Bug 109376 - Crash after accepting all changes from compared documents
Summary: Crash after accepting all changes from compared documents
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
5.0 all versions
Hardware: All All
: highest critical
Assignee: Michael Stahl (CIB)
URL:
Whiteboard: target:6.3.0 target:6.2.4
Keywords: bibisected, bisected, haveBacktrace, regression
: 119822 (view as bug list)
Depends on:
Blocks: Track-Changes
  Show dependency treegraph
 
Reported: 2017-07-26 11:26 UTC by Thomas Lendo
Modified: 2019-05-04 20:13 UTC (History)
5 users (show)

See Also:
Crash report or crash signature: ["SwNode::RemoveAnchoredFly(SwFrameFormat *)"]


Attachments
Chapter 1 test file (474.40 KB, application/vnd.oasis.opendocument.text)
2017-07-26 11:26 UTC, Thomas Lendo
Details
Chapter 2 test file (321.06 KB, application/vnd.oasis.opendocument.text)
2017-07-26 11:26 UTC, Thomas Lendo
Details
gdb backtrace (39.75 KB, text/plain)
2018-11-14 13:12 UTC, Xisco Faulí
Details
screencast (1.29 MB, video/mp4)
2019-04-16 14:14 UTC, Xisco Faulí
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Lendo 2017-07-26 11:26:20 UTC
Created attachment 134867 [details]
Chapter 1 test file

Writer crashes when undoing a document comparison. I'll attach both documents to this bug report as well as the crash report.

Steps to reproduce:
1. Download both chapter documents from this bug report.
2. Open document "chapter 1".
3. Go to Edit > Track Changes > Compare Document...
4. Select and open document "chapter 2".
5. Click on Undo button in the main toolbar or use Ctrl+Z keyboard shortcut.

Actual result:
Writer crashes.

Expected result:
Writer shall undo the comparison activity and shall show the document as is was before that.

Tested with

Version: 5.3.4.2
Build ID: f82d347ccc0be322489bf7da61d7e4ad13fe2ff3
CPU Threads: 8; OS Version: Windows 6.2; UI Render: default; Layout Engine: new; Locale: de-DE (de_DE); Calc: CL

and

Version: 5.1.4.2 (x64)
Build-ID: f99d75f39f1c57ebdd7ffc5f42867c12031db97a
CPU-Threads: 8; BS-Version: Windows 6.19; UI-Render: Standard; Gebietsschema: de-AT (de_DE)
Comment 1 Thomas Lendo 2017-07-26 11:26:36 UTC
Created attachment 134868 [details]
Chapter 2 test file
Comment 2 Thomas Lendo 2017-07-26 11:31:37 UTC
The 2 mostly identical crash reports:

http://crashreport.libreoffice.org/stats/crash_details/f3e36729-d54d-42c8-8251-c20fe93a5799
Crash in: SwNode::RemoveAnchoredFly(SwFrameFormat *)
br-f3e36729-d54d-42c8-8251-c20fe93a5799

http://crashreport.libreoffice.org/stats/crash_details/6a506f9e-d93a-4065-9d77-476298502cf1
Crash in: SwNode::RemoveAnchoredFly(SwFrameFormat *)
br-6a506f9e-d93a-4065-9d77-476298502cf1
Comment 3 Xisco Faulí 2017-07-26 13:25:55 UTC

*** This bug has been marked as a duplicate of bug 98202 ***
Comment 4 Xisco Faulí 2018-11-14 12:47:49 UTC
*** Bug 119822 has been marked as a duplicate of this bug. ***
Comment 5 Xisco Faulí 2018-11-14 12:50:30 UTC
it crashes in

Versión: 6.1.3.2
Id. de compilación: 86daf60bf00efa86ad547e59e09d6bb77c699acb
Subprocs. CPU: 1; SO: Windows 6.1; Repres. IU: predet.; 
Configuración regional: es-ES (es_ES); Calc: group threaded

but not in

Versión: 4.4.0.3
Id. de compilación: de093506bcdc5fafd9023ee680b8c60e3e0645d7
Configuración regional: es_ES

when clicking on 'Accept all'.
moving back to NEW. I believe this issue an bug 98202 have the same root cause. However, I think this one is easier to reproduce
Comment 6 Xisco Faulí 2018-11-14 12:55:50 UTC
I don't believe this is an undo issue but a tracking change issue...
Comment 7 Xisco Faulí 2018-11-14 13:09:39 UTC
Regression introduced by:

https://cgit.freedesktop.org/libreoffice/core/commit/?id=e07feb9457f2ffb373ae69b73dda290140e4005f

author	Michael Stahl <mstahl@redhat.com>	2015-05-08 23:27:49 +0200
committer	Michael Stahl <mstahl@redhat.com>	2015-05-09 11:02:26 +0200
commit	e07feb9457f2ffb373ae69b73dda290140e4005f (patch)
tree	0d0bccf291f44c36d3cb174a02bc1a0000ae3b34
parent	fb73274fcce1edd3d898b7f79700fea96d0040f9 (diff)
sw: fix assert with frames anchored in redlines on rhbz490395-1.odt

Bisected with: bibisect-50max 

Adding Cc: to Michael Stahl
Comment 8 Xisco Faulí 2018-11-14 13:12:32 UTC
Created attachment 146618 [details]
gdb backtrace
Comment 9 Xisco Faulí 2018-11-14 14:03:32 UTC
backtrace from bug 98202 looks the same as this one, howerver bug 98202 can be reproduced from OOo times, not this one...
Comment 10 Michael Stahl (CIB) 2018-11-23 10:43:07 UTC
i'm wondering if it did crash before commit 738fb2ad77e5a1a4d6e2dc540886a17f4527e4db ?

i.e. is it really a regression or was it just differently wrong before e07feb9457f2ffb373ae69b73dda290140e4005f
Comment 11 Xisco Faulí 2018-11-23 11:36:25 UTC
(In reply to Michael Stahl (CIB) from comment #10)
> i'm wondering if it did crash before commit
> 738fb2ad77e5a1a4d6e2dc540886a17f4527e4db ?

I've tried in bibisect-44max with that commit and without it and it doesn't crash in both cases...

> 
> i.e. is it really a regression or was it just differently wrong before
> e07feb9457f2ffb373ae69b73dda290140e4005f

Before e07feb9457f2ffb373ae69b73dda290140e4005f it didn't crash when clicking Accept all changes while it crashes after the commit.
OTOH, even before the commit  it crashed while saving the document after comparing due to bug 98202 which is Inherit from OOo, so it seems to me like two different crashes...
Comment 12 Commit Notification 2019-04-15 10:28:49 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/+/80b73dcc06c671a49fbf238be58c1cd086c5c5f9%5E%21

tdf#109376 sw: fix SwUndoDelete with end pos on SwTableNode crash

It will be available in 6.3.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 13 Michael Stahl (CIB) 2019-04-15 10:29:15 UTC
of course, this never really worked, though it didn't crash before.

fixed on master
Comment 14 Commit Notification 2019-04-15 22:38:12 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-6-2":

https://git.libreoffice.org/core/+/7bba93a99ebb4250f884a68a50aa1912d96f4ba8%5E%21

tdf#109376 sw: fix SwUndoDelete with end pos on SwTableNode crash

It will be available in 6.2.4.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 15 Xisco Faulí 2019-04-16 08:27:26 UTC
The crash is still reproducible in

Version: 6.3.0.0.alpha0+
Build ID: 033e1130a65ec7f0fa9c46e5124adc9d8bf724ba
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US
Calc: threaded

which includes https://git.libreoffice.org/core/+/80b73dcc06c671a49fbf238be58c1cd086c5c5f9%5E%21
Comment 16 Xisco Faulí 2019-04-16 14:14:07 UTC
Created attachment 150797 [details]
screencast
Comment 17 Xisco Faulí 2019-04-16 14:49:21 UTC
Just for the record, the steps described in the description are fixed in

Version: 6.3.0.0.alpha0+
Build ID: 033e1130a65ec7f0fa9c46e5124adc9d8bf724ba
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US
Calc: threaded

but not the one from comment 5
Comment 18 Xisco Faulí 2019-04-16 14:56:51 UTC
both steps from the description and comment 5 point to https://cgit.freedesktop.org/libreoffice/core/commit/?id=e07feb9457f2ffb373ae69b73dda290140e4005f
Comment 19 Commit Notification 2019-04-17 09:29:52 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/+/f83e22f535c1c9482c5d3f566d5d0283355dd98f%5E%21

tdf#109376 sw: fix redline SwUndoDelete with end pos on SwTableNode crash

It will be available in 6.3.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 20 Michael Stahl (CIB) 2019-04-17 09:31:46 UTC
okay that's very similar problem, fixed that too on master
Comment 21 Xisco Faulí 2019-04-17 11:58:34 UTC
Accept all crash verified in

Version: 6.3.0.0.alpha0+
Build ID: 26e85974a0287ab5869e7ff0145a66b853d66a02
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US
Calc: threaded

@Michael Stahl, thanks for fixing this issue!!
Comment 22 Commit Notification 2019-04-20 21:07:49 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-6-2":

https://git.libreoffice.org/core/+/5a80701d307136ebb0240aaa9448b8afe5cda646%5E%21

tdf#109376 sw: fix redline SwUndoDelete with end pos on SwTableNode crash

It will be available in 6.2.4.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 23 Thomas Lendo 2019-05-04 20:13:20 UTC
Michael, thank you very much for your work!