcc/trunk/inst/include/c++/14.0.0/bits/invoke.h:111
> #41 0x00007fffe1a2ebc9 in std::_Function_handler<void (std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >), std::_Bind<void (SfxDispatcher::*(SfxDispatcher*, std::_Placeholder<1>))(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >)> >::_M_invoke(std::_Any_data const&, std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >&&) (__functor=..., __args=...) at /home/sbergman/gcc/trunk/inst/include/c++/14.0.0/bits/std_function.h:290
> #42 0x00007fffe2fad10f in std::function<void (std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >)>::operator()(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >) const
>     (this=0x5040012a8fe0, __args=std::unique_ptr<SfxRequest> = {...}) at /home/sbergman/gcc/trunk/inst/include/c++/14.0.0/bits/std_function.h:591
> #43 0x00007fffe2fac5bd in SfxHintPoster::DoEvent_Impl(void*) (this=0x5040012a8fd0, pPostedHint=0x5030013473a0) at sfx2/source/notify/hintpost.cxx:43
> #44 0x00007fffe2fac2f9 in SfxHintPoster::LinkStubDoEvent_Impl(void*, void*) (instance=0x5040012a8fd0, data=0x5030013473a0) at sfx2/source/notify/hintpost.cxx:39
> #45 0x00007fffbe467893 in Link<void*, void>::Call(void*) const (this=0x5070010dc238, data=0x5030013473a0) at include/tools/link.hxx:111
> #46 0x00007fffbe44e881 in ImplHandleUserEvent(ImplSVEvent*) (pSVEvent=0x5070010dc230) at vcl/source/window/winproc.cxx:2287
> #47 0x00007fffbe4398d4 in ImplWindowFrameProc(vcl::Window*, SalEvent, void const*) (_pWindow=0x50b00012c3d0, nEvent=SalEvent::UserEvent, pEvent=0x5070010dc230) at vcl/source/window/winproc.cxx:2857
> #48 0x00007fffc1ef5828 in SalFrame::CallCallback(SalEvent, void const*) const (this=0x519000147380, nEvent=SalEvent::UserEvent, pEvent=0x5070010dc230) at vcl/inc/salframe.hxx:309
> #49 0x00007fffc1fbc53b in SalGenericDisplay::ProcessEvent(SalUserEventList::SalUserEvent) (this=0x51900007e980, aEvent=...) at vcl/unx/generic/app/gendisp.cxx:66
> #50 0x00007fffc08e09c1 in SalUserEventList::DispatchUserEvents(bool)::$_0::operator()() const (this=0x7fff8bb73120) at vcl/source/app/salusereventlist.cxx:119
> #51 0x00007fffc08e015b in SalUserEventList::DispatchUserEvents(bool) (this=0x51900007e980, bHandleAllCurrentEvents=false) at vcl/source/app/salusereventlist.cxx:120
> #52 0x00007fffc1fbbff8 in SalGenericDisplay::DispatchInternalEvent(bool) (this=0x51900007e980, bHandleAllCurrentEvent=false) at vcl/unx/generic/app/gendisp.cxx:51
> #53 0x00007fff7c9ab1d0 in call_userEventFn(void*) (data=0x508000003020) at vcl/unx/gtk3/gtkdata.cxx:824
> #54 0x00007fffe670f39d in g_idle_dispatch (source=0x50b000a12500, callback=0x7fff7c9aad40 <call_userEventFn(void*)>, user_data=0x508000003020)
>     at ~/.cache/debuginfod_client/4477ca37e3b61bca6e9aba802b32cba8890d2c3c/source##usr##src##debug##glib2-2.76.2-1.fc38.x86_64##redhat-linux-build##..##glib##gmain.c:6163
> #55 0x00007fffe671339c in g_main_dispatch (context=0x50f000013960)
>     at ~/.cache/debuginfod_client/4477ca37e3b61bca6e9aba802b32cba8890d2c3c/source##usr##src##debug##glib2-2.76.2-1.fc38.x86_64##redhat-linux-build##..##glib##gmain.c:3460
> #56 g_main_context_dispatch (context=0x50f000013960) at ~/.cache/debuginfod_client/4477ca37e3b61bca6e9aba802b32cba8890d2c3c/source##usr##src##debug##glib2-2.76.2-1.fc38.x86_64##redhat-linux-build##..##glib##gmain.c:4200
> #57 0x00007fffe6771438 in g_main_context_iterate.isra.0 (context=0x50f000013960, block=1, dispatch=1, self=<optimized out>)
>     at ~/.cache/debuginfod_client/4477ca37e3b61bca6e9aba802b32cba8890d2c3c/source##usr##src##debug##glib2-2.76.2-1.fc38.x86_64##redhat-linux-build##..##glib##gmain.c:4276
> #58 0x00007fffe6710a23 in g_main_context_iteration (context=0x50f000013960, may_block=1)
>     at ~/.cache/debuginfod_client/4477ca37e3b61bca6e9aba802b32cba8890d2c3c/source##usr##src##debug##glib2-2.76.2-1.fc38.x86_64##redhat-linux-build##..##glib##gmain.c:4343
> #59 0x00007fff7c9a5ba1 in GtkSalData::Yield(bool, bool) (this=0x508000003020, bWait=true, bHandleAllCurrentEvents=false) at vcl/unx/gtk3/gtkdata.cxx:405
> #60 0x00007fff7c9bdbae in GtkInstance::DoYield(bool, bool) (this=0x5130000011c0, bWait=true, bHandleAllCurrentEvents=false) at vcl/unx/gtk3/gtkinst.cxx:433
> #61 0x00007fffc0d256d9 in ImplYield(bool, bool) (i_bWait=true, i_bAllEvents=false) at vcl/source/app/svapp.cxx:379
> #62 0x00007fffc0d23d29 in Application::Yield() () at vcl/source/app/svapp.cxx:463
> #63 0x00007fffc0d235e8 in Application::Execute() () at vcl/source/app/svapp.cxx:357
> #64 0x00007ffff6b85575 in desktop::Desktop::Main() (this=0x7fff8bb07c20) at desktop/source/app/app.cxx:1593
> #65 0x00007fffc0dc294b in ImplSVMain() () at vcl/source/app/svmain.cxx:203
> #66 0x00007fffc0dcb551 in SVMain() () at vcl/source/app/svmain.cxx:235
> #67 0x00007ffff6d7227f in soffice_main() () at desktop/source/app/sofficemain.cxx:94
> #68 0x0000555555681b9d in sal_main () at desktop/source/app/main.c:51
> #69 0x0000555555681b77 in main (argc=2, argv=0x7fffffffd9a8) at desktop/source/app/main.c:49