Bug 108836 - CRASH: Bad allocation if undo count is set to zero (0) (see comment 4)
Summary: CRASH: Bad allocation if undo count is set to zero (0) (see comment 4)
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
5.0 all versions
Hardware: All All
: medium normal
Assignee: Michael Stahl (CIB)
URL:
Whiteboard: target:6.0.0 target:5.4.0.2
Keywords: haveBacktrace
Depends on:
Blocks: Undo-Zero-Steps
  Show dependency treegraph
 
Reported: 2017-06-28 13:35 UTC by Telesto
Modified: 2017-07-26 16:47 UTC (History)
3 users (show)

See Also:
Crash report or crash signature:


Attachments
Profile 1 (199.29 KB, application/zip)
2017-06-28 13:36 UTC, Telesto
Details
Profile 2 (148.69 KB, application/zip)
2017-06-28 13:36 UTC, Telesto
Details
bt with debug symbols (6.21 KB, text/plain)
2017-06-28 19:19 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Telesto 2017-06-28 13:35:42 UTC
Description:
I don't know the exact steps to create the broken user profile. I only have a broken user profile. It looks like some sort of profile corruption. It broke three times today.

Steps to Reproduce:
1. Download the attached user profile
2. Extract it to settings directory \4\user (daily build)
3. Launch LibreOffice 
4. Open Writer.. Try to type something -> Crash

Steps to create a broken profile (far from exact, but something like this:
1a. Install the language extensions from LibO5.4.0.0b2 or RC1 by copying the extension folder to LibODev6
1b. Set auto-save to 1 minute (Tools -> Options -> Load/SAVE
2. Go top Tools -> Options -> LibreOfficeDev -> Advanced -> Open Expert configuration -> Set Undo steps from '100' to '0'
3. Open Impress -> Cancel template selection -> Hold CTRL+N for a while (30 new documents). Close all of them (CTRL+F4)
4. Open Calc -> Hold CTRL+N for a while (30 new documents). Close all of them (CTRL+F4)
5. Open Draw -> Hold CTRL+N for a while (30 new documents). Close all of them (CTRL+F4)
6. Open a Writer document and type something

Actual Results:  
Crash: Bad allocation

Expected Results:
No crash


Reproducible: Always

User Profile Reset: No

Additional Info:
Version: 6.0.0.0.alpha0+
Build ID: 9f3814af7264ce90685a82cbf4eb015a38f22bf7
CPU threads: 4; OS: Windows 6.19; UI render: default; 
TinderBox: Win-x86@42, Branch:master, Time: 2017-06-28_00:47:42
Locale: nl-NL (nl_NL); Calc: CL


User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Comment 1 Telesto 2017-06-28 13:36:01 UTC
Created attachment 134348 [details]
Profile 1
Comment 2 Telesto 2017-06-28 13:36:17 UTC
Created attachment 134349 [details]
Profile 2
Comment 3 Xisco Faulí 2017-06-28 14:14:56 UTC
I'll set this to WFM and add the keyword corruptProfile, which was just
suggested on the mailing list:
http://lists.freedesktop.org/archives/libreoffice-qa/2015-October/009104.html
Comment 4 Telesto 2017-06-28 16:00:56 UTC
Found the corner case culprit.
1. Open Writer
2. Options - LibO - Advanced - Expert config: org.openoffice.Office.Common/Undo -> Set undo count to 0
3. Type something in Writer (not sure if it's required)
4. Close the Writer document (gray cross -> back to start screen)
5. Open Writer again -> Start typing random stuff with spaces.. Crash will occur pretty soon. If not repeat 4 and 5)

crashreport.libreoffice.org/stats/crash_details/d55cd0ba-e5e9-41bf-9091-f18a6736484e
Comment 5 Xisco Faulí 2017-06-28 16:18:53 UTC
Confirmed in

Version: 6.0.0.0.alpha0+
Build ID: 08f6f9dded1b142b858c455da03319abac691655
CPU Threads: 4; OS Version: Linux 4.8; UI Render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group

and

Version: 5.0.0.0.alpha1+
Build ID: 0db96caf0fcce09b87621c11b584a6d81cc7df86
Locale: ca-ES (ca_ES.UTF-8)
Comment 6 Julien Nabet 2017-06-28 19:19:42 UTC
Created attachment 134365 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today, I got an assert.
Comment 7 Julien Nabet 2017-06-28 19:21:58 UTC
Michael: thought you might be interested in this one.
I got an assert which has been introduced with https://cgit.freedesktop.org/libreoffice/core/commit/?id=e012f326c1c32c053304998a6826cb322f2c7728 (2013).
Now I just wonder if putting 0 at undo should be forbidden since we've got an assert, or if we just should remove this assert.
Comment 8 Telesto 2017-06-28 20:31:29 UTC
I personally would prefer to be able to set it to 0. For three reasons:
- It makes it possible to move larger datasets in Calc (undo is a bit memory hungry)
- It makes it a bit easier spotting real memory leaks
- Writer is the only application crashing
Comment 9 Julien Nabet 2017-06-28 21:05:12 UTC
part of bt after having removed the assert:
(gdb) bt
#0  0x00007fffc9911aa5 in rtl::OUString::operator+=<rtl::OUStringLiteral1_ const>(rtl::OUStringLiteral1_ const&) & (this=0x9999999999999999, literal=...)
    at /home/julien/lo/libreoffice/include/rtl/ustring.hxx:576
#1  0x00007fffc9d3e35f in SwUndoInsert::CanGrouping (this=0x55555ba65d00, cIns=32 u' ') at /home/julien/lo/libreoffice/sw/source/core/undo/unins.cxx:145
#2  0x00007fffc9758e77 in sw::DocumentContentOperationsManager::InsertString (this=0x5555578b9a30, rRg=SwPaM = {...}, rStr=" ", nInsertMode=SwInsertFlags::EMPTYEXPAND)
    at /home/julien/lo/libreoffice/sw/source/core/doc/DocumentContentOperationsManager.cxx:2514
#3  0x00007fffc99058f3 in SwAutoCorrDoc::Insert (this=0x7fffffff1230, nPos=5, rText=" ") at /home/julien/lo/libreoffice/sw/source/core/edit/acorrect.cxx:131
#4  0x00007ffff36afedf in SvxAutoCorrect::DoAutoCorrect (this=0x555557894ae0, rDoc=..., rTxt="azevb ", nInsPos=5, cChar=32 u' ', bInsert=true, pFrameWin=0x5555579ab5f0)
    at /home/julien/lo/libreoffice/editeng/source/misc/svxacorr.cxx:1271
#5  0x00007fffc9959d37 in SwEditShell::AutoCorrect (this=0x5555579d3200, rACorr=..., bInsert=true, cChar=32 u' ')
    at /home/julien/lo/libreoffice/sw/source/core/edit/edws.cxx:255
#6  0x00007fffca528d74 in SwWrtShell::AutoCorrect (this=0x5555579d3200, rACorr=..., cChar=32 u' ') at /home/julien/lo/libreoffice/sw/source/uibase/wrtsh/wrtsh1.cxx:1613
Comment 10 Commit Notification 2017-06-29 13:27:51 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=5c4a9dfdc01606e0a35c5e2809571d0f6f03df39

tdf#108836 sw: don't enable Undo if Steps configured to 0

It will be available in 6.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 11 Michael Stahl (CIB) 2017-06-29 13:28:10 UTC
well undo with 0 steps isn't going to do a whole lot so lets just not enable it
Comment 12 Buovjaga 2017-06-30 12:19:30 UTC
*** Bug 108863 has been marked as a duplicate of this bug. ***
Comment 13 Commit Notification 2017-07-04 10:33:36 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-5-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=55368a0602eb2ab191e969d3b363087dce62994f&h=libreoffice-5-4

tdf#108836 sw: don't enable Undo if Steps configured to 0

It will be available in 5.4.0.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.