Bug 116293 - CRASH when adding paragraph's in a cell of a complex table structure
Summary: CRASH when adding paragraph's in a cell of a complex table structure
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
(earliest affected)
Hardware: All All
: highest critical
Assignee: Michael Stahl (CIB)
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks: Writer-Tables tdf#114306-regressions
  Show dependency treegraph
Reported: 2018-03-08 15:12 UTC by Telesto
Modified: 2019-05-09 11:21 UTC (History)
6 users (show)

See Also:
Crash report or crash signature:

Example file (17.24 KB, application/vnd.oasis.opendocument.text)
2018-03-08 15:12 UTC, Telesto
BT (3.54 KB, text/plain)
2018-03-08 15:14 UTC, Telesto
stack trace of the deletion of the SwRowFrame (6.04 KB, text/plain)
2018-04-12 12:50 UTC, Michael Stahl (CIB)
layout at the time of RemoveFollowFlowLine entry (409.36 KB, application/xml)
2018-04-12 12:53 UTC, Michael Stahl (CIB)
gdb bt (18.10 KB, text/plain)
2018-07-31 17:09 UTC, Julien Nabet

Note You need to log in before you can comment on or make changes to this bug.
Description Telesto 2018-03-08 15:12:33 UTC
CRASH when adding paragraph's in a cell of a complex table structure. Spinn-off of bug 115903

Steps to Reproduce:
1. Open the attached file
2. Delete both the the embedded tables with the red text
3. Place the mouse cursor some at "Press Enter here"
4. Hold enter for a while -> a page or so -> Crash

Actual Results:  

Expected Results:
No crash

Reproducible: Always

User Profile Reset: No

Additional Info:
Repro with
Build ID: d6b33e49a5e9c51827eda9c5ba16d8daeb27e8af
CPU threads: 4; OS: Windows 6.3; UI render: GL; 
TinderBox: Win-x86@42, Branch:master, Time: 2018-03-07_23:26:53
Locale: nl-NL (nl_NL); Calc: CL

User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Comment 1 Telesto 2018-03-08 15:12:50 UTC
Created attachment 140476 [details]
Example file
Comment 2 Telesto 2018-03-08 15:14:16 UTC
Created attachment 140477 [details]
Comment 3 Xisco Faulí 2018-03-08 15:59:21 UTC
I can reproduce it in

Build ID: 16605d0cdc2c15ab4ae175531ba52824bf52bc70
CPU threads: 4; OS: Linux 4.13; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group

no need to do step 2 in order to reproduce it
Comment 4 Buovjaga 2018-03-08 16:03:55 UTC
Repro. Thanks for picking this up.

Arch Linux 64-bit
Build ID: b8fe96f1da2c42c04a8094ca8c57d49763b7bded
CPU threads: 8; OS: Linux 4.15; UI render: default; VCL: kde4; 
Locale: fi-FI (fi_FI.UTF-8); Calc: group
Built on March 8th 2018
Comment 5 Xisco Faulí 2018-03-08 16:21:27 UTC
Regression introduced by:

author	Manfred Blume <manfred.blume@cib.de>	2017-12-08 15:01:51 +0100
committer	Thorsten Behrens <Thorsten.Behrens@CIB.de>	2017-12-22 00:20:40 +0100
commit	18765b9fa739337d2d891513f6e2fb7c3ce23b50 (patch)
tree	61acc1c9001d529d0df88affe48310187784cc99
parent	baaf6c12c8e9f785dc91e5d3db8b2f5072d4e3f5 (diff)
tdf#114306 fix unexpected page break in row-spanned table

Bisected with: bibisect-linux64-6.1

Adding Cc: to Manfred Blume
Comment 6 Julien Nabet 2018-03-08 19:24:40 UTC
On pc Debian x86-64 with master sources updated today, I can't reproduce this because it's too slow and I hadn't the patience to wait since there's already a bt + a commit pinpointed.

I noticed these logs:
warn:sw.a11y:29702:29702:sw/source/core/access/acctable.cxx:1315: table has invalid position
warn:legacy.osl:29702:29702:sw/source/core/layout/tabfrm.cxx:2619: debug assertion: <SwTabFrame::MakeAll()> - format of table lowers suppressed by fix i44910
warn:legacy.osl:29702:29702:svx/source/dialog/rulritem.cxx:477: Wrong MemberId!
warn:sw.layout:29702:29702:sw/source/core/layout/tabfrm.cxx:1577: LoopControl_2 in lcl_RecalcRow: Stage 1!
Comment 7 Michael Stahl (CIB) 2018-04-12 12:50:55 UTC
Created attachment 141308 [details]
stack trace of the deletion of the SwRowFrame

the problem in one stack trace
Comment 8 Michael Stahl (CIB) 2018-04-12 12:53:05 UTC
Created attachment 141309 [details]
layout at the time of RemoveFollowFlowLine entry
Comment 9 Timur 2018-04-12 14:56:48 UTC
I don't reproduce. Maybe there are some details how to delete tables or where to put mouse.
Comment 10 Xisco Faulí 2018-06-12 09:20:57 UTC
Still reproducible in

Build ID: 3bd8759f5ed0393b2cc5560cab1b5d4052bd9728
CPU threads: 4; OS: Linux 4.13; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group threaded
Comment 11 Xisco Faulí 2018-07-24 16:45:09 UTC
Also reproducible with attachment 99850 [details] from bug 79253

Steps to reproduce:
1. open attached document 
2. goto 3.1 / Nr. 2. "Lara und Viola kommen ins Cafe"
3. place crsr at end of line, press "," and <enter>
4. crash
Comment 12 Julien Nabet 2018-07-31 17:09:55 UTC
Created attachment 143856 [details]
gdb bt

On pc Debian x86-64 with master sources updated today, I could reproduce the crash, following Xisco's comment 11.
Comment 13 Julien Nabet 2018-07-31 17:10:26 UTC
argh, it's just an assert but it's perhaps related to the crash.
Comment 14 yuchun 2018-11-29 08:38:36 UTC
Still exists in version.
When I try the steps for the first time, it will crash.
But it can run correctly after recovering.

Version: (x64)
Build ID: 0f25a3c36f27fd51453b9a9115f236b83c143684
CPU threads: 4; OS: Windows 10.0; UI render: GL; VCL: win; 
TinderBox: Win-x86_64@42, Branch:master, Time: 2018-11-27_20:06:55
Locale: zh-TW (zh_TW); UI-Language: en-US
Calc: threaded
Comment 15 Michael Stahl (CIB) 2019-02-08 09:36:52 UTC
first crash was fixed by this, in particular the SwFrameDeleteGuard in  SwFrame::PrepareMake was something i was considering to add back in the day:

commit 0005b330eaed0b5559042d2597fb45e0c9125d7e
Author:     Caolán McNamara <caolanm@redhat.com>
AuthorDate: Wed Dec 5 13:22:44 2018 +0000
Commit:     Caolán McNamara <caolanm@redhat.com>
CommitDate: Mon Dec 10 14:18:48 2018 +0100

    forcepoint#76 avoid deleting footnote that would delete undeletable page

second crash still reproduces on master; the change due to the commit in comment #5 is that now some frames move both backward and forward, so there is some sort of oscillation and we get these new warnings:

warn:sw.layout:14540:14540:sw/source/core/layout/tabfrm.cxx:1660: LoopControl_1 in lcl_RecalcRow: Stage 1!
warn:sw.layout:14540:14540:sw/source/core/layout/tabfrm.cxx:1589: LoopControl_2 in lcl_RecalcRow: Stage 1!
Comment 16 Michael Stahl (CIB) 2019-02-27 16:44:46 UTC
wrt. comment #11:
this happens due to bIsFollow change in SwFlowFrame::MoveBwd() in the commit

but this document doesn't work particularly well in 5.4:
* if i insert not 1 but 6 paragraphs in that position => infinite loop
* delete any of the nested tables, layout becomes a smoking ruin
Comment 17 Michael Stahl (CIB) 2019-05-09 08:53:34 UTC
the second crash, from comment #11, is fixed by the fix for bug 124675

as mentioned in previous comment, there are many pre-existing problems with this document that should be tracked in different bugs, not this regression bug.

=> regression should be fixed now
Comment 18 Michael Stahl (CIB) 2019-05-09 08:57:57 UTC
i am a complete failure at using bugzilla today, sorry for the noise...
Comment 19 Xisco Faulí 2019-05-09 11:21:03 UTC
Crash verified in

Build ID: 82d018b402219b5452bb08aac2c060031bbc3298
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US
Calc: threaded