Bug 135001 - Crash delete/undo an resize shape
Summary: Crash delete/undo an resize shape
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
6.2.7.1 release
Hardware: All All
: medium critical
Assignee: Michael Stahl (CIB)
URL:
Whiteboard: target:7.1.0 target:7.0.2 target:6.4.7
Keywords: bibisected, haveBacktrace, regression
: 135963 (view as bug list)
Depends on:
Blocks: Shapes Crash
  Show dependency treegraph
 
Reported: 2020-07-21 06:29 UTC by Telesto
Modified: 2020-08-31 19:59 UTC (History)
4 users (show)

See Also:
Crash report or crash signature: ["SwDoc::ChgAnchor(SdrMarkList const &,RndStdIds,bool,bool)"]


Attachments
bibisect-linux-64-6.3, tail of terminal output (7.12 KB, text/plain)
2020-07-22 01:13 UTC, Terrence Enger
Details
backtrace from master on Linux (7.21 KB, text/plain)
2020-07-22 02:38 UTC, Terrence Enger
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Telesto 2020-07-21 06:29:39 UTC
Description:
Crash delete/undo an resize shape

Steps to Reproduce:
1. Open attachment 162927 [details]
2. Go to page 7
3. Delete the arrow shape
4. undo
5. Resize the partly invisible shape

Actual Results:
Crash

Expected Results:
No crash


Reproducible: Always


User Profile Reset: No



Additional Info:
Version: 7.0.0.2
Build ID: c01aa64b6c3d89ebe5fe69c28c7adb24eb85249c
CPU threads: 4; OS: Mac OS X 10.12.6; UI render: default; VCL: osx
Locale: nl-NL (nl_NL.UTF-8); UI: en-US
Calc: threaded
Comment 1 Telesto 2020-07-21 06:34:03 UTC
See also for larger bunch of issues related to this file. bug 134746
Comment 3 Roman Kuznetsov 2020-07-21 08:49:06 UTC
confirm in

Version: 7.1.0.0.alpha0+
Build ID: 1c584069a86e35b847f398b8bf78dce7428c2f63
CPU threads: 4; OS: Mac OS X 10.15.5; UI render: default; VCL: osx
Locale: ru-RU (ru_RU.UTF-8); UI: en-US
Calc: threaded

and in

Версия: 6.2.7.1
ID сборки: 23edc44b61b830b7d749943e020e96f5a7df63bf
Потоков ЦП: 4; ОС:Mac OS X 10.15.5; Отрисовка ИП: GL; VCL: osx; 
Локаль: ru-RU (ru_RU.UTF-8); Язык UI: ru-RU
Calc: threaded

no repro in

Version: 6.0.7.3
Build ID: dc89aa7a9eabfd848af146d5086077aeed2ae4a5
CPU threads: 4; OS: Mac OS X 10.15.5; UI render: GL; 
Locale: ru-RU (ru_RU.UTF-8); Calc: group

so it's a regression
Comment 4 Terrence Enger 2020-07-22 01:13:10 UTC
Created attachment 163389 [details]
bibisect-linux-64-6.3, tail of terminal output

Working in bibisect-linux-64-6.3 on debian-buster, I see the problem
start somewhere in the 14 commits:
<https://cgit.freedesktop.org/libreoffice/core/log/?qt=range&q=b310378e..6aaae44d>.
The skipped commits did not show the blue arrow at all.


The steps I followed were:

(4.1) Open referenced file from the command line.

(4.2) Search for "Other".  Document goes to page 8.  Note that step 2
      in the bug description says go to page 7.

(4.3) Type "<Esc>" to close search bar.

(4.4) Click on the blue arrow.  Program displays grab-handles around
      the blue arrow.

(4.5) Type "<delete>"

(4.6) Type "<ctrl>+Z".  Program displays grab-handles but not the
      arrow.

(4.7) Drag the left-side grab-handle to the left.  Program displays
      blue arrow growing to the left.

(4.8) Drop the drag-handle.  Program crashes.

Backtraces from 64-7.1 master, 64-6.3 master and the earliest bad
version which showed the blue arrow include lines like:

    #12 0x00007fae62741840 in <signal handler called> () at /lib/x86_64-linux-gnu/libc.so.6

    #13 0x00007fae4607e175 in SwDoc::ChgAnchor(SdrMarkList const&, RndStdIds, bool, bool) () at /home/terry/lo_hacking/bibisect/bibisect-linux-64-6.3/instdir/program/../program/libswlo.so


I am removing keyword requestBibisect and adding haveBibisect.
Comment 5 Terrence Enger 2020-07-22 02:38:24 UTC
Created attachment 163390 [details]
backtrace from master on Linux

This backtrace arises from the same user actions as comment 4, using a
local build of commit 0d45380c (2020-07-17), built and running on
debian-buster, configured:

    --with-vendor=Terrence Enger
    --with-jdk-home=/usr/lib/jvm/default-java
    --enable-split-debug
    --enable-gdb-index
    --enable-ld=gold
    --enable-option-checking=fatal
    #--enable-dbgutil
    --enable-debug
    --without-system-postgresql
    --without-myspell-dicts
    --with-extra-buildid
    --without-doxygen
    --with-external-tar=/home/terry/lo_hacking/git/src
    --without-package-format

Conspicuous in the backtrace is "this=0x0":

    #13 0x00007fae0c78a840 in <signal handler called> () at /lib/x86_64-linux-gnu/libc.so.6

    #14 0x00007fadf1dde42a in SwFrame::IsVertical() const (this=0x0) at /home/terry/lo_hacking/git/libo6/sw/source/core/inc/frame.hxx:953


This may not be the same crash that Telesto reported or the same crash
that I reported bibisected in comment 4, but based on the sameness of
user actions I am assigning keyword haveBacktrace.
Comment 6 Telesto 2020-07-22 07:25:47 UTC
Another red lining crash. FWIW, the bug doc is recycled. And there are quite a bunch of crashes. So maybe the root cause being elsewhere.

See see also bug 134746 and Xisco reported also a few
Comment 7 Xisco Faulí 2020-07-22 21:27:48 UTC
Let's adjust the importance a bit. Seems to be more like a corner case than an easy to reproduce crash
Comment 8 Michael Stahl (CIB) 2020-08-25 14:55:32 UTC
can't reproduce on master
Comment 9 Telesto 2020-08-25 15:24:25 UTC
(In reply to Michael Stahl (CIB) from comment #8)
> can't reproduce on master

Confirm, working fine
Version: 7.1.0.0.alpha0+ (x64)
Build ID: 8700bace8c0714d853f5df6918ab9c8bb3d81f77
CPU threads: 4; OS: Windows 6.3 Build 9600; UI render: Skia/Raster; VCL: win
Locale: nl-NL (nl_NL); UI: en-US
Calc: CL
Comment 10 Telesto 2020-08-25 15:31:12 UTC
Sorry; played a bit with the file.. and found the issue again :-)

1. Open the attached file
2. CTRL+A
3. CTRL+Backspace Delete or X
4. Arrow & table remains
5. Select the arrow shape
6. Delete
7. Press Undo
8. Resize the arrow -> Crash
Comment 11 Commit Notification 2020-08-31 10:42:40 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/586750da40c5b332d2442ef24ae121795e88e903

tdf#135001 sw_redlinehide: fix IsShown() for AT_PARA flys

It will be available in 7.1.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 12 Commit Notification 2020-08-31 13:42:37 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-7-0":

https://git.libreoffice.org/core/commit/139ce6588a2980e52df9a106a254c16e6f27ea8d

tdf#135001 sw_redlinehide: fix IsShown() for AT_PARA flys

It will be available in 7.0.2.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 13 Michael Stahl (CIB) 2020-08-31 14:50:33 UTC
*** Bug 135963 has been marked as a duplicate of this bug. ***
Comment 14 Michael Stahl (CIB) 2020-08-31 14:55:59 UTC
comment #10 is fixed now on master.


bibisect on linux-64-7.1 says this fixed the description:

commit f3cb59c46398b3a0646b8b374d5626f715fa6884
Author:     Michael Stahl <Michael.Stahl@cib.de>
AuthorDate: Tue Aug 11 17:54:09 2020 +0200

    tdf#134746 sw: fix redline hiding of at-char fly on empty paragraphs
    
    If a merged paragraph has no extents, a fly anchored at the start or at
    the end should be shown.
    
    (regression from 28b77c89dfcafae82cf2a6d85731b643ff9290e5)
Comment 15 Commit Notification 2020-08-31 19:59:07 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-6-4":

https://git.libreoffice.org/core/commit/56db540f6b97cb7616e68308355e7930d3d64539

tdf#135001 sw_redlinehide: fix IsShown() for AT_PARA flys

It will be available in 6.4.7.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.