Bug 108867 - Assertion failed when adding/removing/adding text box to a shape
Summary: Assertion failed when adding/removing/adding text box to a shape
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
6.0.0.0.alpha0+ Master
Hardware: All All
: medium major
Assignee: Michael Stahl
QA Contact:
URL:
Whiteboard: target:6.0.0 target:5.4.1 target:5.3.6
Keywords: haveBacktrace
Depends on:
Blocks: Assert
  Show dependency treegraph
 
Reported: 2017-06-29 18:19 UTC by Gabor Kelemen
Modified: 2017-07-27 20:37 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:


Attachments
bt with debug symbols (5.70 KB, text/plain)
2017-06-30 05:19 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Gabor Kelemen 2017-06-29 18:19:14 UTC
On a debug build choose Insert -> Shape -> any shape.
Right click on the shape and choose Add Text Box.
Right click on it again and choose Remove Text Box.
Right click on the shape again and choose Add Text Box. -> crash with 

soffice.bin: /home/gabor/src/core/sw/source/core/layout/atrfrm.cxx:2532: void SwFrameFormat::SetOtherTextBoxFormat(SwFrameFormat*): Assertion `nullptr == m_pOtherTextBoxFormat' failed.
Comment 1 Julien Nabet 2017-06-30 05:19:01 UTC
Created attachment 134404 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated yesterday (7d2f53b874e586df6631f21fabb87aa5e45c36a3), I could reproduce this.
I attached bt with symbols
Comment 2 Julien Nabet 2017-06-30 08:02:54 UTC
Just wonder if this line
m_rDoc.DelFrameFormat( pFormat );

(see http://opengrok.libreoffice.org/xref/core/sw/source/core/doc/DocumentLayoutManager.cxx#316)

shouldn't be put outside the else block and so executed all the time.

Gabor: I'm not at home to test this, perhaps you could give it a try on local?

First, you might want to add some  temporary trace on http://opengrok.libreoffice.org/xref/core/sw/source/core/doc/DocumentLayoutManager.cxx#243 to confirm we go in "if" block.
Comment 3 Julien Nabet 2017-06-30 20:57:48 UTC
After having added trace, we indeed go in "if" block quoted in my previous comment but putting "m_rDoc.DelFrameFormat( pFormat );" outside else block doesn't fix anything.

I tested this:
diff --git a/sw/source/core/doc/textboxhelper.cxx b/sw/source/core/doc/textboxhelper.cxx
index 9a88ba9dea4e..c782128f1faa 100644
--- a/sw/source/core/doc/textboxhelper.cxx
+++ b/sw/source/core/doc/textboxhelper.cxx
@@ -123,7 +123,10 @@ void SwTextBoxHelper::destroy(SwFrameFormat* pShape)
 
         // Delete the associated TextFrame.
         if (pFormat)
+        {
             pShape->GetDoc()->getIDocumentLayoutAccess().DelLayoutFormat(pFormat);
+            pShape->SetOtherTextBoxFormat(nullptr);
+        }
     }
 }

I don't reproduce the crash but perhaps just hiding it.
Michael: any thoughts?
Comment 4 Commit Notification 2017-07-21 10:10:51 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=2e486daff35ab16e810bfdafb24b19bcbf2fe8cd

tdf#108867 sw: fix dangling text box frame format pointers in Undo

It will be available in 6.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 5 Michael Stahl 2017-07-21 10:38:03 UTC
it looks like the fancy text boxes were missing code to maintain these other-format pointers on Undo

fixed on master
Comment 6 Commit Notification 2017-07-25 18:17:44 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-5-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=40fbde8f75cbda538eccec558cdb8c0c0a659c31&h=libreoffice-5-4

tdf#108867 sw: fix dangling text box frame format pointers in Undo

It will be available in 5.4.1.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 7 Commit Notification 2017-07-27 20:37:06 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-5-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=b39cb50c6afb47f39b21c3fb3ea913b902632924&h=libreoffice-5-3

tdf#108867 sw: fix dangling text box frame format pointers in Undo

It will be available in 5.3.6.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.