Bug 136855 - Crash correcting with spell checker with track & changes enabled
Summary: Crash correcting with spell checker with track & changes enabled
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
7.1.0.0.alpha0+
Hardware: All All
: high normal
Assignee: Michael Stahl (allotropia)
URL:
Whiteboard: target:7.4.0 target:7.3.0.0.beta2 tar...
Keywords: bibisected, bisected, regression
Depends on:
Blocks:
 
Reported: 2020-09-17 19:08 UTC by Telesto
Modified: 2021-12-15 12:53 UTC (History)
3 users (show)

See Also:
Crash report or crash signature: ["SwContentNode::GetAttr(SfxItemSet &)"]


Attachments
Example file (21.40 KB, application/vnd.oasis.opendocument.text)
2020-09-17 19:08 UTC, Telesto
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Telesto 2020-09-17 19:08:12 UTC
Description:
Crash correcting with spell checker with track & changes enabled

Steps to Reproduce:
1. open the attached file
2. Press F7
3. Press correct 3x -> Crash

Actual Results:
Crash

Expected Results:
No crash


Reproducible: Always


User Profile Reset: No



Additional Info:
Found in
7.1

No issue with
Version: 6.0.6.0.0+
Build ID: c30963b8b4bbbe42a24b97aafa161eff9d7ccdd4
CPU threads: 4; OS: Windows 6.3; UI render: default; 
Locale: nl-NL (nl_NL); Calc: CL
Comment 1 Telesto 2020-09-17 19:08:24 UTC
Created attachment 165640 [details]
Example file
Comment 2 raal 2020-09-18 07:49:20 UTC
Confirm with 7.1, bibisect later
Comment 3 raal 2020-09-18 15:21:25 UTC
 fcec330127a944b8c51bf115a90b4378bbc0bcc8 is the first bad commit
commit fcec330127a944b8c51bf115a90b4378bbc0bcc8
Author: Norbert Thiebaud <nthiebaud@gmail.com>
Date:   Fri Jun 12 08:11:49 2020 -0700

    source e1629c210ad78310e3d48c0756723134a27b89df

https://gerrit.libreoffice.org/c/core/+/96201
Adding CC to: Michael Stahl
Comment 4 Commit Notification 2020-09-21 08:48:34 UTC Comment hidden (off-topic)
Comment 5 Michael Stahl (allotropia) 2020-09-21 08:50:32 UTC Comment hidden (obsolete)
Comment 6 Xisco Faulí 2021-02-09 14:12:59 UTC
Dear Michael Stahl,
This bug has been in ASSIGNED status for more than 3 months without any
activity. Resetting it to NEW.
Please assign it back to yourself if you're still working on this.
Comment 7 Justin L 2021-02-12 07:36:27 UTC
This looks pretty serious to me. Increasing importance. A pTextNd is assumed in sw/source/core/doc/DocumentContentOperationsManager.cxx:4331.
                pTextNd->GetParaAttr( aSet, nStt+1, nStt+1 );


warn:DEBUG::sw/source/core/doc/DocumentContentOperationsManager.cxx:4331: pTextNd[0] start[0] Repl[xxxix]

#0  0x00007fffbd9b886a in std::__shared_ptr<SfxItemSet const, (__gnu_cxx::_Lock_policy)2>::operator bool() const (this=0x150) at /usr/include/c++/9/bits/shared_ptr_base.h:1313
#1  0x00007fffbd9b7094 in SwContentNode::GetSwAttrSet() const (this=0x0) at libreoffice2/sw/inc/node.hxx:719
#2  0x00007fffbdeb8c2b in SwContentNode::GetAttr(SfxItemSet&) const (this=0x0, rSet=SfxItemSet of pool 0x55555a1d2a60 with parent 0x0 and Which ranges: [(1, 55), (151, 151)] = {...})
    at sw/source/core/docnode/node.cxx:1782
#3  0x00007fffbe32571a in sw::GetAttrMerged(SfxItemSet&, SwTextNode const&, SwRootFrame const*) (rFormatSet=SfxItemSet of pool 0x55555a1d2a60 with parent 0x0 and Which ranges: [(1, 55), (151, 151)] = {...}, rNode=..., pLayout=0x0)
    at sw/source/core/text/txtfrm.cxx:370
#4  0x00007fffbe3ffb11 in SwTextNode::GetParaAttr(SfxItemSet&, int, int, bool, bool, bool, SwRootFrame const*) const
    (this=0x0, rSet=SfxItemSet of pool 0x55555a1d2a60 with parent 0x0 and Which ranges: [(1, 55), (151, 151)] = {...}, nStt=1, nEnd=1, bOnlyTextAttr=false, bGetFromChrFormat=true, bMergeIndentValuesOfNumRule=false, pLayout=0x0)
    at sw/source/core/txtnode/thints.cxx:2130
#5  0x00007fffbdd042c8 in sw::DocumentContentOperationsManager::ReplaceRangeImpl(SwPaM&, rtl::OUString const&, bool) (this=0x55555a1f04d0, rPam=SwPaM = {...}, rStr="xxxix", bRegExReplace=false)
    at sw/source/core/doc/DocumentContentOperationsManager.cxx:4332
Comment 8 Commit Notification 2021-12-14 19:44:28 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/d16c5f47600d236e911ae50d0e58a3f2256f5a61

tdf#136855 sw: fix ReplaceRangeImpl() restoring of rPam

It will be available in 7.4.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 9 Michael Stahl (allotropia) 2021-12-14 19:45:33 UTC
fixed on master
Comment 10 Commit Notification 2021-12-14 21:23:39 UTC
Xisco Fauli committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/cfe7dc2ef91ea119ea54b56e207ef7a77291a9d7

tdf#136855: sw: Add UItest

It will be available in 7.4.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 11 Commit Notification 2021-12-15 07:40:09 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-7-3":

https://git.libreoffice.org/core/commit/a5d4f32e6512acdec6402bd18ff958f07c9d327a

tdf#136855 sw: fix ReplaceRangeImpl() restoring of rPam

It will be available in 7.3.0.0.beta2.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 12 Commit Notification 2021-12-15 07:41:39 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-7-2":

https://git.libreoffice.org/core/commit/6af4500fffe0d0db03b4d4a7e77cf627124aefc1

tdf#136855 sw: fix ReplaceRangeImpl() restoring of rPam

It will be available in 7.2.6.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 13 Commit Notification 2021-12-15 12:53:25 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-7-2-5":

https://git.libreoffice.org/core/commit/f94869d8f0f0271bdf40fc0324f7a3bfa7222370

tdf#136855 sw: fix ReplaceRangeImpl() restoring of rPam

It will be available in 7.2.5.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.