Download it now!
Bug 134101 - BigPtrArray::Index2Block undo crash
Summary: BigPtrArray::Index2Block undo crash
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
(earliest affected)
Inherited From OOo
Hardware: All All
: medium critical
Assignee: Not Assigned
Keywords: haveBacktrace, notBibisectable
: 134434 (view as bug list)
Depends on: 136626
Blocks: Undo-Redo Crash-BigPtrArray
  Show dependency treegraph
Reported: 2020-06-18 10:15 UTC by Telesto
Modified: 2020-09-10 07:47 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:

GDB trace of crash (24.40 KB, text/plain)
2020-06-18 11:18 UTC, Buovjaga
minimal reproducer (40.29 KB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2020-06-18 11:53 UTC, Xisco Faulí
minimal reproducer (9.25 KB, application/vnd.oasis.opendocument.text)
2020-07-02 11:36 UTC, Michael Stahl (CIB)

Note You need to log in before you can comment on or make changes to this bug.
Description Telesto 2020-06-18 10:15:38 UTC
BigPtrArray::Index2Block undo crash

Steps to Reproduce:
1. Open attachment 94362 [details] from bug 75208,

Actual Results:

Expected Results:
No crash

Reproducible: Always

User Profile Reset: No

Additional Info:
Found in

and in

but not in
Comment 1 Buovjaga 2020-06-18 11:15:24 UTC
Bibisected with Linux 44max to!/
Copy first-header-footer test from ww8 to ooxml

Adding Cc: to Luke Deller

Repro step between 2 and 3 should be "CTRL+C"
Comment 2 Buovjaga 2020-06-18 11:18:06 UTC
Created attachment 162150 [details]
GDB trace of crash

Arch Linux 64-bit
Build ID: ad0351b84926075297fb74abbe9b31a0455782af
CPU threads: 8; OS: Linux 5.7; UI render: default; VCL: kf5
Locale: fi-FI (fi_FI.UTF-8); UI: en-US
Calc: threaded
Built on 17 June 2020
Comment 3 Xisco Faulí 2020-06-18 11:53:15 UTC
Created attachment 162153 [details]
minimal reproducer
Comment 4 Xisco Faulí 2020-06-18 12:51:02 UTC
For the record, I can't reproduce it in

Build ID: c98b1f1cd43b3e109bcaf6324ef2d1f449b34099
CPU threads: 4; OS: Linux 4.19; UI render: default; VCL: gtk3; 
Locale: en-US (en_US.UTF-8); UI-Language: en-US
Calc: threaded

so I do believe the issue was fixed at some point between the commit in commit 1 and c98b1f1cd43b3e109bcaf6324ef2d1f449b34099. Later, this issue was reintroduced, likely related to bug 134107 or bug 129805

@Telesto, when checking with older versions, please test with other versions in between. LibreOffice 4.4.7 was released more than 5 years ago, which is a huge window of time
Comment 5 Buovjaga 2020-06-18 13:42:29 UTC
(In reply to Xisco Faulí from comment #4)
> @Telesto, when checking with older versions, please test with other versions
> in between. LibreOffice 4.4.7 was released more than 5 years ago, which is a
> huge window of time

Indeed, apologies to Luke for the noise.

The first hint of badness in Linux 6.4 line is a crash upon quitting. Blamed commit:!/

Later in Linux 6.4 repo it morphed to crashing already in the copying step. Appeared in range:

Finally, it became what it is today in Linux 6.5 repo with the commit!/
tdf#129805 writerfilter: fix import of nested generic field

Adding Cc: to Michael Stahl
Comment 6 Michael Stahl (CIB) 2020-07-02 11:33:49 UTC
this crashes because:

during pasting, SwUndoInserts is created first, then SwUndoInsLayFormat is created for flys anchored in a footer from a page style referenced by a page break on some text node, then SwUndoInserts::SetInsertRange() is called.

on Undo, first SwUndoInsLayFormat deletes the flys, then SwUndoInserts has wrong node indexes.

this is not a regression, can repro it in LO 5.2 and OOo 3.3.

what changed in LO 6.4 is that apparently the flys anchored in the footer are imported now, when previously they weren't.
Comment 7 Michael Stahl (CIB) 2020-07-02 11:36:56 UTC
Created attachment 162590 [details]
minimal reproducer
Comment 8 Michael Stahl (CIB) 2020-07-07 16:56:47 UTC
*** Bug 134434 has been marked as a duplicate of this bug. ***
Comment 9 Xisco Faulí 2020-09-10 07:47:29 UTC
Changing to Inherit from OOo based on comment 6