Bug 117185 - Crash when closing the document after a specific undo redo operation (Paste) due to inserted fly anchored at end of last paragraph in body
Summary: Crash when closing the document after a specific undo redo operation (Paste) ...
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
(earliest affected)
4.1 all versions
Hardware: All All
: high major
Assignee: Not Assigned
Keywords: haveBacktrace
: 117152 (view as bug list)
Depends on:
Blocks: Undo-Redo
  Show dependency treegraph
Reported: 2018-04-23 15:58 UTC by Telesto
Modified: 2019-04-14 18:00 UTC (History)
4 users (show)

See Also:
Crash report or crash signature: ["AttrSetHandleHelper::SetParent(std::shared_ptr%3CSfxItemSet%20const%20%3E%20&,SwContentNode%20const%20&,SwFormat%20const%20*,SwFormat%20const%20*)"]

GDB trace of crash with master (26.47 KB, text/plain)
2018-04-23 16:14 UTC, Buovjaga

Note You need to log in before you can comment on or make changes to this bug.
Description Telesto 2018-04-23 15:58:22 UTC
Crash when closing the document after a specific undo redo operation (ucrtbase)

Steps to Reproduce:
1. Open attachment 133424 [details] (bug 117152 & bug 107975)
4. Press Enter ABC (below the image)
4. Paste (CTRL+V)
5. Enter
5. Paste (CTRL+V)
6. Undo three times
7. Redo (CTRL+Y)
8. Close the document (grey cross)

Actual Results:  

Expected Results:
No crash

Reproducible: Always

User Profile Reset: No

Additional Info:
Build ID: 2ed7c02478968852d7d39c2c4677f2ecf3441bc7
CPU threads: 4; OS: Windows 6.3; UI render: default; 
TinderBox: Win-x86@42, Branch:master, Time: 2018-04-22_01:00:56
Locale: nl-NL (nl_NL); Calc: CL

User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Comment 1 Buovjaga 2018-04-23 16:14:42 UTC
Created attachment 141567 [details]
GDB trace of crash with master


Arch Linux 64-bit
Build ID: 14184060bd2249a492ea44d36463914c421e6ce5
CPU threads: 8; OS: Linux 4.16; UI render: default; VCL: kde4; 
Locale: fi-FI (fi_FI.UTF-8); Calc: group
Built on April 23rd 2018
Comment 2 Dieter Praas 2018-04-23 16:16:27 UTC
Also reproducible with

Version: (x64)
Build-ID: 4014ce260a04f1026ba855d3b8d91541c224eab8
CPU-Threads: 4; BS: Windows 6.19; UI-Render: Standard; 
Gebietsschema: en-US (de_DE); Calc: group

Comment 3 Xisco Faulí 2018-04-24 22:04:41 UTC
I can also reproduce it 

Version (Build ID: efca6f15609322f62a35619619a6d5fe5c9bd5a)
Comment 5 Xisco Faulí 2018-04-24 22:07:24 UTC
Actually it's the same crash signature than in the backtrace...
Comment 6 Michael Stahl (CIB) 2018-08-30 10:39:35 UTC
*** Bug 117152 has been marked as a duplicate of this bug. ***
Comment 7 Michael Stahl (CIB) 2018-08-30 10:46:46 UTC
the problem is that the last Paste action inserts a fly that is anchored AT_CHAR at the end of the last paragraph in the document, but the SwUndoInserts::UndoImpl does not remove this fly, which causes the indexes that are stored in the Undo actions to point to the wrong nodes due to the added fly-section at the start of the SwNodes.

this situation was previously fixed by:

commit 2903d85d6197829633d7f96c95cd55821c2c20ff

    fix deleting an image anchored to last paragraph in document
    It only compared nodes instead of SwPositions, thus refusing to delete
    anything anchored at the last content node. Also, select-all makes
    rEnd point to the last content node, after its content. So if
    an anchor-to-char image is anchored at the end of the paragraph,
    it points to this place, too, so that must be checked.

but unfortunately this commit introduced a different problem (see bug 107975) and re-introduced OOo issue 97570, hence i've reverted it in commit 14d2255cbd254dea6e87a04f747e7d6d3d54ceb9 due to lack of time, see also
Comment 8 Xisco Faulí 2018-08-30 10:55:21 UTC
@Michael Stahl, then, is this a dupe of bug 117215 or viceversa ?