Bug Hunting Session
Bug 117215 - CRASH after undoing a paste operation
Summary: CRASH after undoing a paste operation
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
Inherited From OOo
Hardware: All All
: high major
Assignee: Michael Stahl (CIB)
URL:
Whiteboard: target:6.4.0 target:6.3.1 target:6.2.6
Keywords: bibisected, bisected, haveBacktrace
: 117149 117154 125467 126081 (view as bug list)
Depends on:
Blocks: Undo-Redo
  Show dependency treegraph
 
Reported: 2018-04-24 23:27 UTC by Xisco Faulí
Modified: 2019-08-14 08:13 UTC (History)
7 users (show)

See Also:
Crash report or crash signature: ["BigPtrArray::Index2Block(unsigned long)", "SwUndoFlyBase::InsFly(sw::UndoRedoContext &,bool)"]


Attachments
sample document (14.04 KB, application/vnd.oasis.opendocument.text)
2018-04-24 23:27 UTC, Xisco Faulí
Details
gdb backtrace (33.05 KB, text/plain)
2018-04-24 23:27 UTC, Xisco Faulí
Details
Example file (856 bytes, application/x-zip-compressed)
2018-07-04 11:19 UTC, Telesto
Details
Another Example file (216.80 KB, application/vnd.oasis.opendocument.text)
2018-11-20 13:08 UTC, Telesto
Details
Example file (9.05 KB, application/vnd.oasis.opendocument.text)
2018-11-28 11:27 UTC, Telesto
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Xisco Faulí 2018-04-24 23:27:19 UTC
Created attachment 141612 [details]
sample document

Steps to reproduce:
1. Open attached document
2. Ctrl + A
3. Ctrl + C
4. Ctrl + Z

Reproduced in

Version: 6.1.0.0.alpha0+
Build ID: e31a5365091d8658ecce374bbc339a9d832e1a15
CPU threads: 4; OS: Linux 4.13; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group

The crash ( as described in the steps ) is reproducible from LibreOffice 3.3 up to https://cgit.freedesktop.org/libreoffice/core/commit/?id=2903d85d6197829633d7f96c95cd55821c2c20ff which was reverted in https://cgit.freedesktop.org/libreoffice/core/commit/?id=14d2255cbd254dea6e87a04f747e7d6d3d54ceb9
Comment 1 Xisco Faulí 2018-04-24 23:27:47 UTC
Created attachment 141613 [details]
gdb backtrace
Comment 2 Xisco Faulí 2018-04-24 23:30:42 UTC
@Michael Stahl, this is the same signature as bug 107975, I thought you might be interested...
Comment 3 Xisco Faulí 2018-04-25 07:31:48 UTC
*** Bug 117149 has been marked as a duplicate of this bug. ***
Comment 4 Telesto 2018-04-25 16:49:50 UTC
No repro with the given steps.. But repro with: 
1. Open attached document
2. Ctrl + A
3. Ctrl + C
4. Ctrl + V
5. Ctrl + Z

Version: 6.1.0.0.alpha0+
Build ID: 2ed7c02478968852d7d39c2c4677f2ecf3441bc7
CPU threads: 4; OS: Windows 6.3; UI render: default; 
TinderBox: Win-x86@42, Branch:master, Time: 2018-04-22_01:00:56
Locale: nl-NL (nl_NL); Calc: CL
Comment 5 Xisco Faulí 2018-04-25 17:12:26 UTC
ouch, yep, I forgot the Ctrl + V ;-)
Comment 6 Telesto 2018-04-26 16:44:26 UTC
A variation. However, different crash signature. I expect it to be related
1. Open attached document
2. Ctrl + A
3. Open a new document
4. CTRL+V & CTRL+V
5. Undo+Z & CTRL+Z  -> Crash

http://crashreport.libreoffice.org/stats/crash_details/a9f4f314-073e-446c-82bd-fd153b028b3d
Comment 7 Telesto 2018-04-27 18:25:15 UTC
*** Bug 117154 has been marked as a duplicate of this bug. ***
Comment 8 Telesto 2018-07-04 11:19:56 UTC
Created attachment 143307 [details]
Example file

Another example
1. Extract the html file and open it in Internet Explorer (won't work in Firefox)
2. Copy the content
3. Paste it into Writer
4. Undo (CTRL+Z) -> Crash

http://crashreport.libreoffice.org/stats/crash_details/450dc9ab-4470-4207-a38b-3d38d4343358
Comment 9 Telesto 2018-09-25 14:18:57 UTC
The importance should be upped in my opinion..
Comment 10 Telesto 2018-11-20 13:08:38 UTC
Created attachment 146825 [details]
Another Example file

1. Open the attached file
2. CTRL+A
3. CTRL+X
4. CTRL+V
5. CTRL+Z
6. CTRL+Z
Comment 11 Xisco Faulí 2018-11-20 16:51:32 UTC
Inherit from OOo, thus it's not critical enough...
Comment 12 Telesto 2018-11-28 11:27:11 UTC
Created attachment 147089 [details]
Example file

Another (very basic) example with a table instead of image (with a specific anchoring)

1. Cursor inside the embedded table 
2. CTRL+A 
3. CTRL+A (full table selected)
3. CTRL+V (below the existing table)
4. CTRL+Z
5. CTRL+Y
6. CTRL+Z
Comment 13 Xavier Van Wijmeersch 2018-11-28 20:48:29 UTC
following steps from comment12 and using the attachment LO is crashing without sending a report

Version: 6.3.0.0.alpha0+
Build ID: 75dd5d2e734ad9e8265b1954c7496d1ba241079e
CPU threads: 8; OS: Linux 4.19; UI render: default; VCL: kde4; 
Locale: nl-BE (en_US.UTF-8); UI-Language: en-US
Calc: threaded
Comment 14 sdc.blanco 2019-03-30 08:34:39 UTC
I see that the status of this bug is not considered critical, but I think I encountered it in "real life" (i.e, when just using LO, as opposed to just trying to reproduce the bug). 

That is, I got a crash (with Version: 6.1.5.2 (x64)) when trying to Undo a paste operation, which has the same signature as mentioned here. 

http://crashreport.libreoffice.org/stats/crash_details/a0b8af69-6e5b-466b-af3e-fb5e83aadab4
Comment 15 Xisco Faulí 2019-04-13 12:42:42 UTC
attachment 135992 [details] from bug 112201 is also affected by the same crash.
Steps:
1. Select all
2. Copy
3. Paste
4. Undo
Comment 16 Xisco Faulí 2019-04-13 13:50:23 UTC
Can be also reproduced with attachment 139217 [details] from bug 115111
Comment 17 Xisco Faulí 2019-04-13 14:10:27 UTC
and attachment 120627 [details] from bug 95900
Comment 18 Xisco Faulí 2019-04-14 18:12:01 UTC Comment hidden (obsolete)
Comment 19 Xisco Faulí 2019-04-14 18:14:34 UTC
http://crashreport.libreoffice.org/stats/signature/SwUndoFlyBase::InsFly(sw::
UndoRedoContext%20&,bool) is another crash signature related to this

Steps to reproduce:
1. Open attachment 134719 [details] from bug 109078
2. Select all
3. Copy
4. Paste
5. Undo
Comment 20 Xisco Faulí 2019-05-24 07:17:08 UTC
*** Bug 125467 has been marked as a duplicate of this bug. ***
Comment 21 Telesto 2019-06-25 12:16:00 UTC
Is there a list of all the crash signature associated with this.. the BT are different nowadays
Comment 22 Xisco Faulí 2019-06-26 08:04:37 UTC
*** Bug 126081 has been marked as a duplicate of this bug. ***
Comment 23 Commit Notification 2019-07-19 08:14:32 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/+/dea72ef111ee8a0b1b178f8cd48757514d5ca831%5E%21

sw: fix use after free on tdf117215-1.odt

It will be available in 6.4.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 24 Commit Notification 2019-07-19 10:49:51 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-6-3":

https://git.libreoffice.org/core/+/1b0aa6b85edb621d1ccfaed5e3b256d640b92ce6%5E%21

sw: fix use after free on tdf117215-1.odt

It will be available in 6.3.1.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 25 Commit Notification 2019-07-19 11:02:41 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-6-2":

https://git.libreoffice.org/core/+/4b9324b93dcbd72c8c8949309d45790dd8f7d5fd%5E%21

sw: fix use after free on tdf117215-1.odt

It will be available in 6.2.6.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 26 Michael Stahl (CIB) 2019-07-22 11:16:13 UTC
so these are all duplicate of bug 117185 except for comment #12 for which i've filed a new bug 126504

... and except for one use-after-free problem on one of these documents, which i've fixed.
Comment 27 Xisco Faulí 2019-07-29 12:26:41 UTC
Verified in

Version: 6.4.0.0.alpha0+
Build ID: 0d36b32755ac662299e6a8165e9fa57311b74a2f
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US
Calc: threaded

@Michael Stahl, thanks for fixing this issue!