Bug 107568 - CRASH: Libreoffice crashes while inserting the header/footer in a document
Summary: CRASH: Libreoffice crashes while inserting the header/footer in a document
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
5.3.0.3 release
Hardware: All Linux (All)
: highest critical
Assignee: Michael Stahl (allotropia)
URL:
Whiteboard: target:5.4.0 target:5.3.4
Keywords: haveBacktrace
: 104649 107759 (view as bug list)
Depends on:
Blocks:
 
Reported: 2017-05-02 18:37 UTC by Xisco Faulí
Modified: 2017-05-16 10:08 UTC (History)
5 users (show)

See Also:
Crash report or crash signature:


Attachments
backtrace (30.59 KB, text/plain)
2017-05-02 18:37 UTC, Xisco Faulí
Details
valgrind trace (13.53 KB, text/plain)
2017-05-11 12:16 UTC, Michael Stahl (allotropia)
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Xisco Faulí 2017-05-02 18:37:26 UTC
Created attachment 133015 [details]
backtrace

Steps:
1. Open attachment 126127 [details] from bug 100813
2. Insert a footer in the first page

Reproduced in

Version: 5.4.0.0.alpha0+
Build ID: 597a2f5d5bd37443262b0775b8439bc3502aef1b
CPU threads: 4; OS: Linux 4.8; UI render: default; VCL: gtk2; 
Locale: es-ES (ca_ES.UTF-8); Calc: group

On Linux, it's reproducible back to f374e01af32c7752b31455642e7d76f2056a2aeb. Before that, it crashed at import time.

On Window, it crashes at import time due to bug 106161
Comment 1 Aron Budea 2017-05-02 18:53:52 UTC
Reproduced with a master build / Ubuntu 16.04.

Version: 5.4.0.0.alpha1+
Build ID: 862b6c0a32dfce924bfafa84acaed47c5380fc46
CPU threads: 16; OS: Linux 4.4; UI render: default; VCL: gtk3; 
Locale: en-US (en_US.UTF-8); Calc: group
Comment 2 Timur 2017-05-03 09:12:44 UTC
I can't reproduce in Windows 7. I can open the file with LO 5.3.2.1 64-bit.
> 2. Insert a footer in the first page
Please explain how exactly. Change first page to First page style and then Insert footer for first page?
Comment 3 Xisco Faulí 2017-05-03 09:17:46 UTC
(In reply to Timur from comment #2)
> I can't reproduce in Windows 7. I can open the file with LO 5.3.2.1 64-bit.
> > 2. Insert a footer in the first page
> Please explain how exactly. Change first page to First page style and then
> Insert footer for first page?

it crashes right after clicking on the +. Setting it to Linux only
Comment 4 Vera 2017-05-06 14:39:04 UTC
I can reproduce (with footer and header, too) in
Version: 5.3.2.2
Build ID: 1:5.3.2~rc2-0ubuntu1~xenial0
CPU Threads: 8; OS Version: Linux 4.4; UI Render: default; VCL: gtk3; Layout Engine: new; 
Locale: hu-HU (hu_HU.UTF-8); Calc: single

and in
Version: 5.4.0.0.alpha0+
Build ID: 74ccd02eda2d6325a27266fd935aba29b3d75020
CPU threads: 8; OS: Linux 4.4; UI render: default; VCL: gtk2; 
TinderBox: Linux-rpm_deb-x86_64@70-TDF, Branch:master, Time: 2017-04-27_23:51:14
Locale: hu-HU (hu_HU.UTF-8); Calc: group

Moreover the first time I opened the file, LibreOffice crashed after few seconds before I did anything:
soffice.bin[6747]: segfault at a5 ip 00007f76c747d0a1 sp 00007ffcb805e110 error 4 in libswlo.so[7f76c6d95000+f54000]
Comment 5 Xisco Faulí 2017-05-10 17:51:54 UTC
Hi Caolan,
Since you fixed the crash in bug 100813 and the crash while traversing the table in page 43 with the same document that is crashing here, would you mind taking a look at this crash when you have some time as well?
Thank you in advance.
Comment 6 Michael Stahl (allotropia) 2017-05-11 12:16:01 UTC
Created attachment 133236 [details]
valgrind trace

took an hour to run that far in valgrind but unfortunately ASAN proved utterly useless
Comment 7 Michael Stahl (allotropia) 2017-05-11 13:04:21 UTC
so MoveFootnoteCntFwd calls MoveSubTree with pParent = new footnote and pSibling = text frame that is follow of "this" and "this" is formatted and of course the follow is deleted in a JoinFrame call - how is that any surprise and how did that ever work before?
Comment 8 Commit Notification 2017-05-12 19:22:12 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=f6785b99a3f7e7531c8ef7ed16402cc4e02c9750

tdf#107568 sw: prevent moving/splitting of tables in footnotes

It will be available in 5.4.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 9 Michael Stahl (allotropia) 2017-05-12 20:50:18 UTC
actually this went wrong much earlier.

the MoveFootnoteCntFwd tries to move a text frame inside a cell to the next page directly under the footnote container - it should move into another cell frame.

can't figure out how to get the formatting of the paragraph in the table to not split up, so i just nerfed table-in-footnote formatting a bit harder than it already was, at least it doesnt crash any more.

fixed on master
Comment 10 Xisco Faulí 2017-05-13 00:18:23 UTC
Confirmed in

Version: 5.4.0.0.alpha1+
Build ID: 2e399f32e7505bdcf855112d8a48ae0edefe5bbc
CPU Threads: 4; OS Version: Linux 4.8; UI Render: default; VCL: gtk2; 
Locale: fo-FO (ca_ES.UTF-8); Calc: group

Michael, Thank you very much for fixing this. this also fixes bug 104649 and bug 107759
Comment 11 Xisco Faulí 2017-05-13 00:21:09 UTC
*** Bug 104649 has been marked as a duplicate of this bug. ***
Comment 12 Xisco Faulí 2017-05-13 00:22:23 UTC
*** Bug 107759 has been marked as a duplicate of this bug. ***
Comment 13 Commit Notification 2017-05-16 10:08:59 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-5-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=c4b55ea03da881590e5fac1ffc97177e4ce16b0b&h=libreoffice-5-3

tdf#107568 sw: prevent moving/splitting of tables in footnotes

It will be available in 5.3.4.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.