Bug 120754 - Crashes on UNDO
Summary: Crashes on UNDO
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: LibreOffice (show other bugs)
(earliest affected)
5.0 all versions
Hardware: All All
: highest critical
Assignee: Not Assigned
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks: Undo-Redo
  Show dependency treegraph
Reported: 2018-10-21 16:27 UTC by sergio.callegari
Modified: 2018-11-19 15:08 UTC (History)
4 users (show)

See Also:
Crash report or crash signature: ["sdr::contact::ViewObjectContact::getPrimitive2DSequenceSubHierarchy(sdr::contact::DisplayInfo &)"]

test case (15.53 KB, application/vnd.oasis.opendocument.graphics)
2018-11-05 13:43 UTC, sergio.callegari
gdb backtrace (31.42 KB, text/plain)
2018-11-05 14:52 UTC, Xisco Faulí

Note You need to log in before you can comment on or make changes to this bug.
Description sergio.callegari 2018-10-21 16:27:01 UTC
In some cases, LibO crashes after issuing multiple undos.  I have verified that the issue is present both in 6.0.x and 6.1.x.

A repeatable way to trigger the issue consists in using the TeXMaths extension.
I know that LibO should generally not be considered responsible for problems in using extensions, but here the extension is merely employed to repeatably trigger a condition where LibO crashes, which should not happen.

Steps to Reproduce:
1. Install TeXMaths and assure its prerequisites are installed.
2. Open draw or impress and draw an svg equation (e.g. press the texmaths button, type x=2y in the window, check that you are in svg mode and press LaTeX. 
3. See the equation image appear
4. Undo multiple times
5. Try to select something else

Actual Results:
LibO crashes

Expected Results:
LibO should not crash

Reproducible: Always

User Profile Reset: No

Additional Info:
[Information automatically included from LibreOffice]
Locale: en-US
Module: StartModule
[Information guessed from browser]
OS: Linux (All)
OS is 64bit: yes
Comment 1 Xisco Faulí 2018-11-05 13:12:25 UTC
I can't reproduce it in

Build ID: b0da1ca2d7a426ff13f39b21362fbcd5c0580c24
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: threaded

nor in

ID de la construcció: 1:6.1.3~rc2-0ubuntu0.16.04.1
Fils de CPU: 4; SO: Linux 4.15; Renderitzador de la IU: per defecte; VCL: gtk3; 
Configuració local: ca-ES (ca_ES.UTF-8); Calc: group threaded

Could you please try to reproduce it with the latest version of LibreOffice
from https://www.libreoffice.org/download/libreoffice-fresh/ ?
I have set the bug's status to 'NEEDINFO'. Please change it back to
'UNCONFIRMED' if the bug is still present in the latest version.
Comment 2 sergio.callegari 2018-11-05 13:43:23 UTC
Created attachment 146312 [details]
test case
Comment 3 sergio.callegari 2018-11-05 13:47:55 UTC
Yep. Looks like my reproducibility case was not that reproducible. Can you please test again with the test case file in attachment?

- open it with LibO 6.1 (or 6.2) with texmaths installed
- click on V_A to select it and press the texmaths button
- in the texmaths window press latex
- see the re-generated svg image for the symbol appear
- undo several times, until the undo stack is completely empty (e.g. CTRL-Z 10 times to be sure)
- click on V_A again to select it
- press Arrow up to move the selection

At this point LibO crashes for me.
Comment 4 Xisco Faulí 2018-11-05 14:25:48 UTC
Reproduced in

Build ID: b0da1ca2d7a426ff13f39b21362fbcd5c0580c24
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: threaded

@Sergio, thanks for the detailed steps to reproduce it...
Comment 5 Xisco Faulí 2018-11-05 14:29:53 UTC
Also reproduced in

Id. de compilación: 65905a128db06ba48db947242809d14d3f9a93fe
Subprocs. CPU: 1; SO: Windows 6.1; Repres. IU: predet.; 
Configuración regional: es-ES (es_ES); Calc: group threaded
Comment 6 sergio.callegari 2018-11-05 14:36:38 UTC
Thank you for retesting so quickly and sorry for being too optimistic with the first set of instructions on how to reproduce.

Looks like something in the 'past history' of the document has to do with the issue.
Comment 7 Xisco Faulí 2018-11-05 14:43:30 UTC
Regression introduced by:

author	David Tardon <dtardon@redhat.com>	2015-01-28 09:18:51 +0100
committer	David Tardon <dtardon@redhat.com>	2015-01-29 22:25:11 +0100
commit	c0117fcb3dbd6c2a8d5e7679ee8d6fb29264ff6b (patch)
tree	4fc95a01464284df7003b82112a841dd6fe427a7
parent	2f3a9a51bfd042e20fe995b3f7437033d85a8907 (diff)
tdf#78854 do not crash when undoing layout change

Bisected with: bibisect-50max 

Adding Cc: to David Tardon

@Caolán, I thought you could be interested in this issue as well...
Comment 8 Xisco Faulí 2018-11-05 14:52:36 UTC
Created attachment 146314 [details]
gdb backtrace
Comment 9 Caolán McNamara 2018-11-19 15:08:01 UTC
I presume something is called that bypasses the undo stack so its out of sync with reality