Bug 121546 - CRASH undoing table paste
Summary: CRASH undoing table paste
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
5.3 all versions
Hardware: All All
: high major
Assignee: Caolán McNamara
URL:
Whiteboard: target:7.3.0 target:7.2.3
Keywords: bibisected
: 119241 (view as bug list)
Depends on:
Blocks: Writer-Tables Crash
  Show dependency treegraph
 
Reported: 2018-11-20 13:02 UTC by Xisco Faulí
Modified: 2021-11-27 09:27 UTC (History)
4 users (show)

See Also:
Crash report or crash signature: ["CompareSwOutlineNodes::operator()(SwNode * const &,SwNode * const &)"]
Regression By:


Attachments
gdb backtrace (43.01 KB, text/plain)
2018-11-20 13:13 UTC, Xisco Faulí
Details
much smaller document that can reproduce the assert (9.81 KB, application/vnd.oasis.opendocument.text)
2021-11-10 15:33 UTC, Caolán McNamara
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Xisco Faulí 2018-11-20 13:02:14 UTC
This is a follow-up of bug 120115 and probably related to bug 119241

Steps to reproduce:
1. Open attachment 145162 [details] from bug 120115
2. CTRL+A & CTRL+X
3. CTRL+N (New document)
4. CTRL+V
5. CTRL+A & CTRL+X
6. CTRL+V in the same file
7. CTRL+Z x 3
8. CTRL+V
9. CTRL+Z
-> CRASH
Comment 1 Dieter 2018-11-20 13:07:58 UTC
I confirm it with

Version: 6.2.0.0.beta1 (x64)
Build ID: d1b41307be3f8c19fe6f1938cf056e7ff1eb1d18
CPU threads: 4; OS: Windows 10.0; UI render: default; VCL: win; 
Locale: en-US (de_DE); UI-Language: en-GB
Calc: threaded
Comment 2 Xisco Faulí 2018-11-20 13:13:14 UTC
Created attachment 146827 [details]
gdb backtrace

with a debug build, it crashes on step 8
Comment 3 Xisco Faulí 2018-11-20 13:15:06 UTC
(In reply to Xisco Faulí from comment #2)
> Created attachment 146827 [details]
> gdb backtrace
> 
> with a debug build, it crashes on step 8

Which is exactly the same backtrace as in bug 119241. Anyway, let's keep this one open as I find this document easier to work with than the one in bug 119241
Comment 4 Xisco Faulí 2018-11-20 13:22:56 UTC
The crash on step 9 can be reproduced since https://cgit.freedesktop.org/libreoffice/core/commit/?id=e22122e20ca69d0f2b0e8831e9ebf3afd2064329.
Before that, it crashed on step 5 due to https://cgit.freedesktop.org/libreoffice/core/commit/?id=15d8b51bf82610c663f80fe552a1c0315e137ad3. Before this commit it didn't crash.
However, I've reverted both commits locally and it's still crashing so I don't know which commit caused this problem.

@Caolán, since both commits mentioned above are yours, I thought you might be interested in this issue...
Comment 5 RickyTzou 2018-11-29 08:51:49 UTC
The bug fixed in this version

Version: 6.3.0.0.alpha0+ (x64)
Build ID: 0f25a3c36f27fd51453b9a9115f236b83c143684
CPU threads: 8; OS: Windows 10.0; UI render: GL; VCL: win; 
TinderBox: Win-x86_64@42, Branch:master, Time: 2018-11-27_20:06:55
Locale: zh-TW (zh_TW); UI-Language: en-US
Calc: threaded

Thank you!
Comment 6 Xisco Faulí 2018-11-29 09:52:29 UTC
Still reproducible in

Version: 6.2.0.0.beta1+
Build ID: ce7bb69f8205bcbe36cba4c53bd110e07ef3e05d
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US
Calc: threaded

@RickyTzou, are you sure you followed the steps correctly ?
Comment 7 Xavier Van Wijmeersch 2018-12-05 15:00:23 UTC
confirm crash with

Version: 6.3.0.0.alpha0+
Build ID: 834c7c2698443332a347374db10e17d7862d6e4f
CPU threads: 8; OS: Linux 4.19; UI render: default; VCL: kde4; 
Locale: nl-BE (en_US.UTF-8); UI-Language: en-US
Calc: threaded
Comment 8 Xisco Faulí 2019-08-06 13:34:51 UTC
Still reproducible in

Version: 6.4.0.0.alpha0+
Build ID: 967644f09b8b7abe3b86d1647820f14e0196f8b4
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US
Calc: threaded
Comment 9 Telesto 2020-05-16 17:22:18 UTC
Are these exact steps still causing a crash?

The STR works if there is a previous crash (at least for me), but not to initiate the 'first' crash 
Version: 7.0.0.0.alpha1+ (x64)
Build ID: f9790da286f2d2fa47f1748f8cfa6172c6622ca3
CPU threads: 4; OS: Windows 6.3 Build 9600; UI render: Skia/Raster; VCL: win; 
Locale: nl-NL (nl_NL); UI: en-US
Calc: CL

It will crash eventually, adding CTRL+A CTRL+X or pasting table over table.. and if there is a crash, the STR is working the next time..
Comment 10 Xisco Faulí 2021-11-08 10:56:29 UTC
Still reproducible in

Version: 7.3.0.0.alpha1+ / LibreOffice Community
Build ID: 9ffbbd9dba5f12be2914ebbf01ebdd303b695e46
CPU threads: 4; OS: Linux 5.10; UI render: default; VCL: gtk3
Locale: en-US (en_US.UTF-8); UI: en-US
Calc: threaded
Comment 11 Caolán McNamara 2021-11-10 12:51:08 UTC
The assert can be reached with a few less steps as:

1. Open attachment 145162 [details] from bug 120115
2. CTRL+A & CTRL+X
3. CTRL+N (New document)
4. CTRL+V
5. CTRL+A & CTRL+X
6. CTRL+Z x 2
7. SPACE
-> CRASH
Comment 12 Caolán McNamara 2021-11-10 14:55:40 UTC
In SwNodes::Delete I see there is a node where pTextNode->IsOutline() is false, but where m_pOutlineNodes->Seek_Entry( pNd, &nIdxPos ); is true and that seems to be the problem
Comment 13 Caolán McNamara 2021-11-10 15:33:30 UTC
Created attachment 176178 [details]
much smaller document that can reproduce the assert
Comment 14 Caolán McNamara 2021-11-10 17:26:02 UTC
https://gerrit.libreoffice.org/c/core/+/124999 seeems to fix the assert and also the initially reported crash
Comment 15 Commit Notification 2021-11-15 20:17:20 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/d405d73c60d9a86631f592ba4b4cc97ee43fec38

tdf#121546 sw: don't use undo array's m_pOutlineNodes

It will be available in 7.3.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 16 Caolán McNamara 2021-11-15 20:39:04 UTC
fix in trunk, backport to 7-2 in gerrit
Comment 17 Caolán McNamara 2021-11-15 20:58:01 UTC
*** Bug 119241 has been marked as a duplicate of this bug. ***
Comment 18 Commit Notification 2021-11-16 10:28:25 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-7-2":

https://git.libreoffice.org/core/commit/74ff78e1e21dc83099d0dfcedba780c176c8fb3f

tdf#121546 sw: don't use undo array's m_pOutlineNodes

It will be available in 7.2.4.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 19 Commit Notification 2021-11-18 09:51:09 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-7-2-3":

https://git.libreoffice.org/core/commit/f7a148cf13cab1505e0ca8229f6cb334662ef20b

tdf#121546 sw: don't use undo array's m_pOutlineNodes

It will be available in 7.2.3.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 20 Commit Notification 2021-11-20 11:13:47 UTC
Xisco Fauli committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/653c5d2ca1cc777d3556348b65ded0eaae95a414

tdf#121546: sw_uiwriter3: Add unittest

It will be available in 7.3.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 21 Dieter 2021-11-27 09:27:20 UTC
VERIFIED with

Version: 7.4.0.0.alpha0+ (x64) / LibreOffice Community
Build ID: ae36ee4f3aa544e53e2edad93d6d79160b27bc9d
CPU threads: 4; OS: Windows 10.0 Build 19044; UI render: Skia/Raster; VCL: win
Locale: de-DE (de_DE); UI: en-GB
Calc: CL

Michael, Xisco, thank you for fixing it!