Bug 69979

Summary:	EDITING "Select All" crashes Writer when the document contains a header or footer and starts with a table
Product:	LibreOffice	Reporter:	Stephan van den Akker <stephanv778>
Component:	Writer	Assignee:	Miklos Vajna <vmiklos>
Status:	RESOLVED FIXED
Severity:	major	CC:	stephanv778, vmiklos
Priority:	medium	Keywords:	regression
Version:	4.2.0.0.alpha0+ Master
Hardware:	Other
OS:	All
See Also:	https://bugs.freedesktop.org/show_bug.cgi?id=69862 https://bugs.freedesktop.org/show_bug.cgi?id=69893
Whiteboard:	target:4.2.0
Crash report or crash signature:		Regression By:
Attachments:	Example reproducer document that starts with a table and contains a header.

Description Stephan van den Akker 2013-09-30 19:02:25 UTC

Created attachment 86870 [details]
Example reproducer document that starts with a table and contains a header.

How to reproduce:

1 - Open the attached file
2 - Select All (Ctrl-A)

Expected behaviour: All text in the document is selected

Actual behaviour: Text in header is selected, followed by a crash

Crash happens on openSuSE 11.4 (64-bit):
Version: 4.2.0.0.alpha0+
Build ID: e5c370e53d8701d863d231c26ce8e5c46385e5eb

Crash also happens on openSuSE 12.3 (64-bit): 
Version: 4.2.0.0.alpha0+
Build ID: d74ca89ae860025aea98a36cee19fc128a7846e4

gdb output on crash:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x2aaac0bd0700 (LWP 30801)]
0x00002aaaf18403e0 in BigPtrEntry::GetPos (this=0x0) at /home/stephan/Software/libreoffice/core/sw/inc/bparr.hxx:109
109         assert(this == pBlock->pData[ nOffset ]); // element not in the block

(gdb) backtrace
#0  0x00002aaaf18403e0 in BigPtrEntry::GetPos (this=0x0) at /home/stephan/Software/libreoffice/core/sw/inc/bparr.hxx:109
#1  0x00002aaaf184047e in SwNode::GetIndex (this=0x0) at /home/stephan/Software/libreoffice/core/sw/inc/node.hxx:279
#2  0x00002aaaf1b11f45 in SwEditShell::_CopySelToDoc (this=0x1d25bd0, pInsDoc=0x1642f90, pSttNd=0x0) at /home/stephan/Software/libreoffice/core/sw/source/core/edit/edglss.cxx:240
#3  0x00002aaaf1b6814b in SwFEShell::Copy (this=0x1d25bd0, pClpDoc=0x1642f90, pNewClpTxt=0x0) at /home/stephan/Software/libreoffice/core/sw/source/core/frmedt/fecopy.cxx:219
#4  0x00002aaaf214d570 in (anonymous namespace)::lclOverWriteDoc (rSrcWrtShell=..., rDest=...) at /home/stephan/Software/libreoffice/core/sw/source/ui/dochdl/swdtflvr.cxx:373
#5  0x00002aaaf214da4d in SwTransferable::GetData (this=0x1680b20, rFlavor=...) at /home/stephan/Software/libreoffice/core/sw/source/ui/dochdl/swdtflvr.cxx:438
#6  0x00002aaaae6a6906 in TransferableHelper::getTransferData (this=0x1680b20, rFlavor=...) at /home/stephan/Software/libreoffice/core/svtools/source/misc/transfer.cxx:361
#7  0x00002aaabce89284 in x11::SelectionManager::convertData (this=0x142a3a0, xTransferable=..., nType=364, nSelection=1, rFormat=@0x2aaac0bcf82c: 8, rData=...)
    at /home/stephan/Software/libreoffice/core/vcl/unx/generic/dtrans/X11_selection.cxx:668
#8  0x00002aaabce8cda3 in x11::SelectionManager::sendData (this=0x142a3a0, pAdaptor=0x1642db0, requestor=67108900, target=364, property=305, selection=1)
    at /home/stephan/Software/libreoffice/core/vcl/unx/generic/dtrans/X11_selection.cxx:1535
#9  0x00002aaabce8d7e1 in x11::SelectionManager::handleSelectionRequest (this=0x142a3a0, rRequest=...) at /home/stephan/Software/libreoffice/core/vcl/unx/generic/dtrans/X11_selection.cxx:1763
#10 0x00002aaabce94b48 in x11::SelectionManager::handleXEvent (this=0x142a3a0, rEvent=...) at /home/stephan/Software/libreoffice/core/vcl/unx/generic/dtrans/X11_selection.cxx:3644
#11 0x00002aaabce94e05 in x11::SelectionManager::dispatchEvent (this=0x142a3a0, millisec=-1) at /home/stephan/Software/libreoffice/core/vcl/unx/generic/dtrans/X11_selection.cxx:3723
#12 0x00002aaabce94f8e in x11::SelectionManager::run (pThis=0x142a3a0) at /home/stephan/Software/libreoffice/core/vcl/unx/generic/dtrans/X11_selection.cxx:3752
#13 0x00002aaabce865ac in call_SelectionManager_run (pMgr=0x142a3a0) at /home/stephan/Software/libreoffice/core/vcl/unx/generic/dtrans/X11_selection.cxx:91
#14 0x00002aaaaaceac2b in osl_thread_start_Impl (pData=0x1441990) at /home/stephan/Software/libreoffice/core/sal/osl/unx/thread.c:236
#15 0x00002aaaab621e0f in start_thread (arg=0x2aaac0bd0700) at pthread_create.c:308
#16 0x00002aaaab35544d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113

Comment 1 Commit Notification 2013-10-02 09:47:13 UTC

Miklos Vajna committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=232df42b8dc0b4f7a335d2931fc0f29e73b8bca0

fdo#69979 SwCrsrShell::ExtendedSelectAll: exclude headers, too



The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.

Comment 2 Miklos Vajna 2013-10-02 09:49:27 UTC

Fixed in master, marking as resolved. No backport, as problem is master-only.

Thanks for the report! :-)

Comment 3 Stephan van den Akker 2013-10-02 12:30:32 UTC

Confirmed fixed on 64-bit openSuSE 12.3 (one of the previously crashing system) with:

Version: 4.2.0.0.alpha0+
Build ID: 11ad93f4ba84f190c908e92a2c960f7a9fa800c0

Thanks Miklos, for fixing this and the long standing annoyance of bug 69893.