Bug 147199 - CRASH: pasting twice and undoing
Summary: CRASH: pasting twice and undoing
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
7.4.0.0 alpha0+
Hardware: All All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2022-02-04 15:19 UTC by Xisco Faulí
Modified: 2022-05-17 13:39 UTC (History)
5 users (show)

See Also:
Crash report or crash signature:
Regression By:


Attachments
sample file (23.31 KB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2022-02-04 15:19 UTC, Xisco Faulí
Details
bt with debug symbols (12.22 KB, text/plain)
2022-02-05 08:43 UTC, Julien Nabet
Details
sample file 2 (1.67 MB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2022-03-02 09:35 UTC, Xisco Faulí
Details
Before crash in 7.3 (287.96 KB, image/jpeg)
2022-05-17 10:24 UTC, Attila Bakos (NISZ)
Details
The second example without crash (1.45 MB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2022-05-17 11:02 UTC, Attila Bakos (NISZ)
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Xisco Faulí 2022-02-04 15:19:02 UTC
Created attachment 178070 [details]
sample file

Steps to reproduce:
1. Open attached document
2. Select all
3. Copy
4. Paste twice
5. Undo Twice

-> Crash

Reproduced in

Version: 7.4.0.0.alpha0+ / LibreOffice Community
Build ID: d5f015185240a7bddfed7ddf10d6b5426e35fb72
CPU threads: 8; OS: Linux 5.10; UI render: default; VCL: gtk3
Locale: es-ES (es_ES.UTF-8); UI: en-US
Calc: threaded
Comment 1 Xisco Faulí 2022-02-04 15:20:15 UTC
Regression introduced by:

https://cgit.freedesktop.org/libreoffice/core/commit/?id=2951cbdf3a6e2b62461665546b47e1d253fcb834

author	Attila Bakos (NISZ) <bakos.attilakaroly@nisz.hu>	2021-11-10 14:10:11 +0100
committer	László Németh <nemeth@numbertext.org>	2022-01-03 14:28:15 +0100
commit 2951cbdf3a6e2b62461665546b47e1d253fcb834 (patch)
tree d09834b7f1e68e7b3664ed03c5d2ed3c73de552d
parent cce57fd94e9335c5dd5f3725a5fe54f5d3929e8d (diff)
tdf#143574 OOXML export/import of textboxes in group shapes

Bisected with: bibisect-linux64-7.4

Adding Cc: to Attila Bakos
Comment 2 Julien Nabet 2022-02-05 08:43:50 UTC
Created attachment 178078 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today, I got a segfault with gtk3 rendering.
Remark: I've got no crash with gen rendering.
Comment 3 Xisco Faulí 2022-02-07 17:40:04 UTC
with gen, you might need to increase the number of pastes and undo, but it also crashes
Comment 4 Attila Bakos (NISZ) 2022-02-16 17:18:00 UTC
Yes, I have an idea about the real problem:
From that commit the text of the group shapes in textframes attached to the shapes like simple shapes.
As-char anchoring (like these shapes anchored) is not implemented in the master, only in gerrit, here: https://gerrit.libreoffice.org/c/core/+/129627 That can cause crash.
But, that fix can be not enough because there is a problem in the writer core, at the content operation manager so the copy of the textframes will have issues (floating tables, textboxes etc what uses swxtextframe all affected) because the frame format of the textbox unable to survive the content operation manager operation. Before i tried to debug it, and i found the problem in https://opengrok.libreoffice.org/xref/core/sw/source/core/doc/DocumentContentOperationsManager.cxx?r=70ac13ee#3768 but there i lost... There can be seen a SwTextBoxHelper::SavedLink aOldTextBoxes; line where the textframes saved in case of simple shapes for later usage when the fly copying finished (if you comment it that also will have issues too). But for group textboxes this is not so easy, because in case of simple shapes the shape texbox pair 1:1, but in case of group shapes this is 1:N, and each textboxes identified by the sdrobject what its belongs to. However during this content operation, the sdrs will be deleted and recreated, so the textboxes lost their connection. That prevent proper copying of group textboxes in case of ctrl+drag, ctrl+c, undoing, etc. I think this cause that issue too where nested floating table conversion causes exception, now these tables imported as simple tables with wrong position. So i think this is a so complex problem, not a simple regression. Thanks to this issue i have to put a condition in the above mentioned commit, where i disabled group textboxes (WPG) in tables, see: https://opengrok.libreoffice.org/xref/core/writerfilter/source/ooxml/OOXMLFastContextHandler.cxx?r=4a38ca40#1712
But i also hope this will be fixed one day too :)
Comment 5 Xisco Faulí 2022-03-02 09:35:09 UTC
Created attachment 178611 [details]
sample file 2

Another file that crashes after https://cgit.freedesktop.org/libreoffice/core/commit/?id=2951cbdf3a6e2b62461665546b47e1d253fcb834

Steps:
1. Select all & copy
2. Paste 3 times
3. Undo 3 times

-> Crash
Comment 6 Attila Bakos (NISZ) 2022-04-20 14:09:42 UTC Comment hidden (obsolete)
Comment 7 Attila Bakos (NISZ) 2022-04-20 14:12:35 UTC Comment hidden (obsolete)
Comment 8 Attila Bakos (NISZ) 2022-04-20 14:22:57 UTC
(In reply to Attila Bakos (NISZ) from comment #7)
> (In reply to Xisco Faulí from comment #5)
> > Created attachment 178611 [details]
> > sample file 2
> > 
> > Another file that crashes after
> > https://cgit.freedesktop.org/libreoffice/core/commit/
> > ?id=2951cbdf3a6e2b62461665546b47e1d253fcb834
> > 
> > Steps:
> > 1. Select all & copy
> > 2. Paste 3 times
> > 3. Undo 3 times
> > 
> > -> Crash
> 
> but this one crashes unfortunately :(

there is an assert:
https://opengrok.libreoffice.org/xref/core/sw/source/core/docnode/ndnum.cxx?r=d405d73c#41
if i comment it out, works... but i it is not a solution...
Comment 9 Xisco Faulí 2022-04-20 15:02:34 UTC
(In reply to Attila Bakos (NISZ) from comment #6)
> (In reply to Xisco Faulí from comment #0)
> > Created attachment 178070 [details]
> > sample file
> > 
> > Steps to reproduce:
> > 1. Open attached document
> > 2. Select all
> > 3. Copy
> > 4. Paste twice
> > 5. Undo Twice
> > 
> > -> Crash
> > 
> > Reproduced in
> > 
> > Version: 7.4.0.0.alpha0+ / LibreOffice Community
> > Build ID: d5f015185240a7bddfed7ddf10d6b5426e35fb72
> > CPU threads: 8; OS: Linux 5.10; UI render: default; VCL: gtk3
> > Locale: es-ES (es_ES.UTF-8); UI: en-US
> > Calc: threaded
> 
> can you pls check it again? no crash in:
> Version: 7.4.0.0.alpha0+ (x64) / LibreOffice Community
> Build ID: d3c22b1d4754e95a0fbb801a73295e5a4353f38f
> CPU threads: 8; OS: Windows 10.0 Build 19043; UI render: Skia/Raster; VCL:
> win
> Locale: hu-HU (hu_HU); UI: hu-HU
> Calc: CL

yes, it's fixed. 
Fixed by 

author	Attila Bakos (NISZ) <bakos.attilakaroly@nisz.hu>	2022-02-07 17:09:42 +0100
committer	László Németh <nemeth@numbertext.org>	2022-03-01 17:53:01 +0100
commit 0d29394598db2e336a9982cbb7041ea407b2bf6d (patch)
tree 13fccc70320e734ce09f11e6e3f6c68e9da49dd1
parent 16665c48fef0ac178f224cccb1ddced69311835c (diff)
tdf#147126 sw: fix missing as_char anchoring of group textboxes
Comment 10 Attila Bakos (NISZ) 2022-05-17 10:24:36 UTC
Created attachment 180151 [details]
Before crash in 7.3

Hi there. The above mentioned commit could not caused the crash in the case of the second example file, because the bug persist in 7.3 too. To test:
1) Open the https://bugs.documentfoundation.org/attachment.cgi?id=178611&action=edit (Sample file2)
2) Change the anchor of the first shape (in order to can go inside of the group)
3) Go inside the group and add a textbox to the red circle. (Right click on it, add textbox in the context menu)
4) Change back the anchor to As_Char
Now ready the file for testing: do the ctrl+c ctrl+v and ctrl+z actions as mentioned before.
->Crash.

Tested with:
Version: 7.3.3.2 (x64) / LibreOffice Community
Build ID: d1d0ea68f081ee2800a922cac8f79445e4603348
CPU threads: 8; OS: Windows 10.0 Build 19043; UI render: Skia/Raster; VCL: win
Locale: hu-HU (hu_HU); UI: hu-HU
Calc: CL

Kindly asking for re-bibisecting. Thank you. I also will try.
Comment 11 Attila Bakos (NISZ) 2022-05-17 11:02:43 UTC
Created attachment 180153 [details]
The second example without crash

It seems to me, i have found the problem:
Before both file in this ticked crashed due to the above bibisected commit what has been fixed with the commit mentioned 2 comments of this above. But the second file still crashes because of the outlining. If i remove that from the file, it will work fine, as this modified example. With a simple diff the problem can be seen.