Bug Hunting Session
Bug 117185 - Crash when closing the document after a specific undo redo operation (Paste) due to inserted fly anchored at end of last paragraph in body
Summary: Crash when closing the document after a specific undo redo operation (Paste) ...
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
4.1 all versions
Hardware: All All
: high major
Assignee: Michael Stahl (CIB)
URL:
Whiteboard: target:6.4.0 target:6.3.1
Keywords: haveBacktrace
: 117152 124720 124721 (view as bug list)
Depends on:
Blocks: Undo-Redo
  Show dependency treegraph
 
Reported: 2018-04-23 15:58 UTC by Telesto
Modified: 2019-09-04 08:49 UTC (History)
4 users (show)

See Also:
Crash report or crash signature: ["AttrSetHandleHelper::SetParent(std::shared_ptr%3CSfxItemSet%20const%20%3E%20&,SwContentNode%20const%20&,SwFormat%20const%20*,SwFormat%20const%20*)"]


Attachments
GDB trace of crash with master (26.47 KB, text/plain)
2018-04-23 16:14 UTC, Buovjaga
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Telesto 2018-04-23 15:58:22 UTC
Description:
Crash when closing the document after a specific undo redo operation (ucrtbase)

Steps to Reproduce:
1. Open attachment 133424 [details] (bug 117152 & bug 107975)
2. CTRL+A
3. CTRL+C
4. Press Enter ABC (below the image)
4. Paste (CTRL+V)
5. Enter
5. Paste (CTRL+V)
6. Undo three times
7. Redo (CTRL+Y)
8. Close the document (grey cross)

Actual Results:  
Crash

Expected Results:
No crash


Reproducible: Always


User Profile Reset: No



Additional Info:
Version: 6.1.0.0.alpha0+
Build ID: 2ed7c02478968852d7d39c2c4677f2ecf3441bc7
CPU threads: 4; OS: Windows 6.3; UI render: default; 
TinderBox: Win-x86@42, Branch:master, Time: 2018-04-22_01:00:56
Locale: nl-NL (nl_NL); Calc: CL


User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Comment 1 Buovjaga 2018-04-23 16:14:42 UTC
Created attachment 141567 [details]
GDB trace of crash with master

Repro.

Arch Linux 64-bit
Version: 6.1.0.0.alpha0+
Build ID: 14184060bd2249a492ea44d36463914c421e6ce5
CPU threads: 8; OS: Linux 4.16; UI render: default; VCL: kde4; 
Locale: fi-FI (fi_FI.UTF-8); Calc: group
Built on April 23rd 2018
Comment 2 Dieter Praas 2018-04-23 16:16:27 UTC
Also reproducible with

Version: 5.4.6.2 (x64)
Build-ID: 4014ce260a04f1026ba855d3b8d91541c224eab8
CPU-Threads: 4; BS: Windows 6.19; UI-Render: Standard; 
Gebietsschema: en-US (de_DE); Calc: group

crashreport.libreoffice.org/stats/crash_details/c2c0ebe1-dffe-4b7a-8af7-b044539b3685
Comment 3 Xisco Faulí 2018-04-24 22:04:41 UTC
I can also reproduce it 

Version 4.1.0.0.alpha0+ (Build ID: efca6f15609322f62a35619619a6d5fe5c9bd5a)
Comment 5 Xisco Faulí 2018-04-24 22:07:24 UTC
Actually it's the same crash signature than in the backtrace...
Comment 6 Michael Stahl (CIB) 2018-08-30 10:39:35 UTC
*** Bug 117152 has been marked as a duplicate of this bug. ***
Comment 7 Michael Stahl (CIB) 2018-08-30 10:46:46 UTC
the problem is that the last Paste action inserts a fly that is anchored AT_CHAR at the end of the last paragraph in the document, but the SwUndoInserts::UndoImpl does not remove this fly, which causes the indexes that are stored in the Undo actions to point to the wrong nodes due to the added fly-section at the start of the SwNodes.

this situation was previously fixed by:

commit 2903d85d6197829633d7f96c95cd55821c2c20ff

    fix deleting an image anchored to last paragraph in document
    
    It only compared nodes instead of SwPositions, thus refusing to delete
    anything anchored at the last content node. Also, select-all makes
    rEnd point to the last content node, after its content. So if
    an anchor-to-char image is anchored at the end of the paragraph,
    it points to this place, too, so that must be checked.

but unfortunately this commit introduced a different problem (see bug 107975) and re-introduced OOo issue 97570, hence i've reverted it in commit 14d2255cbd254dea6e87a04f747e7d6d3d54ceb9 due to lack of time, see also
https://bugs.documentfoundation.org/show_bug.cgi?id=107975#c9
Comment 8 Xisco Faulí 2018-08-30 10:55:21 UTC
@Michael Stahl, then, is this a dupe of bug 117215 or viceversa ?
Comment 9 Commit Notification 2019-07-22 06:33:23 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/+/28b77c89dfcafae82cf2a6d85731b643ff9290e5%5E%21

tdf#117185 tdf#110442 sw: bring harmony & peace to fly at-char selection

It will be available in 6.4.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 10 Michael Stahl (CIB) 2019-07-22 10:42:45 UTC
fixed on master
Comment 11 Michael Stahl (CIB) 2019-07-22 11:20:32 UTC
*** Bug 124720 has been marked as a duplicate of this bug. ***
Comment 12 Michael Stahl (CIB) 2019-07-22 11:21:34 UTC
*** Bug 124721 has been marked as a duplicate of this bug. ***
Comment 13 Commit Notification 2019-07-22 12:15:19 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-6-3":

https://git.libreoffice.org/core/+/3345feb67f2c49a1b76639965b56968e1c5f03ee%5E%21

tdf#117185 tdf#110442 sw: bring harmony & peace to fly at-char selection

It will be available in 6.3.1.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 14 Xisco Faulí 2019-07-29 15:02:02 UTC
Verified in

Version: 6.4.0.0.alpha0+
Build ID: 0d36b32755ac662299e6a8165e9fa57311b74a2f
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US
Calc: threaded

@Michael Stahl, thanks for fixing this issue!