Created attachment 149500 [details] Headings search crash test file Steps to repro: 1) Open writer with the attached file 2) Menu > View > Toolbars > Find 3) Select Headings in the Navigate By list box 4) Press the Next Heading control until crash occurs (4 presses) I have traced the bug to the following commit: commit d0e9cc832d19b622532f01580d9cf78ee0b215db Author: Michael Stahl <Michael.Stahl@cib.de>, Thu Oct 25 11:06:38 2018 +0200 (4 months ago) Committer: Michael Stahl <Michael.Stahl@cib.de>, Thu Nov 15 15:10:02 2018 +0100 (3 months ago) Follows: libreoffice-6-2-branch-point Precedes: libreoffice-6.2.0.0.beta1 sw_redlinehide_3: adapt GotoOutline for SwCursrShell Adapt SwDoc::GotoOutline(), SwCursorShell::GotoNextOutline(), SwCursorShell::GotoPrevOutline() to skip over outline nodes that are merged away in the layout. Change-Id: Id6f6bb93177753ed21a438c89dc6d90098e11455 It seems to be an issue with accessing an array out of bounds.
Created attachment 149501 [details] bt with debug symbols On pc Debian x86-64 with master sources updated some days ago, I could reproduce this.
fixed on master
Michael Stahl committed a patch related to this issue. It has been pushed to "master": https://git.libreoffice.org/core/+/dfdb7f9fcffe0b8594359c22277b64c7b6cdfd4c%5E%21 tdf#123637 sw_redlinehide: fix iteration in SwCursorShell::GotoNextOutline() It will be available in 6.3.0. The patch should be included in the daily builds available at https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: https://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Michael Stahl committed a patch related to this issue. It has been pushed to "libreoffice-6-2": https://git.libreoffice.org/core/+/0308bfd590a5bdf602254491b1a76e055e6c3f85%5E%21 tdf#123637 sw_redlinehide: fix iteration in SwCursorShell::GotoNextOutline() It will be available in 6.2.3. The patch should be included in the daily builds available at https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: https://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
I confirmed it is fixed in Version: 6.3.0.0.alpha0+ Build ID: b440aea0a0b90b7e6700ee7f6f26e0139089c05d CPU threads: 4; OS: Linux 4.18; UI render: default; VCL: gtk3; Locale: en-US (en_US.UTF-8); UI-Language: en-US Calc: threaded
Verified in Version: 6.3.0.0.alpha0+ Build ID: 8aa579830b20072af8d6e149d6b279362fe98b91 CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US Calc: threaded @Michael Stahl, thanks for fixing this issue!
*** Bug 124067 has been marked as a duplicate of this bug. ***
Michael Stahl committed a patch related to this issue. It has been pushed to "libreoffice-6-2-2": https://git.libreoffice.org/core/+/99f750a7c7bbef67dd6479b77d617f94ce8bfa37%5E%21 tdf#123637 sw_redlinehide: fix iteration in SwCursorShell::GotoNextOutline() It will be available in 6.2.2. The patch should be included in the daily builds available at https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: https://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
bottom fin bar is not supported for uitests see https://wiki.documentfoundation.org/Development/UITests#Unsupported_ui_items