Bug 119241 - Crash in: CompareSwOutlineNodes::operator()(SwNode * const &,SwNode * const &)
Summary: Crash in: CompareSwOutlineNodes::operator()(SwNode * const &,SwNode * const &)
Status: RESOLVED DUPLICATE of bug 121546
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
Inherited From OOo
Hardware: All All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords:
: 132164 134780 137050 (view as bug list)
Depends on:
Blocks: Crash-Assert
  Show dependency treegraph
 
Reported: 2018-08-13 08:59 UTC by Telesto
Modified: 2021-11-15 20:58 UTC (History)
6 users (show)

See Also:
Crash report or crash signature: ["CompareSwOutlineNodes::operator()(SwNode * const &,SwNode * const &)"]
Regression By:


Attachments
bt with debug symbols (13.83 KB, text/plain)
2018-08-13 20:17 UTC, Julien Nabet
Details
bt with debug symbols (14.91 KB, text/plain)
2020-04-12 07:54 UTC, Julien Nabet
Details
Valgrind trace (39.20 KB, application/x-bzip)
2020-04-12 09:12 UTC, Julien Nabet
Details
Valgrind trace (199.97 KB, application/x-bzip)
2020-04-12 12:04 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Telesto 2018-08-13 08:59:27 UTC
This bug was filed from the crash reporting server and is br-e376e7a6-f9e8-4cfd-9616-c9a7766c7b80.
=========================================

1. Open attachment 144106 [details]
2. CTRL+A & CTRL+C
3. CTRL+N (New document)
4. CTRL+V
5. Delete the image on the last page (Éric (Perrineau) (in the new document)
6. CTRL+X
7. CTRL+Z 3 times (back to initial blank document)
8. CTRL+V
9. CTRL+A
10. CTRL+X
Comment 1 Telesto 2018-08-13 09:10:52 UTC Comment hidden (obsolete)
Comment 2 Xisco Faulí 2018-08-13 18:24:15 UTC
Reproduced with

1. Open attachment 144106 [details]
2. CTRL+A & CTRL+C
3. CTRL+N (New document)
4. CTRL+V
5. CTRL+A
6. CTRL+X
7. CTRL+Z (twice)
8. CTRL+V
9. CTRL+A
10. CTRL+X

CRASH!!

Version: 6.2.0.0.alpha0+
Build ID: 53eda574a61396b6765cd1cb0ac9804c754ac4c1
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: threaded
Comment 3 Xisco Faulí 2018-08-13 18:45:49 UTC
The issue started in GTK3 after https://cgit.freedesktop.org/libreoffice/core/commit/?id=962e0bb4b31265b046fe4fb57d3087e20f5fe4ef
Comment 4 Xisco Faulí 2018-08-13 19:05:58 UTC
(In reply to Xisco Faulí from comment #3)
> The issue started in GTK3 after
> https://cgit.freedesktop.org/libreoffice/core/commit/
> ?id=962e0bb4b31265b046fe4fb57d3087e20f5fe4ef

@Caolán, any idea why it's crashing?
Comment 5 Xisco Faulí 2018-08-13 19:19:01 UTC
I can reproduce it back to 

Version: 4.2.0.0.alpha1+
Build ID: fc8f44e82de4ebdd50ac5fbb9207cd1a59a927e3

but not in

Version: 4.1.0.0.alpha1+
Build ID: a2c9d4f8bbde97f175bae4df771273a61251f40

it needs to be bisected with bibisect-42max repo
Comment 6 Julien Nabet 2018-08-13 20:17:17 UTC
Created attachment 144156 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today, I don't reproduce this but had an assert at step 8 of Xisco's step by step process.
Comment 7 raal 2018-12-29 19:08:59 UTC
(In reply to Xisco Faulí from comment #2)
> Reproduced with
> 
> 1. Open attachment 144106 [details]
> 2. CTRL+A & CTRL+C
> 3. CTRL+N (New document)
> 4. CTRL+V
> 5. CTRL+A
> 6. CTRL+X
> 7. CTRL+Z (twice)
> 8. CTRL+V
> 9. CTRL+A
> 10. CTRL+X
> 
> CRASH!!

This seems to have begun at the below commit.
Adding Cc: to Michael Stahl ; Could you possibly take a look at this one?
Thanks 8a8b50772859fd6198e8e139ca853a4b7aca9133 is the first bad commit
commit 8a8b50772859fd6198e8e139ca853a4b7aca9133
Author: Matthew Francis <mjay.francis@gmail.com>
Date:   Sat Sep 5 22:42:31 2015 +0800

    source-hash-b8002169336b6b7597d32755e41fa3dc2688539e
    
    commit b8002169336b6b7597d32755e41fa3dc2688539e
    Author:     Michael Stahl <mstahl@redhat.com>
    AuthorDate: Wed Nov 6 16:36:04 2013 +0100
    Commit:     Michael Stahl <mstahl@redhat.com>
    CommitDate: Thu Nov 7 14:27:50 2013 -0600
    
        remove INPATH and PROEXT
    
        - WORKDIR path is just workdir
        - INSTDIR path is just instdir
        - WORKDIR_FOR_BUILD is workdir_for_build
        - INSTDIR_FOR_BUILD is instdir_for_build
        - replace other usage of INPATH by combination of OS and CPUNAME
    
        Change-Id: Ie398387ebd82a968ec2605f2103c55b43a231482
        Reviewed-on: https://gerrit.libreoffice.org/6601
        Reviewed-by: Tor Lillqvist <tml@collabora.com>
        Tested-by: Tor Lillqvist <tml@collabora.com>
        Reviewed-by: Michael Stahl <mstahl@redhat.com>
Comment 8 Michael Stahl (allotropia) 2019-01-07 11:12:00 UTC
the bisect result is wrong, that repo was IIRC incrementally built so the guilty commit is older than the found one.

(might be worth looking at other bugs that have the same bisect result to see if there is a "likely" commit that looks suspicious? do we have another bibisect repo for that release?)
Comment 9 Xisco Faulí 2019-07-12 17:13:03 UTC
(In reply to Michael Stahl (CIB) from comment #8)
> the bisect result is wrong, that repo was IIRC incrementally built so the
> guilty commit is older than the found one.
> 
> (might be worth looking at other bugs that have the same bisect result to
> see if there is a "likely" commit that looks suspicious? do we have another
> bibisect repo for that release?)

Removing 'bisected' keyword
Comment 10 Xisco Faulí 2019-08-14 08:18:29 UTC
Still reproducible in

Version: 6.4.0.0.alpha0+
Build ID: 2812610f4f39ed5892da08864893c758325d1d39
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US
Calc: threaded
Comment 11 Telesto 2020-04-08 12:56:53 UTC
Still crashing, however the initial exact steps don't work anymore. 

It's still in the area of cut, paste/ undo/redo. However I get a bit restless to figure out the very precise steps. Crash signature maybe slightly different too

swlo!SwNodes::UpdateOutlineIdx


Version: 7.0.0.0.alpha0+ (x64)
Build ID: 4501a0ba623ad61c5a4e0b807da2e96f0e4ce82c
CPU threads: 4; OS: Windows 6.3 Build 9600; UI render: Skia/Raster; VCL: win; 
Locale: nl-NL (nl_NL); UI-Language: en-US
Calc: CL
Comment 12 Julien Nabet 2020-04-12 07:54:41 UTC
Created attachment 159507 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today, I still got an assertion at the same step 8 from Xisco's reproduction process.
Comment 13 Julien Nabet 2020-04-12 09:12:19 UTC
Created attachment 159508 [details]
Valgrind trace
Comment 14 Julien Nabet 2020-04-12 12:04:07 UTC
Created attachment 159511 [details]
Valgrind trace

The previous Valgrind trace was with a build containing enable-dbgutil + gtk3 rendering.

This time, I got the crash at the end of Xisco's process but I used another build with enable-symbols (not enable-dbgutil) + gen rendering.
Comment 15 Xisco Faulí 2020-04-17 10:34:59 UTC
*** Bug 132164 has been marked as a duplicate of this bug. ***
Comment 16 Telesto 2020-04-19 15:05:08 UTC
Can the priority by increased a little. 
Assert + Crash 1,5 years old.. And I end up here every time I fiddle around with a random document pressing +/- CTRL+Z 3 times (see bug 132164). Or use attachment 139976 [details] Do a CTRL+V CTRL+Z dance an go down
Comment 17 Xisco Faulí 2020-04-23 13:50:23 UTC
(In reply to Telesto from comment #16)
> Can the priority by increased a little. 
> Assert + Crash 1,5 years old.. And I end up here every time I fiddle around
> with a random document pressing +/- CTRL+Z 3 times (see bug 132164). Or use
> attachment 139976 [details] Do a CTRL+V CTRL+Z dance an go down

When you say a random document, you mean with any document you try ? we have 516 crashes in https://crashreport.libreoffice.org/stats/signature/CompareSwOutlineNodes::operator()(SwNode%20*%20const%20&,SwNode%20*%20const%20&) which is not that much considering it's been around for years now. seems more like a corner case to me
Comment 18 Telesto 2020-04-23 16:25:48 UTC
(In reply to Xisco Faulí from comment #17)
> (In reply to Telesto from comment #16)
> > Can the priority by increased a little. 
> > Assert + Crash 1,5 years old.. And I end up here every time I fiddle around
> > with a random document pressing +/- CTRL+Z 3 times (see bug 132164). Or use
> > attachment 139976 [details] Do a CTRL+V CTRL+Z dance an go down
> 
> When you say a random document, you mean with any document you try ? 

It's rather 'easy' to reproduce in the sense of finding crashing document. OTOH, the steps needed are quite unlikely to happen in real life. So, technically a corner case.. 

The annoying parts is that, when I 'testing' the stability.. without exactly monitoring my steps, I get a crash caused by this bug. And attaching WinDBG showing another crash cause.. 

However, bug 116640 is referring to the same commit.. with 5000 crashes in the past. https://crashreport.libreoffice.org/stats/signature/SwNode::FindTableNode() -> Can that one be bumped in priority?
Comment 19 Telesto 2020-07-26 21:44:32 UTC
*** Bug 134626 has been marked as a duplicate of this bug. ***
Comment 20 Telesto 2020-07-26 21:45:20 UTC
*** Bug 134780 has been marked as a duplicate of this bug. ***
Comment 21 Telesto 2020-11-11 21:34:34 UTC
*** Bug 137050 has been marked as a duplicate of this bug. ***
Comment 22 Telesto 2020-11-11 21:39:02 UTC
Opting for Inherited based on bug 134626 comment 10
Comment 23 Xisco Faulí 2020-12-03 09:16:00 UTC
Steps from comment 2 still reproducible in

Version: 7.2.0.0.alpha0+
Build ID: 480d00625534c356dabd96c503d992f07c99d152
CPU threads: 4; OS: Linux 5.7; UI render: default; VCL: gtk3
Locale: en-US (en_US.UTF-8); UI: en-US
Calc: threaded
Comment 24 Caolán McNamara 2021-11-15 20:58:01 UTC
The fix for bug #121546 fixes this (as per the comment #2 reproducer route), I can't speak for all the duplicates.

*** This bug has been marked as a duplicate of bug 121546 ***