Bug 135098 - Writer crashes when merging horizontally cells in a table (GTK3)
Summary: Writer crashes when merging horizontally cells in a table (GTK3)
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
5.0 all versions
Hardware: All Linux (All)
: medium critical
Assignee: Caolán McNamara
URL:
Whiteboard: target:7.1.0 target:7.0.1 target:6.4.7
Keywords: bibisectRequest, haveBacktrace, regression
: 122844 (view as bug list)
Depends on:
Blocks: gtk3-whipping-boy
  Show dependency treegraph
 
Reported: 2020-07-24 12:17 UTC by Aleksandr
Modified: 2020-08-10 09:57 UTC (History)
4 users (show)

See Also:
Crash report or crash signature: ["SwTableBox::GetSttIdx"]


Attachments
Sample document (23.83 KB, application/vnd.oasis.opendocument.text)
2020-07-24 12:24 UTC, Xisco Faulí
Details
backtrace (10.36 KB, text/x-log)
2020-08-02 14:10 UTC, Caolán McNamara
Details
gdbtrace with the patch included (7.60 KB, text/plain)
2020-08-03 10:28 UTC, Xisco Faulí
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Aleksandr 2020-07-24 12:17:08 UTC
Description:
I have an .odt file with long table of 2 columns. That have blocks of 2 cells in right column and merged vertically 2 left cells. Sometimes I need to separate these blocks with a single cell (merge 2 cells horizontally). When  I do it, it always crashes. I have merged cells after restart and document recovering.
|-----------------|
|-----------------|
| 1|--------------|
|-----------------|
| 2|--------------|
|-----------------|
| 3|--------------|
|-----------------|
|-----------------|

Steps to Reproduce:
1. Download .odt file: https://yadi.sk/i/n2yWOx29EOgNhw
2. Find text "ADD ROW BELOW AND MERGE THE CELLS OF IT HORISONTALLY" on second page.
3. Try to do it.

Actual Results:
Crash

Expected Results:
Cells must be merged horizontally


Reproducible: Always


User Profile Reset: No


OpenGL enabled: Yes

Additional Info:
Версия: 6.4.4.2
ID сборки: 1:6.4.4-0ubuntu0.20.04.1
Потоков ЦП: 8; ОС: Linux 5.4; Отрисовка ИП: по умолчанию; VCL: gtk3; 
Локаль: ru-RU (ru_RU.UTF-8); Язык интерфейса: ru-RU
Calc: threaded
Comment 1 Xisco Faulí 2020-07-24 12:24:12 UTC
Created attachment 163479 [details]
Sample document
Comment 2 Xisco Faulí 2020-07-24 12:25:51 UTC
Reproduced in

Version: 7.1.0.0.alpha0+
Build ID: d8270636a57e7dc68ede51308c380e2098f765d7
CPU threads: 4; OS: Linux 4.19; UI render: default; VCL: gtk3
Locale: en-US (en_US.UTF-8); UI: en-US
Calc: threaded
Comment 3 Xisco Faulí 2020-07-24 12:57:43 UTC
this is a regression. I tried to bisect it with bibisect-50max on linux but the output is not accurate.

@Ilmari, if you have a chance, could you please try give it a try on Win ?
Comment 4 Telesto 2020-07-24 14:43:49 UTC
I'm not noticing any crash.. 
Version: 7.1.0.0.alpha0+ (x64)
Build ID: <buildversion>
CPU threads: 4; OS: Windows 6.3 Build 9600; UI render: Skia/Raster; VCL: win
Locale: nl-NL (nl_NL); UI: en-US
Calc: CL

Is there a screencast?
Comment 5 Telesto 2020-07-24 19:54:01 UTC
No crash with
Version: 7.0.0.2
Build ID: c01aa64b6c3d89ebe5fe69c28c7adb24eb85249c
CPU threads: 4; OS: Mac OS X 10.12.6; UI render: default; VCL: osx
Locale: nl-NL (nl_NL.UTF-8); UI: en-US
Calc: threaded
Comment 6 Buovjaga 2020-08-01 17:30:02 UTC
No repro on Win. On Linux, only gtk3 crashes.
Comment 7 Caolán McNamara 2020-08-02 14:10:31 UTC
Created attachment 163882 [details]
backtrace
Comment 8 Caolán McNamara 2020-08-02 14:11:47 UTC
its an a11y issue rather than a specific gtk one as far as I can see
Comment 9 Caolán McNamara 2020-08-02 14:25:56 UTC
https://gerrit.libreoffice.org/c/core/+/99956 makes what I see not crash
Comment 10 Commit Notification 2020-08-02 15:14:34 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/9445a5633b167c84eb96c515f3ae765ab427442a

tdf#135098 assert/crash on checking IsSelected on cell being disposed

It will be available in 7.1.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 11 Caolán McNamara 2020-08-02 15:49:41 UTC
fixed the assert I saw to master, with backport to 7-0 in gerrit
Comment 12 Buovjaga 2020-08-02 18:27:54 UTC
Verified, thanks!

Arch Linux 64-bit
Version: 7.1.0.0.alpha0+
Build ID: 94811eac3bd3077b60029c52d7798bca9b3c877b
CPU threads: 8; OS: Linux 5.7; UI render: default; VCL: gtk3
Locale: fi-FI (fi_FI.UTF-8); UI: en-US
Calc: threaded
Built on 2 August 2020
Comment 13 Commit Notification 2020-08-03 04:38:39 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-7-0":

https://git.libreoffice.org/core/commit/48f48eea8a57d0da9defae77d9fc51dfe84bcfca

tdf#135098 assert/crash on checking IsSelected on cell being disposed

It will be available in 7.0.1.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 14 Xisco Faulí 2020-08-03 10:14:28 UTC
Still crashing for me in

Version: 7.1.0.0.alpha0+
Build ID: 32090b018d9ff81659a4c9ed41c64109ebebe4fc
CPU threads: 4; OS: Linux 4.19; UI render: default; VCL: gtk3
Locale: en-US (en_US.UTF-8); UI: en-US
Calc: threaded

(bisect repository)
Comment 15 Xisco Faulí 2020-08-03 10:28:58 UTC
Created attachment 163897 [details]
gdbtrace with the patch included
Comment 16 Xisco Faulí 2020-08-03 10:39:20 UTC
The new backtrace ( SwTableBox::GetSttIdx ) seems to be the same as in bug 122844
Comment 17 Caolán McNamara 2020-08-05 15:30:54 UTC
there's only one line of bt though, but it does look similar
Comment 18 Caolán McNamara 2020-08-05 20:27:00 UTC
I have high hopes that https://gerrit.libreoffice.org/c/core/+/100186 fixed this and maybe bug #122844 too (untested for that case)
Comment 19 Xisco Faulí 2020-08-06 08:13:35 UTC
(In reply to Caolán McNamara from comment #18)
> I have high hopes that https://gerrit.libreoffice.org/c/core/+/100186 fixed
> this and maybe bug #122844 too (untested for that case)

I do confirm the patch fixes the issue for me. OTOH, your previous patch < 9445a5633b167c84eb96c515f3ae765ab427442a > fixes bug 122844 for me...
Comment 20 Xisco Faulí 2020-08-06 08:21:17 UTC
*** Bug 122844 has been marked as a duplicate of this bug. ***
Comment 21 Commit Notification 2020-08-06 08:47:55 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/818511e32f41bdf873bb660ec67bc82e4a27e847

tdf#135098 update SwTableCursor m_SelectedBoxes before merge

It will be available in 7.1.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 22 Caolán McNamara 2020-08-06 08:53:01 UTC
that seems to do the right thing, fixed in master and backports to 7-0 and 6-4 in gerrit
Comment 23 Xisco Faulí 2020-08-10 09:54:10 UTC
Verified in

Version: 7.1.0.0.alpha0+
Build ID: 6ad2f463784a24c566477cdd60ae729651bb8564
CPU threads: 4; OS: Linux 4.19; UI render: default; VCL: gtk3
Locale: en-US (en_US.UTF-8); UI: en-US
Calc: threaded

@Caolán, thanks for fixing this issue!!
Comment 24 Commit Notification 2020-08-10 09:56:28 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-7-0":

https://git.libreoffice.org/core/commit/1bef764ac84d113a0bcb237a0634579ee8dccec0

tdf#135098 update SwTableCursor m_SelectedBoxes before merge

It will be available in 7.0.1.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 25 Commit Notification 2020-08-10 09:57:42 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-6-4":

https://git.libreoffice.org/core/commit/0d5affd7a25396dbff866adae524a4c01329801f

tdf#135098 update SwTableCursor m_SelectedBoxes before merge

It will be available in 6.4.7.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.