Bug 141610 - Libreoffice crashes, if a shape with textbox inside is anchored to a frame
Summary: Libreoffice crashes, if a shape with textbox inside is anchored to a frame
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
7.1.2.2 release
Hardware: All All
: medium critical
Assignee: Not Assigned
URL:
Whiteboard:
Keywords: bibisected, bisected, regression
Depends on:
Blocks: Frame Shape-Textbox Crash
  Show dependency tree / graph
 
Reported: 2021-04-10 17:56 UTC by Matheod
Modified: 2024-01-08 22:54 UTC (History)
7 users (show)

See Also:
Crash report or crash signature: ["cppuhelper3MSC.dll","GetFrameOfModify(SwRootFrame const*, sw::BroadcastingModify const&, SwFrameType, SwPosition const*, std::pair<Point, bool> const*)"]

Attachments
This is the backup file (generated when libreoffice crashed). If you try to open it libreoffice will crash. (10.47 KB, application/vnd.oasis.opendocument.text)
2021-04-10 17:58 UTC, Matheod 		Details
This is the file before action making it crash. You need to create a frame, move an arrow in the frame, and set it anchor to frame (10.10 KB, application/vnd.oasis.opendocument.text)
2021-04-10 17:59 UTC, Matheod 		Details
Bibisect log (2.90 KB, text/plain)
2022-05-02 09:45 UTC, Telesto 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Matheod 2021-04-10 17:56:24 UTC 
This bug was filed from the crash reporting server and is br-a137d82d-7ae0-4c1c-8662-13848741ccdb.
=========================================

Libreoffice crashed when I try to set the anchor of an arrow form to a frame.

The bug is reproductible. The backup file make libreoffice crash.
Comment 1 Matheod 2021-04-10 17:58:06 UTC 
Created attachment 171086 [details]
This is the backup file (generated when libreoffice crashed). If you try to open it libreoffice will crash.
Comment 2 Matheod 2021-04-10 17:59:03 UTC 
Created attachment 171087 [details]
This is the file before action making it crash. You need to create a frame, move an arrow in the frame, and set it anchor to frame
Comment 3 Dieter 2021-04-25 05:56:17 UTC 
I confirm it with

Version: 7.1.3.1 (x64) / LibreOffice Community
Build ID: fa76d07d7006a0e2866c3247cef2d5eb55ae8369
CPU threads: 4; OS: Windows 10.0 Build 19042; UI render: Skia/Raster; VCL: win
Locale: de-DE (de_DE); UI: en-GB
Calc: CL

I can only confirm it with the arrows in your document. If I create an new arrow with Insert > Shapes > Block Arrows > Down Arrow and anchor it to the frame, LO doesn't crash. I also notice a little grey dot, if I select one of your arrows. So could you please describe how you've created thoses arrows.
Comment 4 Matheod 2021-04-25 11:43:14 UTC 
(In reply to Dieter from comment #3)
> I confirm it with
> 
> Version: 7.1.3.1 (x64) / LibreOffice Community
> Build ID: fa76d07d7006a0e2866c3247cef2d5eb55ae8369
> CPU threads: 4; OS: Windows 10.0 Build 19042; UI render: Skia/Raster; VCL:
> win
> Locale: de-DE (de_DE); UI: en-GB
> Calc: CL
> 
> I can only confirm it with the arrows in your document. If I create an new
> arrow with Insert > Shapes > Block Arrows > Down Arrow and anchor it to the
> frame, LO doesn't crash. I also notice a little grey dot, if I select one of
> your arrows. So could you please describe how you've created thoses arrows.

Hum sorry it beens to long ago. As far I remember I created the arrow with the toolbar, not the menu.

But when I create the arrow with Insert > Shapes > Block arrows > Down Arrow I also have the little grey dot when I select the arrow. However, I tested with this newly create arrow and it doesn't crash.

I also noticed that on my old arrow there was a strange rectangle at the right when you zoom in.
Comment 5 Matheod 2021-04-25 11:49:50 UTC 
More testing :

I remmbered that I also renamed the arrow : tried to do that with a new arrow : no issue

I also tried to set my new arrow anchored to character, with a red background and white border : no issue

I tried to add text (double click then type on keyboard) to the arrow and noticed that they didn't behavied the same.
On the new arrow the text will display fully but with the crash arrow only the first character will show. Also if you try to select the text, you will have the option to choose the style of the text (title, quotation, etc.) but you will not have this for the new arrow.
Comment 6 Matheod 2021-04-25 11:55:28 UTC 
Found the culprit !

You have to add the text by right clicking on the arrow and selecting "Add a text area".

Then the arrow will crash (and the arrow will also have the rectangle glitch and the cropped text bug).

So there is porbably multiple bug hidden behind this one, starting with why double cliking and typing doesn't do the same as right cliking and selecting add a text area.

So here the step to reproduce the bug from scratch :

- Create a new file
- Add a frame
- Add an arrow
- Right click on the arrow and select add a text area
- move the arrow inside the frame
- Right click the arrow and set it to anchor to the frame
Comment 7 Dieter 2021-04-27 14:47:04 UTC 
(In reply to Matheod from comment #6)
> So here the step to reproduce the bug from scratch :
> 
> - Create a new file
> - Add a frame
> - Add an arrow
> - Right click on the arrow and select add a text area
> - move the arrow inside the frame
> - Right click the arrow and set it to anchor to the frame

Yes I can reproduce it with those steps
Comment 8 sdc.blanco 2022-04-24 13:41:20 UTC 
1. New document
2. Insert interactive frame
3. Insert shape in frame 
4. Right-click shape, anchor to frame
5. Right-click shape, add textbox

(reproducible) Crash

Version: 7.4.0.0.alpha0+ (x64) / LibreOffice Community
Build ID: f8e11c6480ff0005715b989a6d4e2e10a3816cf6
CPU threads: 8; OS: Windows 10.0 Build 19043; UI render: Skia/Raster; VCL: win
Locale: en-US (da_DK); UI: en-US
Calc: CL
Comment 9 sdc.blanco 2022-04-24 13:45:51 UTC 
Here is crash report for same STR as comment 8:

https://crashreport.libreoffice.org/stats/crash_details/59a28d8d-85f1-4c57-83c4-10f670b95b2f

Version: 7.2.6.2 (x64) / LibreOffice Community
Build ID: b0ec3a565991f7569a5a7f5d24fed7f52653d754
CPU threads: 8; OS: Windows 10.0 Build 19043; UI render: Skia/Raster; VCL: win
Locale: da-DK (da_DK); UI: en-US
Calc: threaded
Comment 10 sdc.blanco 2022-04-24 13:55:53 UTC 
Alternate STR.

1. Make shape with added textbox.
2. Make frame.
3. Anchor shape "to frame" 

Crash in 7.4.0.0.alpha0+
Comment 11 Telesto 2022-04-24 19:33:13 UTC 
(In reply to sdc.blanco from comment #8)
> 1. New document
> 2. Insert interactive frame
> 3. Insert shape in frame 
> 4. Right-click shape, anchor to frame
> 5. Right-click shape, add textbox
> 
> (reproducible) Crash
> 
Crash with
7.1

not crash with
Version: 7.0.0.0.beta1+ (x64)
Build ID: 2891e91a513520d68ea2b8c59c14335861a15253
CPU threads: 4; OS: Windows 6.3 Build 9600; UI render: Skia/Raster; VCL: win
Locale: en-US (nl_NL); UI: en-US
Calc: CL
Comment 12 Martin Srdoš 2022-04-29 21:00:06 UTC 
There is two different behaviour of the crashing. First is that program crash exactly in the time if I create the text box. Second is that after create the textbox is everything ok, but the program crash after close.

I have bisected that like bug is both behaviours.
 e7f029b7ca96f76183c6cf05a09ecca046d996f9 is the first bad commit
commit e7f029b7ca96f76183c6cf05a09ecca046d996f9
Author: Norbert Thiebaud <nthiebaud@gmail.com>
Date:   Thu Jun 11 07:08:11 2020 -0700

I have forgotten how to search the person, who made the commit. Someone can help?
Comment 14 Stephan Bergmann 2022-05-02 07:37:48 UTC 
(In reply to Martin Srdoš from comment #12)
> I have bisected that like bug is both behaviours.
>  e7f029b7ca96f76183c6cf05a09ecca046d996f9 is the first bad commit
> commit e7f029b7ca96f76183c6cf05a09ecca046d996f9
> Author: Norbert Thiebaud <nthiebaud@gmail.com>
> Date:   Thu Jun 11 07:08:11 2020 -0700

Please state the bibisect repo that you used.
Comment 15 Martin Srdoš 2022-05-02 07:45:18 UTC 
(In reply to Stephan Bergmann from comment #14)
> (In reply to Martin Srdoš from comment #12)
> > I have bisected that like bug is both behaviours.
> >  e7f029b7ca96f76183c6cf05a09ecca046d996f9 is the first bad commit
> > commit e7f029b7ca96f76183c6cf05a09ecca046d996f9
> > Author: Norbert Thiebaud <nthiebaud@gmail.com>
> > Date:   Thu Jun 11 07:08:11 2020 -0700
> 
> Please state the bibisect repo that you used.

win64-7.1
Comment 16 Stephan Bergmann 2022-05-02 09:14:30 UTC 
(In reply to Martin Srdoš from comment #13)
> Update:
> 
> Result of bisection is: e7f029b7ca96f76183c6cf05a09ecca046d996f9 is the
> first bad commit
> commit e7f029b7ca96f76183c6cf05a09ecca046d996f9
> Author: Norbert Thiebaud <nthiebaud@gmail.com>
> Date:   Thu Jun 11 07:08:11 2020 -0700
> 
>     source b5cb211f80fd87c109633232cf340ac7969c8648
> 
>     source b5cb211f80fd87c109633232cf340ac7969c8648
>     source ac411c83c82babb325e2bfd32f4e7009e86eac78
>     source 345cb192f0bc2fef97ae52ade48efc2d8591a165
>     source 2126215fb3b2e77145cbf7f1d8e93ee3cca761b3
>     source 430a89fa4876a1ba4057f47c87d7882f11dc66b3
>     source 2695951b7bc178fdbcdce174762343bc4b691a33
>     source f30e4981248f1ebc37728f5848773f730f14ea56
>     source 6e77dcd9d2605e55b57d0a379d87cdd2c48b62f4
>     source ddd9b1bccd87c6913ba4576da8af2d59daf106e9
>     source b2b234269b13d5dfd8e7123a25d282d88fee33a0
>     ...
> 
> In the result is more than 7 hundred lines...
> 
> I am adding Stephan Bergmann to CC list <sbergman@redhat.com>

That win64-7.1 bibisect commit unfortunately covers 388 source commits, see `git log 1aa9a2ac5341d457bbdc00b987285203d11333f1^..b5cb211f80fd87c109633232cf340ac7969c8648` in the core repo.  The topmost one happens to be by me, but its hard to tell which of the 388 commits is the actual culprit here.
Comment 17 Stephan Bergmann 2022-05-02 09:22:29 UTC 
[removed keyword "bisected", which had presumably been added in error]
Comment 18 Telesto 2022-05-02 09:31:22 UTC 
My guess would be 06e2cbb31d0ea703df872b91eb8eacdcaced7653
But it's likely better to do a bibisect with Linux bibisect repro to confirm
Comment 19 Telesto 2022-05-02 09:45:05 UTC 
Created attachment 179888 [details]
Bibisect log

Bisected to:
author	Attila Bakos (NISZ) <bakos.attilakaroly@nisz.hu>	2021-02-22 14:28:59 +0100
committer	Xisco Fauli <xiscofauli@libreoffice.org>	2021-03-02 12:14:28 +0100
commit 6edeb6a8209a990e83f07c02753d606226f59be7 (patch)
tree 7fe435fb78a6db03782b3ab75280433bc65e7f57
parent e941720d5c3e6a555c2405d5f8d9de6c37150e27 (diff)
tdf#140158 tdf#138598 tdf#140598 sw: fix sync of AS_CHAR textboxes
Textboxes anchored "As Character" fell apart, when
typing before some characters or inserting a page break.

By fixing that, the tdf#138598 bug also have fixed which
was a regression from commit b6850bbe95418ecfde404be1696548f18d200c9b
(tdf#106153 sw compatibility: fix textboxes exceeding the page).

In addition, tdf140598 is also fixed, which was
a regression from commit c96c386c5db45dc4d5e358915caad7474e373068
(tdf#136516 add positioning to SwTextBoxHelper::syncProperty()).
Comment 20 Telesto 2022-05-02 09:46:15 UTC 
Adding CC: to Attila Bakos
Comment 21 Stéphane Guillou (stragu) 2023-10-31 05:39:47 UTC 
Updating version and OS fields according to comments and bibisection.

Repro with comment 8 steps in:

Version: 7.2.0.4 / LibreOffice Community
Build ID: 9a9c6381e3f7a62afc1329bd359cc48accb6435b
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: threaded

https://crashreport.libreoffice.org/stats/crash_details/b3e2b998-317d-4074-9fc2-2200962b5c44
Crash signature: GetFrameOfModify(SwRootFrame const*, sw::BroadcastingModify const&, SwFrameType, SwPosition const*, std::pair<Point, bool> const*)
(same as bug 155917)

Still crashes in recent trunk build:

Version: 24.2.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 31fb3045dabdb27d913712f3abcade315e3ea9bd
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: threaded