Bug 126504 - Crash on Undo of paste table below table
Summary: Crash on Undo of paste table below table
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
(earliest affected)
Inherited From OOo
Hardware: All All
: high major
Assignee: Not Assigned
Depends on:
Blocks: Undo-Redo
  Show dependency treegraph
Reported: 2019-07-22 10:47 UTC by Michael Stahl (CIB)
Modified: 2020-01-27 09:43 UTC (History)
4 users (show)

See Also:
Crash report or crash signature: ["BigPtrArray::Index2Block(unsigned long)", "SwTextNode::SplitContentNode(SwPosition const &,std::function<void > const *)"]


Note You need to log in before you can comment on or make changes to this bug.
Description Michael Stahl (CIB) 2019-07-22 10:47:03 UTC
this is copied from bug 117215 comment #12


Telesto 2018-11-28 12:27:11 CET

Created attachment 147089 [details]
Example file

Another (very basic) example with a table instead of image (with a specific anchoring)

Steps to Reproduce:
1. Cursor inside the embedded table 
2. CTRL+A 
3. CTRL+A (full table selected)
3. CTRL+V (below the existing table)

Actual Results:
crash with some invalid nodearray access

Expected Results:
no crash

Reproducible: Always

User Profile Reset: No

Additional Info:
Comment 1 Michael Stahl (CIB) 2019-07-22 11:08:36 UTC
Comment 2 Michael Stahl (CIB) 2019-07-22 11:10:37 UTC
copying severity etc. from source bug

bugzilla is giving me weird error messages so i'm trying it one field at a time, sorry about the mails...

oops ignore the attachment url in the description, that was a mis-paste, the right one ins 147089
Comment 3 Michael Stahl (CIB) 2019-07-22 11:11:38 UTC
ah! i get the error if i set status to NEW
Comment 4 Christian Lohmaier 2019-07-22 11:57:30 UTC
try to set to new after reindex of bugzilla activity table...
Comment 5 baffclan 2019-07-22 12:36:39 UTC
Cannot reproduce with,

Version: (x64)
Build ID: 728469fa359ba8c83d812146293a0b0aa53945ba
CPU threads: 4; OS: Windows 10.0; UI render: default; VCL: win; 
Locale: ja-JP (ja_JP); UI-Language: en-US
Calc: threaded

Version: (x64)
Build ID: cb28e48bfd7e8727797435dc05bdfe1652fb34f0
CPU threads: 4; OS: Windows 10.0; UI render: GL; VCL: win; 
TinderBox: Win-x86_64@62-TDF, Branch:master, Time: 2019-06-20_23:11:40
Locale: ja-JP (ja_JP); UI-Language: en-US
Calc: threaded

Version: (x64)
Build ID: 59b5eca7030a091b9f39257897e757a51f2345e1
CPU threads: 4; OS: Windows 10.0; UI render: GL; VCL: win; 
TinderBox: Win-x86_64@42, Branch:master, Time: 2019-07-21_01:43:29
Locale: ja-JP (ja_JP); UI-Language: en-US
Calc: threaded
Comment 6 Michael Stahl (CIB) 2019-07-22 12:59:24 UTC
i get this, but maybe it's survivable in a non-debug version:

soffice.bin: /home/ms/lo/master/sw/source/core/bastyp/bparr.cxx:84: BigPtrEntry *BigPtrArray::operator[](sal_uLong) const: Assertion `idx < m_nSize' failed.
Comment 7 Xisco Faulí 2020-01-10 10:42:38 UTC
Another way to get the same crash signature < crashreport.libreoffice.org/stats/crash_details/870d593a-d4a8-444e-b5ab-dec2b7a18948 >

1. Open attachment 142123 [details] from bug 117638
2. Select all
3. Copy
4. Paste 5 times
5. Undo 6 times

-> Crash
Comment 8 Xisco Faulí 2020-01-27 09:43:49 UTC
I think the following crash may also be related, although the crash signature is different < http://crashreport.libreoffice.org/stats/crash_details/fd2b9d8a-9895-4924-ae3d-549104b81287 >

Steps to reproduce:
1. Open attachment 155681 [details] from bug 124821
2. Select all
3. Cut
4. Paste 2 times
5. Undo 3 times

-> Crash