Bug 136855 - Crash correcting with spell checker with track & changes enabled
Summary: Crash correcting with spell checker with track & changes enabled
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
7.1.0.0.alpha0+
Hardware: All All
: high normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords: bibisected, bisected, regression
Depends on:
Blocks:
 
Reported: 2020-09-17 19:08 UTC by Telesto
Modified: 2021-02-12 07:36 UTC (History)
3 users (show)

See Also:
Crash report or crash signature:


Attachments
Example file (21.40 KB, application/vnd.oasis.opendocument.text)
2020-09-17 19:08 UTC, Telesto
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Telesto 2020-09-17 19:08:12 UTC
Description:
Crash correcting with spell checker with track & changes enabled

Steps to Reproduce:
1. open the attached file
2. Press F7
3. Press correct 3x -> Crash

Actual Results:
Crash

Expected Results:
No crash


Reproducible: Always


User Profile Reset: No



Additional Info:
Found in
7.1

No issue with
Version: 6.0.6.0.0+
Build ID: c30963b8b4bbbe42a24b97aafa161eff9d7ccdd4
CPU threads: 4; OS: Windows 6.3; UI render: default; 
Locale: nl-NL (nl_NL); Calc: CL
Comment 1 Telesto 2020-09-17 19:08:24 UTC
Created attachment 165640 [details]
Example file
Comment 2 raal 2020-09-18 07:49:20 UTC
Confirm with 7.1, bibisect later
Comment 3 raal 2020-09-18 15:21:25 UTC
fcec330127a944b8c51bf115a90b4378bbc0bcc8 is the first bad commit
commit fcec330127a944b8c51bf115a90b4378bbc0bcc8
Author: Norbert Thiebaud <nthiebaud@gmail.com>
Date:   Fri Jun 12 08:11:49 2020 -0700

    source sha:e1629c210ad78310e3d48c0756723134a27b89df

https://gerrit.libreoffice.org/c/core/+/96201
Adding CC to: Michael Stahl
Comment 4 Commit Notification 2020-09-21 08:48:34 UTC Comment hidden (off-topic)
Comment 5 Michael Stahl (allotropia) 2020-09-21 08:50:32 UTC Comment hidden (obsolete)
Comment 6 Xisco Faulí 2021-02-09 14:12:59 UTC
Dear Michael Stahl,
This bug has been in ASSIGNED status for more than 3 months without any
activity. Resetting it to NEW.
Please assign it back to yourself if you're still working on this.
Comment 7 Justin L 2021-02-12 07:36:27 UTC
This looks pretty serious to me. Increasing importance. A pTextNd is assumed in sw/source/core/doc/DocumentContentOperationsManager.cxx:4331.
                pTextNd->GetParaAttr( aSet, nStt+1, nStt+1 );


warn:DEBUG::sw/source/core/doc/DocumentContentOperationsManager.cxx:4331: pTextNd[0] start[0] Repl[xxxix]

#0  0x00007fffbd9b886a in std::__shared_ptr<SfxItemSet const, (__gnu_cxx::_Lock_policy)2>::operator bool() const (this=0x150) at /usr/include/c++/9/bits/shared_ptr_base.h:1313
#1  0x00007fffbd9b7094 in SwContentNode::GetSwAttrSet() const (this=0x0) at libreoffice2/sw/inc/node.hxx:719
#2  0x00007fffbdeb8c2b in SwContentNode::GetAttr(SfxItemSet&) const (this=0x0, rSet=SfxItemSet of pool 0x55555a1d2a60 with parent 0x0 and Which ranges: [(1, 55), (151, 151)] = {...})
    at sw/source/core/docnode/node.cxx:1782
#3  0x00007fffbe32571a in sw::GetAttrMerged(SfxItemSet&, SwTextNode const&, SwRootFrame const*) (rFormatSet=SfxItemSet of pool 0x55555a1d2a60 with parent 0x0 and Which ranges: [(1, 55), (151, 151)] = {...}, rNode=..., pLayout=0x0)
    at sw/source/core/text/txtfrm.cxx:370
#4  0x00007fffbe3ffb11 in SwTextNode::GetParaAttr(SfxItemSet&, int, int, bool, bool, bool, SwRootFrame const*) const
    (this=0x0, rSet=SfxItemSet of pool 0x55555a1d2a60 with parent 0x0 and Which ranges: [(1, 55), (151, 151)] = {...}, nStt=1, nEnd=1, bOnlyTextAttr=false, bGetFromChrFormat=true, bMergeIndentValuesOfNumRule=false, pLayout=0x0)
    at sw/source/core/txtnode/thints.cxx:2130
#5  0x00007fffbdd042c8 in sw::DocumentContentOperationsManager::ReplaceRangeImpl(SwPaM&, rtl::OUString const&, bool) (this=0x55555a1f04d0, rPam=SwPaM = {...}, rStr="xxxix", bRegExReplace=false)
    at sw/source/core/doc/DocumentContentOperationsManager.cxx:4332