Bug 107427 - CRASH: Libreoffice crashes while deleting the header
Summary: CRASH: Libreoffice crashes while deleting the header
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
4.1 all versions
Hardware: All All
: highest critical
Assignee: Michael Stahl
URL:
Whiteboard: target:5.4.0 target:5.3.4 target:5.3....
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2017-04-25 17:39 UTC by Xisco Faulí
Modified: 2017-07-10 15:35 UTC (History)
2 users (show)

See Also:
Crash report or crash signature: ["SwNode::FindTableNode()"]


Attachments
backtrace (173.59 KB, text/plain)
2017-04-25 17:47 UTC, Xisco Faulí
Details
backtrace (194.84 KB, text/plain)
2017-04-26 10:00 UTC, Xisco Faulí
Details
backtrace fixed crash (212.88 KB, text/plain)
2017-04-26 11:47 UTC, Xisco Faulí
Details
backtrace fixed crash (16.32 KB, text/plain)
2017-04-26 11:59 UTC, Xisco Faulí
Details
backtrace (20.17 KB, text/plain)
2017-04-26 12:03 UTC, Xisco Faulí
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Xisco Faulí 2017-04-25 17:39:53 UTC
I reproduced this crash while trying to reproduce bug 95941
Since both crashreport signatures are different, I report this crash in a different report.

Steps to reproduce:
1. Open attachment 120673 [details] from bug 95941
2. Go to page 4
3. Highlight the header
4. Select 'Delete Header' from the blue dropdown menu

Observed behaviour: LibreOffice Crashes
Comment 1 Xisco Faulí 2017-04-25 17:41:41 UTC
Regression introduced by:

author	Michael Stahl <mstahl@redhat.com>	2013-03-27 22:33:44 (GMT)
committer	Michael Stahl <mstahl@redhat.com>	2013-03-27 22:47:11 (GMT)
commit	efc5995170f2ffe98374acb16a4f851bede6842d (patch)
tree	15fcb29b1a0cdcccfa59a088ff5329d1e41b2b5b
parent	b227a8e4d65e4bbfe991aed9342fe3e30eca8639 (diff)
SwCrsrShell: remove pointless resetting of Mark positions...
... before calling DeleteMark(), which actually resets the Mark
position to something guaranteed not to be an SwIndexReg since CWS
odfmetadata2; checking HasMark() before DeleteMark() is pointless too.

Bisected with bibisect-41max.

Adding Cc: to Michael Stahl
Comment 2 Xisco Faulí 2017-04-25 17:47:14 UTC
Created attachment 132836 [details]
backtrace
Comment 3 Michael Stahl 2017-04-26 08:54:28 UTC
Comment on attachment 132836 [details]
backtrace

this backtrace has ScTabViewShell::ExecDrawIns so surely it's for a different crash, in Calc?
Comment 4 Xisco Faulí 2017-04-26 10:00:58 UTC
Created attachment 132846 [details]
backtrace

I'm re-uploading the backtrace just in case the previous one was from another crash...
Comment 5 Michael Stahl 2017-04-26 10:43:56 UTC
there's a step missing to get it to crash, i have to click on the blue header widget again after deleting the header, then it crashes nicely

fixed on master
Comment 6 Commit Notification 2017-04-26 10:45:53 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=8cd1ae22eb2d464516717d767bd3e5f6c2f4bd34

tdf#107427 sw: fix crash with stale entries in SwNavigationMgr

It will be available in 5.4.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 7 Xisco Faulí 2017-04-26 11:20:13 UTC
(In reply to Michael Stahl from comment #5)
> there's a step missing to get it to crash, i have to click on the blue
> header widget again after deleting the header, then it crashes nicely
> 
> fixed on master

In my case I didn't need to click on the blue header again as LibreOffice crashed right after deleting the header. Just for the record: It only crashed if the header was highlighted ( Can be done by going to the left border of the header and clicking once the back arrow appears )
Comment 8 Xisco Faulí 2017-04-26 11:47:20 UTC
Created attachment 132855 [details]
backtrace fixed crash
Comment 9 Xisco Faulí 2017-04-26 11:59:52 UTC
Created attachment 132856 [details]
backtrace fixed crash
Comment 10 Xisco Faulí 2017-04-26 12:03:54 UTC
Created attachment 132858 [details]
backtrace
Comment 11 Commit Notification 2017-04-26 13:28:14 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=b2fdb61446bc072ae1b6db380a584a87a1173f11

tdf#107427 sw: fix crash when deleting header with selected table

It will be available in 5.4.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 12 Michael Stahl 2017-04-26 13:30:41 UTC
okay step 2 means select the entire table in the header, then it crashes

fixed on master
Comment 13 Michael Stahl 2017-04-26 21:12:08 UTC
the SwNavigatonMgr crash effectively only happens on master,
see abandoned backport for why
https://gerrit.libreoffice.org/#/c/37009/
Comment 14 Xisco Faulí 2017-04-26 21:42:45 UTC
(In reply to Michael Stahl from comment #13)
> the SwNavigatonMgr crash effectively only happens on master,
> see abandoned backport for why
> https://gerrit.libreoffice.org/#/c/37009/

Yes, you're right, that's why I couldn't reproduce it on Win, because I was using LibreOffice 5.3.3. I can reproduce it on Win if I use LibreOffice 5.4.0
Comment 15 Xisco Faulí 2017-04-26 21:45:19 UTC
Just for the record, the initial report can be reproduced following these steps:
1. Create a new Writer Document
2. Insert a header
3. Insert a table inside the header
4. Select the table
5. Delete the header

CRASH!

I'll try to create a UI test following these steps
Comment 16 Xisco Faulí 2017-04-27 08:53:38 UTC
Verified in

Version: 5.4.0.0.alpha0+
Build ID: 7c11fe076005ed4e28f04f14990b7011a03a4517
CPU threads: 4; OS: Linux 4.8; UI render: default; VCL: gtk2; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group
Comment 17 Commit Notification 2017-04-27 20:16:02 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-5-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=adc0b3b214323d7588cadd17f2b4faafeb5e4e80&h=libreoffice-5-3

tdf#107427 sw: fix crash when deleting header with selected table

It will be available in 5.3.4.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 18 Commit Notification 2017-05-03 10:48:41 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-5-3-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=016bf0d749eebad63e322563bff8ef87e88a607b&h=libreoffice-5-3-3

tdf#107427 sw: fix crash when deleting header with selected table

It will be available in 5.3.3.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 19 Commit Notification 2017-06-14 11:51:56 UTC
Xisco Fauli committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=6db84250d1c4e7ec5a54ff75e124ea9a84ff89d9

uitest: Add test for insertPageHeader and tdf#107427

It will be available in 6.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.