Bug 115065 - Crash when dragging table with many rows to a table with less rows
Summary: Crash when dragging table with many rows to a table with less rows
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
5.3 all versions
Hardware: All All
: highest critical
Assignee: Mike Kaganski
URL:
Whiteboard: target:6.1.0 target:6.0.1
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2018-01-17 10:11 UTC by Mike Kaganski
Modified: 2018-06-26 10:33 UTC (History)
4 users (show)

See Also:
Crash report or crash signature: ["SfxItemPool::Remove(SfxPoolItem const &)"]


Attachments
bt with debug symbols (9.16 KB, text/plain)
2018-01-17 12:12 UTC, Julien Nabet
Details
minimized document (9.59 KB, application/vnd.oasis.opendocument.text)
2018-01-18 09:31 UTC, Xisco Faulí
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Mike Kaganski 2018-01-17 10:11:31 UTC
This bug was filed from the crash reporting server and is br-c89f1689-2e5a-4a82-bbca-6f77fff17efe.
=========================================

Steps to reproduce:

1. Create new Writer document.
2. Insert a table with two rows (say, 1 column and 2 rows)
3. Below, insert another table with 1 row (say, 2 columns and 1 row)
4. Select first table (both cells)
5. Drag it to first cell of second table

At this point, the document window "freezes", i.e., its display would not change despite scrolling (the scrollbars do show changes). Cursor over the window is in "wait" state. Hovering over other parts (toolbars) shows them as active.

6. Close the document. Choose "No" confirmation dialog.

At this point, crash occurs.

Version: 6.0.0.2 (x64)
Build ID: 06b618bb6f431d27fd2def25aa19c833e29b61cd
CPU threads: 4; OS: Windows 10.0; UI render: default; 
Locale: ru-RU (ru_RU); Calc:
Comment 1 Julien Nabet 2018-01-17 12:12:26 UTC
Created attachment 139148 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated some days ago, I could reproduce this.
I attached a bt quite different from the crashreport
Comment 2 Xisco Faulí 2018-01-17 23:29:23 UTC Comment hidden (obsolete)
Comment 3 Jim Raykowski 2018-01-18 00:18:03 UTC
Hi All,

This behavior can be reproduced in versions before the patch was merged by applying styles to the tables and then doing the steps which result in crash.

I have reproduced it in the following pre patched versions:
Version: 5.4.4.2, Build ID: 1:5.4.4~rc2-0ubuntu0.16.04.1~lo1 
and
Version: 6.0.0.0.beta2 (x64) mswindows

See bug 115026 for an other regression pointing to this merge.
Comment 4 Xisco Faulí 2018-01-18 09:31:01 UTC
Hi Jim Raykowski,
Thank you very much for your comment.
You're totally right, it can be reproduced with previous versions if two tables with 2 different styles are merged.

This points me to 

author	Jakub Trzebiatowski <ubap.dev@gmail.com>	2016-06-21 00:31:01 +0200
committer	Miklos Vajna <vmiklos@collabora.co.uk>	2016-07-07 09:02:15 +0000
commit	40fba0f4418084d50cc5c388cb0b6e1abe395d61 (patch)
tree	4b1e97aa7755c80d9a8749fb94dc3fe26a2f35fb
parent	046244bcfe1c5c1cd2325fe74b933c05e43cf190 (diff)
GSoC Writer Table Styles Import
This patch is implementing import of table styles (table-template).

Modified shared code: Added "background" to the cell styles export.

To make cell export properties map accessible by both export and import code,
moved from xmloff/source/table/XMLTableExport.cxx to xmloff/txtprmap.hxx.

To avoid export of default valued properties implemented XPropertyState for
SwXTextCellStyle
Comment 5 Xisco Faulí 2018-01-18 09:31:51 UTC
Created attachment 139174 [details]
minimized document

Attaching a minimized document to reproduce the issue
Comment 6 Commit Notification 2018-01-19 05:45:20 UTC
Mike Kaganski committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=13e55cedd2944c41f3f4fe7032cfea1ef9e6015d

tdf#115065: nullptr dereference

It will be available in 6.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 7 Xisco Faulí 2018-01-22 11:52:16 UTC
Verified in

Version: 6.1.0.0.alpha0+
Build ID: de1bb0878fc7d7eb6071ec94d770712648013075
CPU threads: 4; OS: Linux 4.10; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group threaded

Thanks Mike for fixing this!!
Comment 8 Commit Notification 2018-01-30 09:47:30 UTC
Mike Kaganski committed a patch related to this issue.
It has been pushed to "libreoffice-6-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=34064c116f196073259fc0a83c3d92611c263d19&h=libreoffice-6-0

tdf#115065: nullptr dereference

It will be available in 6.0.1.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.