Bug 128603 - CRASH: Cutting a textbox in a reopened document
Summary: CRASH: Cutting a textbox in a reopened document
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
4.4 all versions
Hardware: All All
: medium normal
Assignee: Miklos Vajna
URL:
Whiteboard: target:6.4.0 target:6.3.4
Keywords: bibisected, bisected, regression
Depends on:
Blocks:
 
Reported: 2019-11-05 08:51 UTC by Xisco Faulí
Modified: 2019-11-08 11:24 UTC (History)
2 users (show)

See Also:
Crash report or crash signature: ["SwNodeIndex::~SwNodeIndex()"]


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Xisco Faulí 2019-11-05 08:51:07 UTC
Issue found while verifying bug 128335

Steps to reproduce:
1. Open attachment 153993 [details] from bug 127412
2. Select shape 3
3. Ctrl + X
4. Ctrl + V
5. Undo 2 times
6. Select shape 3 again
7. Ctrl + X
8. Close the document -> do not save
9. Open the same document again
10. Select shape 3
11. Ctrl + X

-> Crash

Reproduced in

Version: 6.4.0.0.alpha1+
Build ID: ee909ca2c02f949605f68720c3f1eef658502749
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US
Calc: threaded
Comment 1 Xisco Faulí 2019-11-05 08:52:19 UTC
Regression introduced by:

https://cgit.freedesktop.org/libreoffice/core/commit/?id=9835a5823e0f559aabbc0e15ea126c82229c4bc7

author	Miklos Vajna <vmiklos@collabora.co.uk>	2014-10-04 19:37:55 +0200
committer	Miklos Vajna <vmiklos@collabora.co.uk>	2014-10-04 20:18:01 +0200
commit	9835a5823e0f559aabbc0e15ea126c82229c4bc7 (patch)
tree	12b77a17bf437e248ef02cc06634ab1dc458a99c
parent	ad5e8b30ac66a00d0110fcdaf4d064181247585b (diff)
sw textboxes: reimplement ODF import/export

Bisected with: bibisect-44max

Adding Cc: to Miklos Vajna
Comment 2 Commit Notification 2019-11-07 11:28:34 UTC
Miklos Vajna committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/dbe744f1deef144e205b72e5927d61a6ea47af25

tdf#128603 sw textbox: restore shape+frame pair on undo

It will be available in 6.4.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 3 Xisco Faulí 2019-11-07 16:21:01 UTC
Verified in

Version: 6.4.0.0.alpha1+
Build ID: 498c2d3944b666c2f016b65903001920db2cb2a4
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US
Calc: threaded

@Miklos, thanks for fixing this issue!!
Comment 4 Commit Notification 2019-11-07 18:12:27 UTC
Miklos Vajna committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/0c49f0f8a16cf3eeb887b6c68213d00bbd56a3eb

Related: tdf#128603 sw textbox: fix use-after-free

It will be available in 6.4.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 5 Commit Notification 2019-11-08 11:24:56 UTC
Miklos Vajna committed a patch related to this issue.
It has been pushed to "libreoffice-6-3":

https://git.libreoffice.org/core/commit/dc15ed995b6bc1745688b6d8ee6b935705a055c1

tdf#128603 sw textbox: restore shape+frame pair on undo

It will be available in 6.3.4.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.