Description: The bug is that, under some circumstances, when I type a word that starts with the letter "f" then the letter "i", LibreOffice Writer crashes when I type the letter "i". Maybe it also happens with other letter combinations but this is the only one I ran into so far. It always happens when the font is Linux Biolinum G, and doesn't happen with other fonts like Calibri. Steps to Reproduce: 1. Set the font to Linux Biolinum G 2. Set the character style to "Emphasis" 3. Type the letter "f", then the letter "i" Actual Results: Crash. Expected Results: Characters should be displayed without crashing. Reproducible: Always User Profile Reset: Yes OpenGL enabled: Yes Additional Info: Version: 6.3.5.2 (x64) Build ID: dd0751754f11728f69b42ee2af66670068624673 CPU threads: 4; OS: Windows 10.0; UI render: default; VCL: win; Locale: en-US (en_US); UI-Language: en-US Calc: threaded NOTE: this also happened with the previous version I had installed: Version: 6.3.1.2 (x64) Build ID: b79626edf0065ac373bd1df5c28bd630b4424273 CPU threads: 4; OS: Windows 10.0; UI render: default; VCL: win; Locale: en-US (en_US); UI-Language: en-US Calc: threaded The bug is also reproducible in safe mode, with and without OpenGL.
Created attachment 158706 [details] A document that reproduces the issue every time on my machine
On pc Debian x86-64 with master sources updated today, I could reproduce this.
I retrieved a bt and try to put some breaks but the pb seems in Harfbuzz. #0 0x00007ffff0b05d0d in (anonymous namespace)::direct_run(bool, void* const*, unsigned char const*, int*, graphite2::Slot**&, unsigned char, graphite2::vm::Machine::status_t&, graphite2::SlotMap*) (get_table_mode=false, program=0x7fffd5dbd798, data=0x7fffd5dbd878 "\006", stack=0x7ffffffe3a98, __map=@0x7ffffffe38f0: 0x7ffffffe52e0, _dir=0 '\000', status=@0x7ffffffe4aa8: graphite2::vm::Machine::finished, __smap=0x7ffffffe52d0) at workdir/UnpackedTarball/graphite/src/inc/opcodes.h:473 #1 0x00007ffff0b07313 in graphite2::vm::Machine::run(void* const*, unsigned char const*, graphite2::Slot**&) (this=0x7ffffffe3a90, program=0x7fffd5dbd798, data=0x7fffd5dbd878 "\006", is=@0x7ffffffe38f0: 0x7ffffffe52e0) at workdir/UnpackedTarball/graphite/src/direct_machine.cpp:116 #2 0x00007ffff0b02ca4 in graphite2::vm::Machine::Code::run(graphite2::vm::Machine&, graphite2::Slot**&) const (this=0x7fffd6286568, m=..., map=@0x7ffffffe38f0: 0x7ffffffe52e0) at workdir/UnpackedTarball/graphite/src/Code.cpp:751 #3 0x00007ffff0afe6c3 in graphite2::Pass::testConstraint(graphite2::Rule const&, graphite2::vm::Machine&) const (this=0x6500a78, r=..., m=...) at workdir/UnpackedTarball/graphite/src/Pass.cpp:653 #4 0x00007ffff0afd5c4 in graphite2::Pass::findNDoRule(graphite2::Slot*&, graphite2::vm::Machine&, graphite2::FiniteStateMachine&) const (this=0x6500a78, slot=@0x7ffffffe3a00: 0x8bd09f0, m=..., fsm=...) at workdir/UnpackedTarball/graphite/src/Pass.cpp:512 #5 0x00007ffff0afd221 in graphite2::Pass::runGraphite(graphite2::vm::Machine&, graphite2::FiniteStateMachine&, bool) const (this=0x6500a78, m=..., fsm=..., reverse=false) at workdir/UnpackedTarball/graphite/src/Pass.cpp:420 #6 0x00007ffff0ae975e in graphite2::Silf::runGraphite(graphite2::Segment*, unsigned char, unsigned char, int) const (this=0x64f08c8, seg=0x8b567d0, firstPass=0 '\000', lastPass=1 '\001', dobidi=1) at workdir/UnpackedTarball/graphite/src/Silf.cpp:431 #7 0x00007ffff0ada76b in graphite2::Face::runGraphite(graphite2::Segment*, graphite2::Silf const*) const (this=0x64b3d50, seg=0x8b567d0, aSilf=0x64f08c8) at workdir/UnpackedTarball/graphite/src/Face.cpp:179 #8 0x00007ffff0c9bdb8 in graphite2::Segment::runGraphite() (this=0x8b567d0) at workdir/UnpackedTarball/graphite/src/inc/Segment.h:94 #9 0x00007ffff0c9b8e0 in (anonymous namespace)::makeAndInitialize(graphite2::Font const*, graphite2::Face const*, unsigned int, graphite2::FeatureVal const*, gr_encform, void const*, unsigned long, int) (font=0x0, face=0x64b3d50, script=1818326126, pFeats=0x5ed9290, enc=gr_utf32, pStart=0x8b562b0, nChars=3, dir=2) at workdir/UnpackedTarball/graphite/src/gr_segment.cpp:46 #10 0x00007ffff0c9b772 in gr_make_seg(gr_font const*, gr_face const*, gr_uint32, gr_feature_val const*, gr_encform, void const*, size_t, int) (font=0x0, face=0x64b3d50, script=1818326126, pFeats=0x5ed9290, enc=gr_utf32, pStart=0x8b562b0, nChars=3, dir=2) at workdir/UnpackedTarball/graphite/src/gr_segment.cpp:110 #11 0x00007ffff0c424b1 in _hb_graphite2_shape(hb_shape_plan_t*, hb_font_t*, hb_buffer_t*, hb_feature_t const*, unsigned int) (shape_plan=0x6564410, font=0x64b3290, buffer=0x8b57790, features=0x0, num_features=0) at hb-graphite2.cc:256 #12 0x00007ffff0c3dd57 in hb_shape_plan_execute(hb_shape_plan_t*, hb_font_t*, hb_buffer_t*, hb_feature_t const*, unsigned int) (shape_plan=0x6564410, font=0x64b3290, buffer=0x8b57790, features=0x0, num_features=0) at ./hb-shaper-list.hh:38 #13 0x00007ffff0c3f229 in hb_shape_full(hb_font_t*, hb_buffer_t*, hb_feature_t const*, unsigned int, char const* const*) (font=0x64b3290, buffer=0x8b57790, features=0x0, num_features=0, shaper_list=0x7ffffffe5e10) at hb-shape.cc:139 #14 0x00007ffff057aa8b in GenericSalLayout::LayoutText(ImplLayoutArgs&, SalLayoutGlyphs const*) (this=0x61173c0, rArgs=..., pGlyphs=0x0) at vcl/source/gdi/CommonSalLayout.cxx:471 #15 0x00007ffff018d7fd in OutputDevice::ImplLayout(rtl::OUString const&, int, int, Point const&, long, long const*, SalLayoutFlags, vcl::TextLayoutCache const*, SalLayoutGlyphs const*) const (this=0x5e887a0, rOrigStr="Text with the \"Emphasis\" style seems to trigger the problem. Try typing the letter \"i\" after the \"f\" here, on my machine it crashes every time: fi", nMinIndex=143, nLen=3, rLogicalPos=Point = {...}, nLogicalWidth=0, pDXArray=0x0, flags=SalLayoutFlags::GlyphItemsOnly, pLayoutCache=0x0, pGlyphs=0x0) at vcl/source/outdev/text.cxx:1319 Indeed when putting a break in vcl/source/gdi/CommonSalLayout.cxx:471, GDB doesn't stop.
Repro master 7.0+ both Win and Lin. Np repro 6.2. Regression in 6.3. 41c8baa8134040fb2bcdf859113cc7d52c53e8c3 is the first bad commit commit 41c8baa8134040fb2bcdf859113cc7d52c53e8c3 Author: Jenkins Build User <tdf@pollux.tdf> Date: Fri Dec 14 09:47:38 2018 +0100 source 6b84708914f9c026776b28a300ac6d278272881f Previous commit 5d196bab4f73206315b9fff03fa8e126b658e2f3 (HEAD, refs/bisect/good-5d196bab4f73206315b9fff03fa8e126b658e2f3) Author: Jenkins Build User <tdf@pollux.tdf> Date: Fri Dec 14 08:14:37 2018 +0100 source 744c82af55d0ef1bfae61d13e5cf32fbd83c8b6b Single source: https://gerrit.libreoffice.org/plugins/gitiles/core/+/6b84708914f9c026776b28a300ac6d278272881f%5E!/ commit 6b84708914f9c026776b28a300ac6d278272881f [log] author Miklos Vajna <vmiklos@collabora.com> Thu Dec 13 09:13:39 2018 +0100 committer Miklos Vajna <vmiklos@collabora.com> Fri Dec 14 09:08:04 2018 +0100 tree f44f856fa3b8d105c951b250860a108c413b72e5 parent 744c82af55d0ef1bfae61d13e5cf32fbd83c8b6b [diff] graphite: update to 1.3.12 Martin Hosken thinks all patches are redundant now, so drop them. Change-Id: I062168416a1289b7f4dd42d8ae58b7df56a37712 Reviewed-on: https://gerrit.libreoffice.org/65074 Tested-by: Jenkins Reviewed-by: Miklos Vajna <vmiklos@collabora.com> CC: Miklos. Please take a look (to fix or to mark EasyHack).
Sounds like a crash in graphite itself, should this be forwarded to <https://github.com/silnrsi/graphite>, to their issue tracker? CC Justin who may know what is the preferred way of handling such "graphite in LO" problems, I don't.
This is a bug in the graphite engine. A fix has been pushed to master and we hope to do a maintenance release in a week or so.
So not our bug then since Graphite one.
You will still need to upgrade to the newer Graphite library when it comes out.
Thanks everyone for the quick resolution!
*** Bug 132453 has been marked as a duplicate of this bug. ***
Gabor Kelemen committed a patch related to this issue. It has been pushed to "master": https://git.libreoffice.org/core/commit/835b86437446a81541ab6923f7776a0a71c44ab9 tdf#131366 Update graphite to 1.3.14 It will be available in 7.0.0. The patch should be included in the daily builds available at https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: https://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Gabor Kelemen committed a patch related to this issue. It has been pushed to "libreoffice-6-4": https://git.libreoffice.org/core/commit/55e9293c342647ad89c3f081c5b5b677140ac847 tdf#131366 Update graphite to 1.3.14 It will be available in 6.4.5. The patch should be included in the daily builds available at https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: https://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
*** Bug 132982 has been marked as a duplicate of this bug. ***
*** Bug 133325 has been marked as a duplicate of this bug. ***
*** Bug 134533 has been marked as a duplicate of this bug. ***
*** Bug 135452 has been marked as a duplicate of this bug. ***
*** Bug 137597 has been marked as a duplicate of this bug. ***
The fix is working for me. Thank you!