Bug Hunting Session
Bug 124397 - FILEOPEN DOCX Deleting text frame from DOCX crashes LibreOffice Writer
Summary: FILEOPEN DOCX Deleting text frame from DOCX crashes LibreOffice Writer
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
4.0 all versions
Hardware: All All
: high major
Assignee: Not Assigned
URL:
Whiteboard:
Keywords: bibisected, haveBacktrace, regression
Depends on:
Blocks: DOCX-Frames
  Show dependency treegraph
 
Reported: 2019-03-28 15:15 UTC by NISZ LibreOffice Team
Modified: 2019-08-07 11:53 UTC (History)
5 users (show)

See Also:
Crash report or crash signature: ["SwFlyFrame::InsertColumns()","BigPtrArray::Index2Block(unsigned long)"]


Attachments
The file with the frame that causes the crash (28.83 KB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2019-03-28 15:17 UTC, NISZ LibreOffice Team
Details
A screenshot showcasing the crash (61.96 KB, image/png)
2019-03-28 15:19 UTC, NISZ LibreOffice Team
Details
gdb backtrace (deleted)
2019-03-28 16:04 UTC, Xisco Faulí
Details
gdb backtrace (41.03 KB, text/x-log)
2019-03-28 16:06 UTC, Xisco Faulí
Details
console logs + bt (8.35 KB, text/plain)
2019-03-28 18:02 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description NISZ LibreOffice Team 2019-03-28 15:15:44 UTC
Description:
If we delete the text frame from the attached document in LibreOffice Writer, LibreOffice crashes.

The earliest version of LibreOffice we were able to reproduce the bug was LibreOffice 3.6.0.4 (Build ID: 932b512).

LibreOffice 3.5.0rc3 (Build ID: 7e68ba2-a744ebf-1f241b7-c506db1-7d53735) rendered the text frame as a narrow and tall rectangle, but deleting it didn't cause crash.

Steps to Reproduce:
    1. Open the attached DOCX file;
    2. Select the red text frame and delete it by pressing Del – alternatively, you can use the Navigator to delete the object.

Actual Results:
LibreOffice crashes when we attempt to delete the text frame from the document.

Expected Results:
LibreOffice should just delete the text frame without crashing.


Reproducible: Always


User Profile Reset: No



Additional Info:
LibreOffice details:
Version: 6.3.0.0.alpha0+ (x64)
Build ID: ed6a71eafa61bade50219d2ff6233a42ab6d1c17
CPU threads: 4; OS: Windows 6.3; UI render: GL; VCL: win; 
TinderBox: Win-x86_64@42, Branch:master, Time: 2019-03-28_01:15:23
Locale: hu-HU (hu_HU); UI-Language: en-US
Calc: threaded
Comment 1 NISZ LibreOffice Team 2019-03-28 15:17:31 UTC
Created attachment 150360 [details]
The file with the frame that causes the crash
Comment 2 NISZ LibreOffice Team 2019-03-28 15:19:24 UTC
Created attachment 150361 [details]
A screenshot showcasing the crash
Comment 3 Xisco Faulí 2019-03-28 15:35:15 UTC
Reproduced in

Version: 6.3.0.0.alpha0+
Build ID: e74de110d16c95414fac7541c8fe6541d4597113
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US
Calc: threaded
Comment 4 Xisco Faulí 2019-03-28 15:43:18 UTC
Also reproduced in

Version 4.1.0.0.alpha0+ (Build ID: efca6f15609322f62a35619619a6d5fe5c9bd5a)
Comment 5 Xisco Faulí 2019-03-28 16:04:58 UTC
Created attachment 150366 [details]
gdb backtrace
Comment 6 Xisco Faulí 2019-03-28 16:06:24 UTC
The content of attachment 150366 [details] has been deleted for the following reason:

unreadable file
Comment 7 Xisco Faulí 2019-03-28 16:06:51 UTC
Created attachment 150367 [details]
gdb backtrace
Comment 8 Julien Nabet 2019-03-28 18:02:47 UTC
Created attachment 150377 [details]
console logs + bt

On pc Debian x86-64 with master sources updated today, I could reproduce this.
Comment 9 Xisco Faulí 2019-04-01 10:36:46 UTC
I get two different crash signatures.

1. If the text mark is deleted from the navigator -> SwFlyFrame::InsertColumns()
2. If the text frame is deleted placing the cursor before it + del + undo -> BigPtrArray::Index2Block(unsigned long)
Comment 12 Xisco Faulí 2019-04-02 13:18:31 UTC
(In reply to Xisco Faulí from comment #11)
> One of these commits look like a good candidate ->
> https://cgit.freedesktop.org/libreoffice/core/log/sw/source/
> core?qt=range&q=1cdb792368ed26d58828eead2848422e7dec4c7d..
> 77987eacff20dec40caf29aae61d262239d441e9

Hi Noel, I'm wondering if this crash might be caused by one of your refactors mentioned in the link above...
Comment 13 Michael Meeks 2019-04-09 11:55:27 UTC
Noel - Xisco raised this in the ESC last week; any thoughts ?
Comment 14 Noel Grandin 2019-04-09 16:10:38 UTC
It's definitely a lifetime issue, we have a nullptr inside a unique_ptr here, but I have no idea how to fix it - I mean, I could fix by checking for nullptr in this specific place, but possibly the SwNodeIndex is not supposed to have a nullptr, and should be removed somewhere else?
Comment 15 Xisco Faulí 2019-07-29 15:31:31 UTC
Still reproducible in

Version: 6.4.0.0.alpha0+
Build ID: 0d36b32755ac662299e6a8165e9fa57311b74a2f
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US
Calc: threaded

@Michael Stahl, I thought you might be interested in this issue..