Bug Hunting Session
Bug 120754 - Crashes on UNDO
Summary: Crashes on UNDO
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: LibreOffice (show other bugs)
Version:
(earliest affected)
5.0 all versions
Hardware: All All
: highest critical
Assignee: Caolán McNamara
URL:
Whiteboard: target:6.3.0 target:6.2.4 target:6.1.6
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks: Undo-Redo
  Show dependency treegraph
 
Reported: 2018-10-21 16:27 UTC by sergio.callegari
Modified: 2019-04-10 09:51 UTC (History)
4 users (show)

See Also:
Crash report or crash signature: ["sdr::contact::ViewObjectContact::getPrimitive2DSequenceSubHierarchy(sdr::contact::DisplayInfo &)"]


Attachments
test case (15.53 KB, application/vnd.oasis.opendocument.graphics)
2018-11-05 13:43 UTC, sergio.callegari
Details
gdb backtrace (31.42 KB, text/plain)
2018-11-05 14:52 UTC, Xisco Faulí
Details

Note You need to log in before you can comment on or make changes to this bug.
Description sergio.callegari 2018-10-21 16:27:01 UTC
Description:
In some cases, LibO crashes after issuing multiple undos.  I have verified that the issue is present both in 6.0.x and 6.1.x.

A repeatable way to trigger the issue consists in using the TeXMaths extension.
I know that LibO should generally not be considered responsible for problems in using extensions, but here the extension is merely employed to repeatably trigger a condition where LibO crashes, which should not happen.

Steps to Reproduce:
1. Install TeXMaths and assure its prerequisites are installed.
2. Open draw or impress and draw an svg equation (e.g. press the texmaths button, type x=2y in the window, check that you are in svg mode and press LaTeX. 
3. See the equation image appear
4. Undo multiple times
5. Try to select something else

Actual Results:
LibO crashes

Expected Results:
LibO should not crash


Reproducible: Always


User Profile Reset: No



Additional Info:
[Information automatically included from LibreOffice]
Locale: en-US
Module: StartModule
[Information guessed from browser]
OS: Linux (All)
OS is 64bit: yes
Comment 1 Xisco Faulí 2018-11-05 13:12:25 UTC
I can't reproduce it in

Version: 6.2.0.0.alpha1+
Build ID: b0da1ca2d7a426ff13f39b21362fbcd5c0580c24
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: threaded

nor in

Versió: 6.1.3.2
ID de la construcció: 1:6.1.3~rc2-0ubuntu0.16.04.1
Fils de CPU: 4; SO: Linux 4.15; Renderitzador de la IU: per defecte; VCL: gtk3; 
Configuració local: ca-ES (ca_ES.UTF-8); Calc: group threaded

Could you please try to reproduce it with the latest version of LibreOffice
from https://www.libreoffice.org/download/libreoffice-fresh/ ?
I have set the bug's status to 'NEEDINFO'. Please change it back to
'UNCONFIRMED' if the bug is still present in the latest version.
Comment 2 sergio.callegari 2018-11-05 13:43:23 UTC
Created attachment 146312 [details]
test case
Comment 3 sergio.callegari 2018-11-05 13:47:55 UTC
Yep. Looks like my reproducibility case was not that reproducible. Can you please test again with the test case file in attachment?

- open it with LibO 6.1 (or 6.2) with texmaths installed
- click on V_A to select it and press the texmaths button
- in the texmaths window press latex
- see the re-generated svg image for the symbol appear
- undo several times, until the undo stack is completely empty (e.g. CTRL-Z 10 times to be sure)
- click on V_A again to select it
- press Arrow up to move the selection

At this point LibO crashes for me.
Comment 4 Xisco Faulí 2018-11-05 14:25:48 UTC
Reproduced in

Version: 6.2.0.0.alpha1+
Build ID: b0da1ca2d7a426ff13f39b21362fbcd5c0580c24
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: threaded

@Sergio, thanks for the detailed steps to reproduce it...
Comment 5 Xisco Faulí 2018-11-05 14:29:53 UTC
Also reproduced in

Versión: 6.1.2.1
Id. de compilación: 65905a128db06ba48db947242809d14d3f9a93fe
Subprocs. CPU: 1; SO: Windows 6.1; Repres. IU: predet.; 
Configuración regional: es-ES (es_ES); Calc: group threaded
Comment 6 sergio.callegari 2018-11-05 14:36:38 UTC
Thank you for retesting so quickly and sorry for being too optimistic with the first set of instructions on how to reproduce.

Looks like something in the 'past history' of the document has to do with the issue.
Comment 7 Xisco Faulí 2018-11-05 14:43:30 UTC
Regression introduced by:

author	David Tardon <dtardon@redhat.com>	2015-01-28 09:18:51 +0100
committer	David Tardon <dtardon@redhat.com>	2015-01-29 22:25:11 +0100
commit	c0117fcb3dbd6c2a8d5e7679ee8d6fb29264ff6b (patch)
tree	4fc95a01464284df7003b82112a841dd6fe427a7
parent	2f3a9a51bfd042e20fe995b3f7437033d85a8907 (diff)
tdf#78854 do not crash when undoing layout change

Bisected with: bibisect-50max 

Adding Cc: to David Tardon

@Caolán, I thought you could be interested in this issue as well...
Comment 8 Xisco Faulí 2018-11-05 14:52:36 UTC
Created attachment 146314 [details]
gdb backtrace
Comment 9 Caolán McNamara 2018-11-19 15:08:01 UTC
I presume something is called that bypasses the undo stack so its out of sync with reality
Comment 10 Caolán McNamara 2019-04-04 10:56:34 UTC
yes, I see that SdrObject::SetName will create an UndoObjectStrAttr, but changing the zorder in the macro calls SdrObject::SetOrdNum which does not add anything to the undo stack, and the ordinal changes which puts the undo stack out of whack
Comment 11 Commit Notification 2019-04-04 15:23:03 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/+/b8c49b1d4d4debd86c4b944b0bb2ba020ef1b030%5E%21

Resolves: tdf#120754 on undoing an obj insert use its current ordinal

It will be available in 6.3.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 12 Caolán McNamara 2019-04-04 15:29:39 UTC
looks good in master, backport to 6-2 in gerrit.
Comment 13 Xisco Faulí 2019-04-08 09:49:31 UTC
Verified in

Version: 6.3.0.0.alpha0+
Build ID: 31ac398cfa30694b18240d31df17a58d699b5bf6
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US
Calc: threaded

@Caolán, thanks for fixing this issue!!
Comment 14 Commit Notification 2019-04-08 09:54:11 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-6-2":

https://git.libreoffice.org/core/+/709fc73b2c538f0c15d8c94ffeb5d8234a00a01d%5E%21

Resolves: tdf#120754 on undoing an obj insert use its current ordinal

It will be available in 6.2.4.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 15 Commit Notification 2019-04-10 09:51:49 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-6-1":

https://git.libreoffice.org/core/+/891eb765c393c0f113e87c0949da9bc01f97584d%5E%21

Resolves: tdf#120754 on undoing an obj insert use its current ordinal

It will be available in 6.1.6.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.