Bug 124397 - FILEOPEN DOCX Deleting text frame from DOCX crashes LibreOffice Writer
Summary: FILEOPEN DOCX Deleting text frame from DOCX crashes LibreOffice Writer
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
(earliest affected)
4.0 all versions
Hardware: All All
: high major
Assignee: Not Assigned
Whiteboard: target:7.0.0
Keywords: bibisected, haveBacktrace, regression
Depends on:
Blocks: DOCX-Frames Crash-BigPtrArray
  Show dependency treegraph
Reported: 2019-03-28 15:15 UTC by NISZ LibreOffice Team
Modified: 2020-07-01 11:30 UTC (History)
5 users (show)

See Also:
Crash report or crash signature: ["SwFlyFrame::InsertColumns()","BigPtrArray::Index2Block(unsigned long)"]
Regression By:

The file with the frame that causes the crash (28.83 KB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2019-03-28 15:17 UTC, NISZ LibreOffice Team
A screenshot showcasing the crash (61.96 KB, image/png)
2019-03-28 15:19 UTC, NISZ LibreOffice Team
gdb backtrace (deleted)
2019-03-28 16:04 UTC, Xisco Faulí
gdb backtrace (41.03 KB, text/x-log)
2019-03-28 16:06 UTC, Xisco Faulí
console logs + bt (8.35 KB, text/plain)
2019-03-28 18:02 UTC, Julien Nabet

Note You need to log in before you can comment on or make changes to this bug.
Description NISZ LibreOffice Team 2019-03-28 15:15:44 UTC
If we delete the text frame from the attached document in LibreOffice Writer, LibreOffice crashes.

The earliest version of LibreOffice we were able to reproduce the bug was LibreOffice (Build ID: 932b512).

LibreOffice 3.5.0rc3 (Build ID: 7e68ba2-a744ebf-1f241b7-c506db1-7d53735) rendered the text frame as a narrow and tall rectangle, but deleting it didn't cause crash.

Steps to Reproduce:
    1. Open the attached DOCX file;
    2. Select the red text frame and delete it by pressing Del – alternatively, you can use the Navigator to delete the object.

Actual Results:
LibreOffice crashes when we attempt to delete the text frame from the document.

Expected Results:
LibreOffice should just delete the text frame without crashing.

Reproducible: Always

User Profile Reset: No

Additional Info:
LibreOffice details:
Version: (x64)
Build ID: ed6a71eafa61bade50219d2ff6233a42ab6d1c17
CPU threads: 4; OS: Windows 6.3; UI render: GL; VCL: win; 
TinderBox: Win-x86_64@42, Branch:master, Time: 2019-03-28_01:15:23
Locale: hu-HU (hu_HU); UI-Language: en-US
Calc: threaded
Comment 1 NISZ LibreOffice Team 2019-03-28 15:17:31 UTC
Created attachment 150360 [details]
The file with the frame that causes the crash
Comment 2 NISZ LibreOffice Team 2019-03-28 15:19:24 UTC
Created attachment 150361 [details]
A screenshot showcasing the crash
Comment 3 Xisco Faulí 2019-03-28 15:35:15 UTC
Reproduced in

Build ID: e74de110d16c95414fac7541c8fe6541d4597113
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US
Calc: threaded
Comment 4 Xisco Faulí 2019-03-28 15:43:18 UTC
Also reproduced in

Version (Build ID: efca6f15609322f62a35619619a6d5fe5c9bd5a)
Comment 5 Xisco Faulí 2019-03-28 16:04:58 UTC
Created attachment 150366 [details]
gdb backtrace
Comment 6 Xisco Faulí 2019-03-28 16:06:24 UTC
The content of attachment 150366 [details] has been deleted for the following reason:

unreadable file
Comment 7 Xisco Faulí 2019-03-28 16:06:51 UTC
Created attachment 150367 [details]
gdb backtrace
Comment 8 Julien Nabet 2019-03-28 18:02:47 UTC
Created attachment 150377 [details]
console logs + bt

On pc Debian x86-64 with master sources updated today, I could reproduce this.
Comment 9 Xisco Faulí 2019-04-01 10:36:46 UTC
I get two different crash signatures.

1. If the text mark is deleted from the navigator -> SwFlyFrame::InsertColumns()
2. If the text frame is deleted placing the cursor before it + del + undo -> BigPtrArray::Index2Block(unsigned long)
Comment 12 Xisco Faulí 2019-04-02 13:18:31 UTC
(In reply to Xisco Faulí from comment #11)
> One of these commits look like a good candidate ->
> https://cgit.freedesktop.org/libreoffice/core/log/sw/source/
> core?qt=range&q=1cdb792368ed26d58828eead2848422e7dec4c7d..
> 77987eacff20dec40caf29aae61d262239d441e9

Hi Noel, I'm wondering if this crash might be caused by one of your refactors mentioned in the link above...
Comment 13 Michael Meeks 2019-04-09 11:55:27 UTC
Noel - Xisco raised this in the ESC last week; any thoughts ?
Comment 14 Noel Grandin 2019-04-09 16:10:38 UTC
It's definitely a lifetime issue, we have a nullptr inside a unique_ptr here, but I have no idea how to fix it - I mean, I could fix by checking for nullptr in this specific place, but possibly the SwNodeIndex is not supposed to have a nullptr, and should be removed somewhere else?
Comment 15 Xisco Faulí 2019-07-29 15:31:31 UTC
Still reproducible in

Build ID: 0d36b32755ac662299e6a8165e9fa57311b74a2f
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US
Calc: threaded

@Michael Stahl, I thought you might be interested in this issue..
Comment 16 Xisco Faulí 2020-04-30 14:24:44 UTC
The issue was fixed by https://cgit.freedesktop.org/libreoffice/core/commit/?id=81112d875f1c29f1244e7f283f90d56cfbe5b5b4

@Michael Stahl, thanks for fixing this issue!!

Comment 17 Commit Notification 2020-04-30 16:40:03 UTC
Xisco Fauli committed a patch related to this issue.
It has been pushed to "master":


tdf#124397: sw: Add unittest

It will be available in 7.0.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:

Affected users are encouraged to test the fix and report feedback.