Bug 147199 - CRASH: pasting twice and undoing
Summary: CRASH: pasting twice and undoing
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
7.4.0.0 alpha0+
Hardware: All All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard: target:7.5.0
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2022-02-04 15:19 UTC by Xisco Faulí
Modified: 2022-07-11 06:46 UTC (History)
5 users (show)

See Also:
Crash report or crash signature:


Attachments
sample file (23.31 KB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2022-02-04 15:19 UTC, Xisco Faulí
Details
bt with debug symbols (12.22 KB, text/plain)
2022-02-05 08:43 UTC, Julien Nabet
Details
sample file 2 (1.67 MB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2022-03-02 09:35 UTC, Xisco Faulí
Details
Before crash in 7.3 (287.96 KB, image/jpeg)
2022-05-17 10:24 UTC, Attila Bakos (NISZ)
Details
The second example without crash (1.45 MB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2022-05-17 11:02 UTC, Attila Bakos (NISZ)
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Xisco Faulí 2022-02-04 15:19:02 UTC
Created attachment 178070 [details]
sample file

Steps to reproduce:
1. Open attached document
2. Select all
3. Copy
4. Paste twice
5. Undo Twice

-> Crash

Reproduced in

Version: 7.4.0.0.alpha0+ / LibreOffice Community
Build ID: d5f015185240a7bddfed7ddf10d6b5426e35fb72
CPU threads: 8; OS: Linux 5.10; UI render: default; VCL: gtk3
Locale: es-ES (es_ES.UTF-8); UI: en-US
Calc: threaded
Comment 1 Xisco Faulí 2022-02-04 15:20:15 UTC
Regression introduced by:

https://cgit.freedesktop.org/libreoffice/core/commit/?id=2951cbdf3a6e2b62461665546b47e1d253fcb834

author	Attila Bakos (NISZ) <bakos.attilakaroly@nisz.hu>	2021-11-10 14:10:11 +0100
committer	László Németh <nemeth@numbertext.org>	2022-01-03 14:28:15 +0100
commit 2951cbdf3a6e2b62461665546b47e1d253fcb834 (patch)
tree d09834b7f1e68e7b3664ed03c5d2ed3c73de552d
parent cce57fd94e9335c5dd5f3725a5fe54f5d3929e8d (diff)
tdf#143574 OOXML export/import of textboxes in group shapes

Bisected with: bibisect-linux64-7.4

Adding Cc: to Attila Bakos
Comment 2 Julien Nabet 2022-02-05 08:43:50 UTC
Created attachment 178078 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today, I got a segfault with gtk3 rendering.
Remark: I've got no crash with gen rendering.
Comment 3 Xisco Faulí 2022-02-07 17:40:04 UTC
with gen, you might need to increase the number of pastes and undo, but it also crashes
Comment 4 Attila Bakos (NISZ) 2022-02-16 17:18:00 UTC
Yes, I have an idea about the real problem:
From that commit the text of the group shapes in textframes attached to the shapes like simple shapes.
As-char anchoring (like these shapes anchored) is not implemented in the master, only in gerrit, here: https://gerrit.libreoffice.org/c/core/+/129627 That can cause crash.
But, that fix can be not enough because there is a problem in the writer core, at the content operation manager so the copy of the textframes will have issues (floating tables, textboxes etc what uses swxtextframe all affected) because the frame format of the textbox unable to survive the content operation manager operation. Before i tried to debug it, and i found the problem in https://opengrok.libreoffice.org/xref/core/sw/source/core/doc/DocumentContentOperationsManager.cxx?r=70ac13ee#3768 but there i lost... There can be seen a SwTextBoxHelper::SavedLink aOldTextBoxes; line where the textframes saved in case of simple shapes for later usage when the fly copying finished (if you comment it that also will have issues too). But for group textboxes this is not so easy, because in case of simple shapes the shape texbox pair 1:1, but in case of group shapes this is 1:N, and each textboxes identified by the sdrobject what its belongs to. However during this content operation, the sdrs will be deleted and recreated, so the textboxes lost their connection. That prevent proper copying of group textboxes in case of ctrl+drag, ctrl+c, undoing, etc. I think this cause that issue too where nested floating table conversion causes exception, now these tables imported as simple tables with wrong position. So i think this is a so complex problem, not a simple regression. Thanks to this issue i have to put a condition in the above mentioned commit, where i disabled group textboxes (WPG) in tables, see: https://opengrok.libreoffice.org/xref/core/writerfilter/source/ooxml/OOXMLFastContextHandler.cxx?r=4a38ca40#1712
But i also hope this will be fixed one day too :)
Comment 5 Xisco Faulí 2022-03-02 09:35:09 UTC
Created attachment 178611 [details]
sample file 2

Another file that crashes after https://cgit.freedesktop.org/libreoffice/core/commit/?id=2951cbdf3a6e2b62461665546b47e1d253fcb834

Steps:
1. Select all & copy
2. Paste 3 times
3. Undo 3 times

-> Crash
Comment 6 Attila Bakos (NISZ) 2022-04-20 14:09:42 UTC Comment hidden (obsolete)
Comment 7 Attila Bakos (NISZ) 2022-04-20 14:12:35 UTC Comment hidden (obsolete)
Comment 8 Attila Bakos (NISZ) 2022-04-20 14:22:57 UTC
(In reply to Attila Bakos (NISZ) from comment #7)
> (In reply to Xisco Faulí from comment #5)
> > Created attachment 178611 [details]
> > sample file 2
> > 
> > Another file that crashes after
> > https://cgit.freedesktop.org/libreoffice/core/commit/
> > ?id=2951cbdf3a6e2b62461665546b47e1d253fcb834
> > 
> > Steps:
> > 1. Select all & copy
> > 2. Paste 3 times
> > 3. Undo 3 times
> > 
> > -> Crash
> 
> but this one crashes unfortunately :(

there is an assert:
https://opengrok.libreoffice.org/xref/core/sw/source/core/docnode/ndnum.cxx?r=d405d73c#41
if i comment it out, works... but i it is not a solution...
Comment 9 Xisco Faulí 2022-04-20 15:02:34 UTC
(In reply to Attila Bakos (NISZ) from comment #6)
> (In reply to Xisco Faulí from comment #0)
> > Created attachment 178070 [details]
> > sample file
> > 
> > Steps to reproduce:
> > 1. Open attached document
> > 2. Select all
> > 3. Copy
> > 4. Paste twice
> > 5. Undo Twice
> > 
> > -> Crash
> > 
> > Reproduced in
> > 
> > Version: 7.4.0.0.alpha0+ / LibreOffice Community
> > Build ID: d5f015185240a7bddfed7ddf10d6b5426e35fb72
> > CPU threads: 8; OS: Linux 5.10; UI render: default; VCL: gtk3
> > Locale: es-ES (es_ES.UTF-8); UI: en-US
> > Calc: threaded
> 
> can you pls check it again? no crash in:
> Version: 7.4.0.0.alpha0+ (x64) / LibreOffice Community
> Build ID: d3c22b1d4754e95a0fbb801a73295e5a4353f38f
> CPU threads: 8; OS: Windows 10.0 Build 19043; UI render: Skia/Raster; VCL:
> win
> Locale: hu-HU (hu_HU); UI: hu-HU
> Calc: CL

yes, it's fixed. 
Fixed by 

author	Attila Bakos (NISZ) <bakos.attilakaroly@nisz.hu>	2022-02-07 17:09:42 +0100
committer	László Németh <nemeth@numbertext.org>	2022-03-01 17:53:01 +0100
commit 0d29394598db2e336a9982cbb7041ea407b2bf6d (patch)
tree 13fccc70320e734ce09f11e6e3f6c68e9da49dd1
parent 16665c48fef0ac178f224cccb1ddced69311835c (diff)
tdf#147126 sw: fix missing as_char anchoring of group textboxes
Comment 10 Attila Bakos (NISZ) 2022-05-17 10:24:36 UTC
Created attachment 180151 [details]
Before crash in 7.3

Hi there. The above mentioned commit could not caused the crash in the case of the second example file, because the bug persist in 7.3 too. To test:
1) Open the https://bugs.documentfoundation.org/attachment.cgi?id=178611&action=edit (Sample file2)
2) Change the anchor of the first shape (in order to can go inside of the group)
3) Go inside the group and add a textbox to the red circle. (Right click on it, add textbox in the context menu)
4) Change back the anchor to As_Char
Now ready the file for testing: do the ctrl+c ctrl+v and ctrl+z actions as mentioned before.
->Crash.

Tested with:
Version: 7.3.3.2 (x64) / LibreOffice Community
Build ID: d1d0ea68f081ee2800a922cac8f79445e4603348
CPU threads: 8; OS: Windows 10.0 Build 19043; UI render: Skia/Raster; VCL: win
Locale: hu-HU (hu_HU); UI: hu-HU
Calc: CL

Kindly asking for re-bibisecting. Thank you. I also will try.
Comment 11 Attila Bakos (NISZ) 2022-05-17 11:02:43 UTC
Created attachment 180153 [details]
The second example without crash

It seems to me, i have found the problem:
Before both file in this ticked crashed due to the above bibisected commit what has been fixed with the commit mentioned 2 comments of this above. But the second file still crashes because of the outlining. If i remove that from the file, it will work fine, as this modified example. With a simple diff the problem can be seen.
Comment 12 Attila Bakos (NISZ) 2022-06-30 10:35:06 UTC
It seems me it works fine with current master:
Version: 7.5.0.0.alpha0+ (x64) / LibreOffice Community
Build ID: eba47de3dc43fe249b7e53391a5c772c79961d4e
CPU threads: 8; OS: Windows 10.0 Build 19043; UI render: Skia/Raster; VCL: win
Locale: hu-HU (hu_HU); UI: en-US
Calc: CL
I suggest rechecking it. thx
Comment 13 Xisco Faulí 2022-06-30 10:49:06 UTC
issue fixed by

author	Attila Bakos (NISZ) <bakos.attilakaroly@nisz.hu>	2022-02-07 17:09:42 +0100
committer	László Németh <nemeth@numbertext.org>	2022-03-01 17:53:01 +0100
commit 0d29394598db2e336a9982cbb7041ea407b2bf6d (patch)
tree 13fccc70320e734ce09f11e6e3f6c68e9da49dd1
parent 16665c48fef0ac178f224cccb1ddced69311835c (diff)
tdf#147126 sw: fix missing as_char anchoring of group textboxes
Comment 14 Xisco Faulí 2022-06-30 10:55:24 UTC
(In reply to Attila Bakos (NISZ) from comment #12)
> It seems me it works fine with current master:
> Version: 7.5.0.0.alpha0+ (x64) / LibreOffice Community
> Build ID: eba47de3dc43fe249b7e53391a5c772c79961d4e
> CPU threads: 8; OS: Windows 10.0 Build 19043; UI render: Skia/Raster; VCL:
> win
> Locale: hu-HU (hu_HU); UI: en-US
> Calc: CL
> I suggest rechecking it. thx

meh, UI bisected the original report, which was already bisected in comment 9, What do you want me to recheck ?
Comment 15 Attila Bakos (NISZ) 2022-06-30 11:03:00 UTC
(In reply to Xisco Faulí from comment #14)
> (In reply to Attila Bakos (NISZ) from comment #12)
> > It seems me it works fine with current master:
> > Version: 7.5.0.0.alpha0+ (x64) / LibreOffice Community
> > Build ID: eba47de3dc43fe249b7e53391a5c772c79961d4e
> > CPU threads: 8; OS: Windows 10.0 Build 19043; UI render: Skia/Raster; VCL:
> > win
> > Locale: hu-HU (hu_HU); UI: en-US
> > Calc: CL
> > I suggest rechecking it. thx
> 
> meh, UI bisected the original report, which was already bisected in comment
> 9, What do you want me to recheck ?

sorry i checked bad file (the first one, what was good before, but i did not remember), and when i tried to reply to you, there was an error on Bugzilla, so you was faster then me. Unfortunately it is not fixed yet.
Comment 16 Xisco Faulí 2022-06-30 11:06:47 UTC
(In reply to Attila Bakos (NISZ) from comment #15)
> (In reply to Xisco Faulí from comment #14)
> > (In reply to Attila Bakos (NISZ) from comment #12)
> > > It seems me it works fine with current master:
> > > Version: 7.5.0.0.alpha0+ (x64) / LibreOffice Community
> > > Build ID: eba47de3dc43fe249b7e53391a5c772c79961d4e
> > > CPU threads: 8; OS: Windows 10.0 Build 19043; UI render: Skia/Raster; VCL:
> > > win
> > > Locale: hu-HU (hu_HU); UI: en-US
> > > Calc: CL
> > > I suggest rechecking it. thx
> > 
> > meh, UI bisected the original report, which was already bisected in comment
> > 9, What do you want me to recheck ?
> 
> sorry i checked bad file (the first one, what was good before, but i did not
> remember), and when i tried to reply to you, there was an error on Bugzilla,
> so you was faster then me. Unfortunately it is not fixed yet.

So the problem is with comment 5, right ?
Comment 17 Attila Bakos (NISZ) 2022-06-30 11:13:29 UTC
Yes, the attachment in the comment 5 is still bad in that version what i checked.
But i checked the first one only what was already good before (as you have written, but i did not remember that) Sorry for the pointless check.
Comment 18 Xisco Faulí 2022-06-30 11:32:47 UTC
(In reply to Attila Bakos (NISZ) from comment #17)
> Yes, the attachment in the comment 5 is still bad in that version what i
> checked.
> But i checked the first one only what was already good before (as you have
> written, but i did not remember that) Sorry for the pointless check.

ok. I checked and the assert is

soffice.bin: /home/tdf/lode/jenkins/workspace/lo_gerrit/tb/src_master/sw/source/core/docnode/ndnum.cxx:41: void SwNodes::UpdateOutlineNode(SwNode&): Assertion `IsDocNodes()' failed.
warn:desktop:547447:547447:desktop/source/app/crashreport.cxx:61: minidump generated: /home/xisco/LibreOfficeDev_7.5.0.0.alpha0_Linux_x86-64_archive/program/../program/../libreofficedev/4/crash//bd4f0530-03d1-4878-8ff9db88-d1b6bf9b.dmp
Unspecified Application Error

which is already reported in bug 146859. Let's use that ticket for the problem with comment 5 and close this one as RESOLVED FIXED
Comment 19 Attila Bakos (NISZ) 2022-06-30 12:07:28 UTC
(In reply to Xisco Faulí from comment #18)
> (In reply to Attila Bakos (NISZ) from comment #17)
> > Yes, the attachment in the comment 5 is still bad in that version what i
> > checked.
> > But i checked the first one only what was already good before (as you have
> > written, but i did not remember that) Sorry for the pointless check.
> 
> ok. I checked and the assert is
> 
> soffice.bin:
> /home/tdf/lode/jenkins/workspace/lo_gerrit/tb/src_master/sw/source/core/
> docnode/ndnum.cxx:41: void SwNodes::UpdateOutlineNode(SwNode&): Assertion
> `IsDocNodes()' failed.
> warn:desktop:547447:547447:desktop/source/app/crashreport.cxx:61: minidump
> generated:
> /home/xisco/LibreOfficeDev_7.5.0.0.alpha0_Linux_x86-64_archive/program/../
> program/../libreofficedev/4/crash//bd4f0530-03d1-4878-8ff9db88-d1b6bf9b.dmp
> Unspecified Application Error
> 
> which is already reported in bug 146859. Let's use that ticket for the
> problem with comment 5 and close this one as RESOLVED FIXED

Thank you.
Comment 20 Commit Notification 2022-06-30 19:32:29 UTC
Xisco Fauli committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/1d84ac1cd25022be13bd0c3f831f24b8edfee75d

tdf#147199: sw_uiwriter3: Add unittest

It will be available in 7.5.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 21 NISZ LibreOffice Team 2022-07-11 06:46:52 UTC
Verified in:
Version: 7.5.0.0.alpha0+ (x64) / LibreOffice Community
Build ID: a93d7e7df6804cd6f1f2fa1ef0e6e95ce6c3752a
CPU threads: 8; OS: Windows 10.0 Build 19042; UI render: Skia/Vulkan; VCL: win
Locale: hu-HU (hu_HU); UI: en-US
Calc: CL