Bug 107975 - CRASH: Crash after undo operation (BigPtrArray::Index2Block(unsigned long)
Summary: CRASH: Crash after undo operation (BigPtrArray::Index2Block(unsigned long)
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
4.4 all versions
Hardware: All All
: highest critical
Assignee: Michael Stahl
QA Contact:
URL:
Whiteboard: target:6.0.0 target:5.3.6 target:5.4....
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2017-05-20 18:59 UTC by Telesto
Modified: 2017-08-05 18:40 UTC (History)
4 users (show)

See Also:
Crash report or crash signature: ["BigPtrArray::Index2Block(unsigned long)"]


Attachments
Example file (10.07 KB, application/odt)
2017-05-20 19:00 UTC, Telesto
Details
backtrace (24.81 KB, text/plain)
2017-05-21 13:40 UTC, Xisco Faulí
Details
bt with debug symbols (9.27 KB, text/plain)
2017-05-26 10:04 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Telesto 2017-05-20 18:59:47 UTC
Description:
Crash after undo operation

Steps to Reproduce:
1. Open the attached file
2. Press CTRL+A and + CTRL+C
3. Position the mouse cursor (caret) after "ABC" below the blue image
4. Paste CTRL+V
5. Undo paste CTRL+Z -> Crash

crashreport.libreoffice.org/stats/crash_details/6b2a72a2-80d4-4759-84bc-b695350653d4


Actual Results:  
Crash

Expected Results:
No crash


Reproducible: Always

User Profile Reset: No

Additional Info:
Versie: 5.4.0.0.beta1 
Build ID: 8672113ead4e403c55e31b1d9a3d1e0f3b299577
CPU-threads: 4; Besturingssysteem:Windows 6.2; UI-render: standaard; 
Locale: nl-NL (nl_NL); Calc: CL


User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Comment 1 Telesto 2017-05-20 19:00:05 UTC
Created attachment 133424 [details]
Example file
Comment 2 Xisco Faulí 2017-05-21 13:35:33 UTC
Confirmed in

Version: 5.4.0.0.alpha1+
Build ID: 74d2e606fd3605fe0a585f596eaa215ae4e20d18
CPU Threads: 4; OS Version: Linux 4.8; UI Render: default; VCL: gtk3; 
Locale: en-US (ca_ES.UTF-8); Calc: group

and

Version: 5.2.0.0.alpha1+
Build ID: 5b168b3fa568e48e795234dc5fa454bf24c9805e
CPU Threads: 4; OS Version: Linux 4.8; UI Render: default; 
Locale: ca-ES (ca_ES.UTF-8)

but not in

Version: 5.0.0.0.alpha1+
Build ID: 0db96caf0fcce09b87621c11b584a6d81cc7df86
Locale: ca-ES (ca_ES.UTF-8)
Comment 3 Xisco Faulí 2017-05-21 13:40:09 UTC
Created attachment 133434 [details]
backtrace
Comment 4 Xisco Faulí 2017-05-21 13:55:17 UTC
Regression introduced in range https://cgit.freedesktop.org/libreoffice/core/log/?qt=range&q=240d1f289c5788845cd4336f223f2c4bc8975a99..4f918cd5daed963287805da761e6983a392ae050

Bibisected with lo-linux-dbgutil-daily-till51
Comment 5 Aron Budea 2017-05-24 01:28:01 UTC
I got a freeze during bibisection, and the other symptom is that the blue image got moved, not copied to its new place. Adding Cc: to Michael Stahl, please take a look.

While it's a revert, the reverted commit is from a year before.

https://cgit.freedesktop.org/libreoffice/core/commit/?id=e84f0a9b3223f49b0829f2f55dacbf11ae201c1e
author		Michael Stahl <mstahl@redhat.com>	2015-09-11 15:20:27 (GMT)
committer	Michael Stahl <mstahl@redhat.com>	2015-09-11 15:44:27 (GMT)

Revert "Fix single node CopyRange"
Comment 6 Xisco Faulí 2017-05-24 08:22:54 UTC
I do confirm LibreOffice crashes before 9099e21b89184bd4e39def497e483cac4a77ec5a. Tested with bibisect-44max
Comment 7 Xisco Faulí 2017-05-25 11:08:26 UTC
Regression introduced initially by:

author	Luboš Luňák <l.lunak@collabora.com>	2014-08-12 16:39:02 (GMT)
committer	Luboš Luňák <l.lunak@collabora.com>	2014-08-12 18:23:16 (GMT)
commit	2903d85d6197829633d7f96c95cd55821c2c20ff (patch)
tree	c73b28cb073885647e4e9274735bc7e4ed93fa10
parent	95f0811c093680e6258f3bc973a3f7a3731a28f4 (diff)
fix deleting an image anchored to last paragraph in document
It only compared nodes instead of SwPositions, thus refusing to delete
anything anchored at the last content node. Also, select-all makes
rEnd point to the last content node, after its content. So if
an anchor-to-char image is anchored at the end of the paragraph,
it points to this place, too, so that must be checked.

Bisected with bibisect-44max
Comment 8 Julien Nabet 2017-05-26 10:04:58 UTC
Created attachment 133609 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated 2 days ago, I could reproduce this.
I attached a bt + content of BigPtrArray when crash happened.
Comment 9 Michael Stahl 2017-07-19 15:36:34 UTC
the commit in comment #7 is a good idea but unfortunately incomplete;
there are other places than the one changed there that need to agree
as to whether flys in a selection are deleted or not.

this includes Undo as in this report and OOo issue 97570 (Insert File
instead of Paste) which was incidentally re-introduced by this commit,
as well as redlining.

the Undo currently has difficulties distinguishing between flys
that were already there vs. flys that were inserted by the Paste,
so if it deletes too many flys all the nodes-indexes stored
in Undo objects are off and can cause out-of-bounds indexing.

there is some mechanism in shellio.cxx to track inserted flys;
i forgot if that is used during Paste or not...

unfortunately i'm short on time to investigate how this should work,
so i'll just revert the commit for now, shouldn't crash any more at least.

fixed on master
Comment 10 Commit Notification 2017-07-19 15:37:35 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=14d2255cbd254dea6e87a04f747e7d6d3d54ceb9

tdf#107975: Revert "fix deleting an image anchored to last paragraph

It will be available in 6.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 11 Xisco Faulí 2017-07-19 15:57:00 UTC
Hi Michael,
Thanks for fixing this.
Do you know, by any change, the steps to reproduce the problem 2903d85d6197829633d7f96c95cd55821c2c20ff was meant to fix? I'd like to create a follow-up issue since the commit has been reverted
Comment 12 Michael Stahl 2017-07-19 16:06:37 UTC
(In reply to Xisco Faulí from comment #11)
> Do you know, by any change, the steps to reproduce the problem
> 2903d85d6197829633d7f96c95cd55821c2c20ff was meant to fix? I'd like to
> create a follow-up issue since the commit has been reverted

i am not sure about this.

one problem is that if the deletion
ends in the middle of a paragraph, then flys anchored AT char
in the selection don't get deleted but are just anchored at the
start of the paragraph.

actually there is the symmetric problem at the start of the
selection, for which the commit didn't help at all.

another is if you anchor a fly AT char at the very end of the document,
i don't think there is a way to delete it by deleting text,
you have to delete it by doing a fly selection and then deleting that.
Comment 13 Commit Notification 2017-07-20 09:46:57 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-5-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=1450f9f56c2053a1584f2f1a9e40c54971b57edd&h=libreoffice-5-3

tdf#107975: Revert "fix deleting an image anchored to last paragraph

It will be available in 5.3.6.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 14 Commit Notification 2017-07-20 20:01:59 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-5-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=2327554df607b8f74d8cb91d81659bcc125a99dc&h=libreoffice-5-4

tdf#107975: Revert "fix deleting an image anchored to last paragraph

It will be available in 5.4.1.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 15 Commit Notification 2017-07-30 20:18:14 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-5-3-5":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=c3b0e4e456d10d3f73900049afda1a9e181ead7f&h=libreoffice-5-3-5

tdf#107975: Revert "fix deleting an image anchored to last paragraph

It will be available in 5.3.5.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.