Bug 115079 - Crash when I open a specific .ODT file with table
Summary: Crash when I open a specific .ODT file with table
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
5.3.7.2 release
Hardware: All All
: highest critical
Assignee: Julien Nabet
URL:
Whiteboard: target:6.1.0 target:6.0.1 target:5.4....
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2018-01-18 00:16 UTC by Kimiyoshi Ohno
Modified: 2018-01-24 16:41 UTC (History)
4 users (show)

See Also:
Crash report or crash signature: ["SwFlowFrame::IsAnFollow(SwFlowFrame const *)"]


Attachments
File to crash. (22.18 KB, application/vnd.oasis.opendocument.text)
2018-01-18 00:18 UTC, Kimiyoshi Ohno
Details
bt with debug symbols (11.59 KB, text/plain)
2018-01-18 07:15 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Kimiyoshi Ohno 2018-01-18 00:16:00 UTC
Description:
It crashes when I open a specific odt file.

It is reproduced by the following operating system.
 - Windows 10
 - Linux (Ubuntu, Fedora)

I have a sample file to crash.
I will attach it later.

Steps to Reproduce:
1. Open a specific odt file.

Actual Results:  
Crashed.

Expected Results:
Nothing.


Reproducible: Always


User Profile Reset: No



Additional Info:


User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0
Comment 1 Kimiyoshi Ohno 2018-01-18 00:18:33 UTC
Created attachment 139168 [details]
File to crash.
Comment 2 tommy27 2018-01-18 07:03:19 UTC
tested under Win7 x64

It crashes with LibO 5.3.7.2 and 6.0.0.0.beta1+ (*) as well

status -> NEW

(*) Build ID: 29228e83df009cf76ac819ed024527be1092f065
CPU threads: 8; OS: Windows 6.1; UI render: GL; 
TinderBox: Win-x86@42, Branch:libreoffice-6-0, Time: 2017-12-04_23:15:34
Locale: it-IT (it_IT); Calc: group threaded
Comment 3 Julien Nabet 2018-01-18 07:15:31 UTC
Created attachment 139171 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated some days ago, I could reproduce this.
Comment 4 Julien Nabet 2018-01-18 07:37:58 UTC
I submitted a patch to review here:
https://gerrit.libreoffice.org/#/c/48089/
Comment 5 Xisco Faulí 2018-01-18 09:46:13 UTC
Julien, just in case it helps...

Regression introduced by:

author	Mike Kaganski <mike.kaganski@collabora.com>	2016-12-08 23:01:03 +0300
committer	Miklos Vajna <vmiklos@collabora.co.uk>	2016-12-12 08:23:30 +0000
commit 6f5024de2e1a5cc533527e45b33d9a415467c48d (patch)
tree de8f7248a9f0361e23dcbb1eacb72f67071d51a9
parent 7740e945e0c74d057c424cced079adc766cc5604 (diff)
tdf#104425 sw: split rows w/large min height (fix layout loop)

Bisected with: bibisect-linux-64-5.4

Adding Cc: to Mike Kaganski
Comment 6 Julien Nabet 2018-01-18 09:50:30 UTC
Thank you Xisco!
The patch I submitted concerns the function lcl_calcHeightOfRowBeforeThisFrame which has been added in your quoted commit.
Comment 7 Julien Nabet 2018-01-18 12:43:14 UTC
Sorry the proposed patch was wrong.
Comment 8 Mike Kaganski 2018-01-19 22:31:50 UTC
Julien's patch is correct; it will be pushed shortly.
Comment 9 Commit Notification 2018-01-20 06:37:22 UTC
Julien Nabet committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=daf1b10f4e266818b6e14f0f1dfddd66f0a3a2f0

tdf#115079: check that row frame belongs to table frame to avoid segfault

It will be available in 6.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 10 Commit Notification 2018-01-20 13:26:38 UTC
Julien Nabet committed a patch related to this issue.
It has been pushed to "libreoffice-6-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=4bfa6ad5ca95bdcee12f8cd0544b5f08558050c5&h=libreoffice-6-0

tdf#115079: check that row frame belongs to table frame to avoid segfault

It will be available in 6.0.1.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 11 Commit Notification 2018-01-20 13:26:48 UTC
Julien Nabet committed a patch related to this issue.
It has been pushed to "libreoffice-5-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=66ad52d05a11b87f921e782ffb6a9b49528fc194&h=libreoffice-5-4

tdf#115079: check that row frame belongs to table frame to avoid segfault

It will be available in 5.4.5.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 12 Julien Nabet 2018-01-21 13:01:03 UTC
Thank you Mike for your help on this one!
Comment 13 Commit Notification 2018-01-24 16:41:05 UTC
Julien Nabet committed a patch related to this issue.
It has been pushed to "libreoffice-6-0-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=e5f952e6bc6b0d0944cb9125b5aa243de5c742d7&h=libreoffice-6-0-0

tdf#115079: check that row frame belongs to table frame to avoid segfault

It will be available in 6.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.