Bug 137869 - Crash after undo they modifications made by track & changes (document comparison)
Summary: Crash after undo they modifications made by track & changes (document compari...
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
7.1.0.0.alpha0+
Hardware: All All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks: Crash
  Show dependency treegraph
 
Reported: 2020-10-30 07:44 UTC by Telesto
Modified: 2021-07-09 19:43 UTC (History)
3 users (show)

See Also:
Crash report or crash signature:


Attachments
Example file (48.98 KB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2020-10-30 10:37 UTC, Telesto
Details
backtrace from assertion (15.69 KB, text/plain)
2020-11-02 21:06 UTC, Terrence Enger
Details
DOCX (49.00 KB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2021-07-07 17:12 UTC, Telesto
Details
ODT (45.72 KB, application/vnd.oasis.opendocument.text)
2021-07-07 17:14 UTC, Telesto
Details
backtrace on linux (11.28 KB, text/plain)
2021-07-09 18:23 UTC, Terrence Enger
Details
bibisect in linux-64-6.1, tail of terminal output (3.13 KB, text/plain)
2021-07-09 19:42 UTC, Terrence Enger
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Telesto 2020-10-30 07:44:35 UTC
Description:
Crash after undo they modifications made by track & changes (document comparison)

Steps to Reproduce:
1. Download attachment 166847 [details]
2. Open the attached file (export of attachment 166847 [details] to DOCX)
3. Edit -> Track changes -> Compare Document -> Select the ODT
4. Accept all or reject all (maybe 2 different bugs?)
5. CTRL+Z everything -> crash

Probably to many undo-steps

Actual Results:
Crash

Expected Results:
No crash


Reproducible: Always


User Profile Reset: No



Additional Info:
Version: 7.1.0.0.alpha0+ (x64)
Build ID: 94e6e140491de31c0788c91af855a75a3bb12709
CPU threads: 4; OS: Windows 6.3 Build 9600; UI render: Skia/Raster; VCL: win
Locale: nl-NL (nl_NL); UI: en-US
Calc: CL
Comment 1 Telesto 2020-10-30 07:45:37 UTC
No crash in
Version: 5.4.0.0.alpha1+
Build ID: 9feb7f7039a3b59974cbf266922177e961a52dd1
CPU threads: 4; OS: Windows 6.29; UI render: GL; 
Locale: nl-NL (nl_NL); Calc: CL
Comment 2 Xisco Faulí 2020-10-30 09:56:44 UTC
no attached file
Comment 3 Telesto 2020-10-30 10:37:56 UTC
Created attachment 166870 [details]
Example file
Comment 4 Telesto 2020-10-30 10:39:06 UTC
(In reply to Xisco Faulí from comment #2)
> no attached file

It's always the same :-(
Comment 5 Terrence Enger 2020-11-02 21:06:52 UTC
Created attachment 166955 [details]
backtrace from assertion

At the end of step 3., my LO crashes with message (rewrapped):

    soffice.bin:
        /home/terry/lo_hacking/git/libo6/sw/source/core/bastyp/index.cxx:234:
        virtual SwIndexReg::~SwIndexReg():
        Assertion `!m_pFirst && !m_pLast && "There are still indices
        registered"' failed.

This is in a local build of commit fbd6d6cc (2020-10-30), configured
with --enable-debug , built and running on debian-buster.  I suspect
that my LO is crashing earlier in STR because of --enable-debug.

I have found two bugs already reporting the same assertion:
  - bug 126539, upon reject changes.  
  - bug 130699, upon other undo/redo.
Five or six of frames leading up to the assertion in the backtraces attached to those bugs match function names with my backtrace.
Comment 6 Kevin Suo 2020-11-05 15:51:44 UTC
No crash for me on Fedora 32, either build id 94e6e140491de31c0788c91af855a75a3bb12709 or today's master.
Comment 7 Xisco Faulí 2021-07-07 10:52:22 UTC
Hello Telesto,
Could you please try to reproduce it with a master build from http://dev-builds.libreoffice.org/daily/master/ ?
You can install it alongside the standard version.
I have set the bug's status to 'NEEDINFO'. Please change it back to 'UNCONFIRMED' if the bug is still present in the master build
Comment 8 Telesto 2021-07-07 17:12:37 UTC
Created attachment 173421 [details]
DOCX
Comment 9 Telesto 2021-07-07 17:14:45 UTC
Created attachment 173422 [details]
ODT

1. Open the DOCX attachment
2. Edit -> Track Changes -> Compare document
3. Pick the ODT
4. Edit -> Track Changes -> Manage
5. Reject all
6. Press and hold CTRL+Z -> Crash or freeze
Comment 10 Telesto 2021-07-07 17:15:05 UTC
Version: 7.3.0.0.alpha0+ (x64) / LibreOffice Community
Build ID: bd2f2273d83dcca43eb6b465308707efd45e7adf
CPU threads: 4; OS: Windows 6.3 Build 9600; UI render: Skia/Raster; VCL: win
Locale: nl-NL (nl_NL); UI: en-US
Calc: CL
Comment 11 Terrence Enger 2021-07-09 18:23:42 UTC
Created attachment 173478 [details]
backtrace on linux

The interesting part of the backtrace starts at frame #18, where
idx==778, m_nSize==778.

In a local --enable-debug --enable-dbgutil build of commit d95e400b
(2021-06-18), built and running on debian-buster, using the STR from
the bug description, I see a crash in step 5 after the second
<ctrl>+Z.

Final terminal messages are (rewrapped):

    warn:legacy.osl:22417:22417:sw/source/core/access/acccontext.cxx:445:
        fire event for disposed frame?
    warn:legacy.osl:22417:22417:sw/source/core/layout/anchoredobject.cxx:569:
        <SwAnchoredObject::GetObjRectWithSpaces> - cache for object
        rectangle inclusive spaces marked as valid, but it couldn't
        be. Missing invalidation of cache.
    warn:sw.core:22417:22417:sw/source/core/docnode/node.cxx:1980:
        Wrong cond collection, skipping check of Cond Colls.
    warn:sw.core:22417:22417:sw/source/core/docnode/node.cxx:1980:
        Wrong cond collection, skipping check of Cond Colls.
    warn:legacy.osl:22417:22417:sw/source/core/access/acccontext.cxx:445:
        fire event for disposed frame?
    warn:legacy.osl:22417:22417:sw/source/core/access/acccontext.cxx:445:
        fire event for disposed frame?
    soffice.bin:
        /home/terry/lo_hacking/git/libo6/sw/source/core/bastyp/bparr.cxx:84:
        BigPtrEntry* BigPtrArray::operator[](sal_uLong) const:
        Assertion `idx < m_nSize' failed.
    Unspecified Application Error

I am setting status NEW.
Comment 12 Terrence Enger 2021-07-09 19:42:59 UTC
Created attachment 173479 [details]
bibisect in linux-64-6.1, tail of terminal output

Working in bibisect-linux-64-6.1 on debian buster, I see:

          commit    s-h       date
          --------  --------  -------------------
    good  e3c3da3d  6aa9f098  2019-01-15 17:13:04
    bad   8e8eab51  736a3841  2019-01-15 18:01:57

and commit message starting :

    commit 736a38419f49d4b96bd845f5767a028df59e4cff
    Author:     Serge Krot <Serge.Krot@cib.de>
    AuthorDate: Thu Dec 6 19:11:58 2018 +0100
    Commit:     Michael Stahl <Michael.Stahl@cib.de>
    CommitDate: Tue Jan 15 19:01:57 2019 +0100

        sw: DOCX: recognize TOC title during import

I am removing keyword bibsectRequest and add keywords bibisected,
bisected.