Bug 123637 - Crash when Navigate By Headings search wraps from end to beginning of file
Summary: Crash when Navigate By Headings search wraps from end to beginning of file
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
6.2.0.0.beta1+
Hardware: All All
: medium normal
Assignee: Michael Stahl (allotropia)
URL:
Whiteboard: target:6.3.0 target:6.2.2
Keywords: haveBacktrace, needUITest
: 124067 (view as bug list)
Depends on:
Blocks:
 
Reported: 2019-02-21 22:06 UTC by Jim Raykowski
Modified: 2019-06-11 07:00 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:


Attachments
Headings search crash test file (21.50 KB, application/vnd.oasis.opendocument.text)
2019-02-21 22:06 UTC, Jim Raykowski
Details
bt with debug symbols (4.69 KB, text/plain)
2019-02-21 22:44 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Jim Raykowski 2019-02-21 22:06:11 UTC
Created attachment 149500 [details]
Headings search crash test file

Steps to repro:

1) Open writer with the attached file
2) Menu > View > Toolbars > Find
3) Select Headings in the Navigate By list box
4) Press the Next Heading control until crash occurs (4 presses)

I have traced the bug to the following commit:

commit d0e9cc832d19b622532f01580d9cf78ee0b215db
Author: Michael Stahl <Michael.Stahl@cib.de>, Thu Oct 25 11:06:38 2018 +0200 (4 months ago)
Committer: Michael Stahl <Michael.Stahl@cib.de>, Thu Nov 15 15:10:02 2018 +0100 (3 months ago)
Follows: libreoffice-6-2-branch-point
Precedes: libreoffice-6.2.0.0.beta1

sw_redlinehide_3: adapt GotoOutline for SwCursrShell

Adapt SwDoc::GotoOutline(), SwCursorShell::GotoNextOutline(),
SwCursorShell::GotoPrevOutline() to skip over outline nodes that are
merged away in the layout.

Change-Id: Id6f6bb93177753ed21a438c89dc6d90098e11455

It seems to be an issue with accessing an array out of bounds.
Comment 1 Julien Nabet 2019-02-21 22:44:49 UTC
Created attachment 149501 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated some days ago, I could reproduce this.
Comment 2 Michael Stahl (allotropia) 2019-03-07 10:29:12 UTC
fixed on master
Comment 3 Commit Notification 2019-03-07 10:30:53 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/+/dfdb7f9fcffe0b8594359c22277b64c7b6cdfd4c%5E%21

tdf#123637 sw_redlinehide: fix iteration in SwCursorShell::GotoNextOutline()

It will be available in 6.3.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 4 Commit Notification 2019-03-07 16:47:04 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-6-2":

https://git.libreoffice.org/core/+/0308bfd590a5bdf602254491b1a76e055e6c3f85%5E%21

tdf#123637 sw_redlinehide: fix iteration in SwCursorShell::GotoNextOutline()

It will be available in 6.2.3.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 5 Jim Raykowski 2019-03-08 06:07:29 UTC
I confirmed it is fixed in

Version: 6.3.0.0.alpha0+
Build ID: b440aea0a0b90b7e6700ee7f6f26e0139089c05d
CPU threads: 4; OS: Linux 4.18; UI render: default; VCL: gtk3; 
Locale: en-US (en_US.UTF-8); UI-Language: en-US
Calc: threaded
Comment 6 Xisco Faulí 2019-03-13 12:43:35 UTC
Verified in

Version: 6.3.0.0.alpha0+
Build ID: 8aa579830b20072af8d6e149d6b279362fe98b91
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US
Calc: threaded

@Michael Stahl, thanks for fixing this issue!
Comment 7 Xisco Faulí 2019-03-14 07:45:06 UTC
*** Bug 124067 has been marked as a duplicate of this bug. ***
Comment 8 Commit Notification 2019-03-14 20:05:21 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-6-2-2":

https://git.libreoffice.org/core/+/99f750a7c7bbef67dd6479b77d617f94ce8bfa37%5E%21

tdf#123637 sw_redlinehide: fix iteration in SwCursorShell::GotoNextOutline()

It will be available in 6.2.2.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 9 artur 2019-06-11 07:00:15 UTC
bottom fin bar is not supported for uitests see https://wiki.documentfoundation.org/Development/UITests#Unsupported_ui_items