Bug 126168 - Crash in: rtl_uString_acquire: frame style undo redo
Summary: Crash in: rtl_uString_acquire: frame style undo redo
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
5.0 all versions
Hardware: All All
: high major
Assignee: Vasily Melenchuk (CIB)
URL:
Whiteboard: target:6.4.0 target:6.3.1 target:6.2....
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2019-06-30 05:02 UTC by Jim Raykowski
Modified: 2019-11-22 19:13 UTC (History)
6 users (show)

See Also:
Crash report or crash signature: ["rtl_uString_acquire"]


Attachments
bt Windows (windbg) (47.67 KB, text/plain)
2019-07-01 09:14 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Jim Raykowski 2019-06-30 05:02:26 UTC
This bug was filed from the crash reporting server and is br-a98f97bf-bac1-4a8a-a344-1195ddfdddeb.
=========================================

Here are the steps that repro the crash:
Version: 6.2.0.2 (x64)
Build ID: 2ce5217b30a543f7666022df50f0562f82be0cff
CPU threads: 4; OS: Windows 10.0; UI render: default; VCL: win; 
Locale: en-US (en_US); UI-Language: en-US
Calc: threaded

1) Open Writer
2) Menu > Insert > Frame > Frame...
3) Press OK in Frame dialog
4) Sidebar Styles deck New Style from Selection button select New Style...
(In version 6.4 the button name is Styles action and the drop down item is New Style from Selection)
5) Enter a name in the Create Style dialog and press OK
6) ctrl+z 3 times
7) shift+ctrl+z 3 times

Results: crash

Also able to repro using: Linux SAL_USE_VLCPLUGIN=gtk3, gtk2, and gen
Version: 6.4.0.0.alpha0+
Build ID: 7dd57a914be5f8fc2b53b7725c16625887cf7439
CPU threads: 4; OS: Linux 5.0; UI render: default; VCL: gtk3;
Locale: en-US (en_US.UTF-8); UI-Language: en-US
Calc: threaded

The repro steps don't always work for gtk3 and sometimes can be reproduced by doing ctrl+z 2 times in step six and then shift+ctrl+z 3 times
 
Windows version Version: 6.4.0.0.alpha0+ (x64) does not repro with the above steps but can be made to crash as well by playing with the undo and redo after Creating a new style.
Comment 1 Telesto 2019-06-30 07:43:59 UTC
Repro with
Version: 6.4.0.0.alpha0+ (x86)
Build ID: c2cb467a1e5194c56bb65706b7965fb2c9241b8f
CPU threads: 4; OS: Windows 6.3; UI render: default; VCL: win; 
TinderBox: Win-x86@42, Branch:master, Time: 2019-06-29_00:11:35
Locale: nl-NL (nl_NL); UI-Language: en-US
Calc: threaded
Comment 2 Xisco Faulí 2019-06-30 11:12:36 UTC
Also reproduced in

Version: 5.2.0.0.alpha1+
Build ID: 5b168b3fa568e48e795234dc5fa454bf24c9805e
CPU Threads: 4; OS Version: Linux 4.15; UI Render: default; 
Locale: ca-ES (ca_ES.UTF-8)
Comment 3 Xisco Faulí 2019-06-30 18:04:51 UTC
Also reproduced in

Version: 5.2.0.0.alpha0+
Build ID: 3ca42d8d51174010d5e8a32b96e9b4c0b3730a53
Threads 4; Ver: 4.15; Render: default; 

but not in

Version: 4.5.0.0.alpha0+
Build ID: 2851ce5afd0f37764cbbc2c2a9a63c7adc844311
Locale: ca_ES
Comment 4 Xisco Faulí 2019-06-30 18:22:18 UTC
it needs to be bisected with 5.0 repo. I've tried on linux but the results isn't accurate. I'll try again tomorrow. Maybe it's better if done on Win
Comment 5 Julien Nabet 2019-07-01 09:14:01 UTC
Created attachment 152479 [details]
bt Windows (windbg)

On Win10 with master sources updated 3 days ago, I could reproduce this.
Comment 6 Xisco Faulí 2019-07-01 09:31:00 UTC
I believe this is a regression from

author	Vasily Melenchuk <vasily.melenchuk@cib.de>	2015-04-06 12:23:09 +0300
committer	Katarina Behrens <Katarina.Behrens@cib.de>	2015-05-03 23:23:00 +0200
commit bc9d02b0ca6244b46c9e2c59b7cc3618eb0f0148 (patch)
tree 21e5b9f00dd0e3f75fee093748a41cebc6a9f38e
parent f7bed502ff0dc43f5a24f8e35c5573bdd76eed65 (diff)
tdf#89783: sal_uInt16 replacement by size_t: sections

Bisected with: bibisect-50max

Adding Cc: to Vasily Melenchuk
Comment 7 Commit Notification 2019-08-01 12:26:37 UTC
Vasily Melenchuk committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/+/20e7632919f4bbefabb4190d10ee79c65b89dca7%5E%21

tdf#126168: sw undo/redo crash fixed

It will be available in 6.4.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 8 Xisco Faulí 2019-08-02 09:24:45 UTC
Verified in

Version: 6.4.0.0.alpha0+
Build ID: 620fff54ca9cd04459cc5d963ef94d4438129fe4
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US
Calc: threaded

@Vasily Melenchuk, thanks for fixing this issue!
Comment 9 Commit Notification 2019-08-02 09:27:27 UTC
Vasily Melenchuk committed a patch related to this issue.
It has been pushed to "libreoffice-6-3":

https://git.libreoffice.org/core/+/9b9a69aa0eefca90ed4a72caae97b485aabb37ae%5E%21

tdf#126168: sw undo/redo crash fixed

It will be available in 6.3.1.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 10 Commit Notification 2019-08-06 09:33:47 UTC
Vasily Melenchuk committed a patch related to this issue.
It has been pushed to "libreoffice-6-2":

https://git.libreoffice.org/core/+/3d3a0979fa148ab90d6794f58829f2c3cd90503a%5E%21

tdf#126168: sw undo/redo crash fixed

It will be available in 6.2.7.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 11 Commit Notification 2019-11-22 19:13:32 UTC
Zdeněk Crhonek committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/f394ea0b6b58ed516977803f00c0147bb0facc25

uitest for bug tdf#126168

It will be available in 6.5.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.