Bug 147726 - Crash in BigPtrArray::Index2Block(unsigned long) const [assert (pTextNd), function UndoImpl, file undel.cxx, line 918]
Summary: Crash in BigPtrArray::Index2Block(unsigned long) const [assert (pTextNd), fun...
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
5.0.0.5 release
Hardware: All All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords: bibisected, bisected, haveBacktrace, regression
: 147197 149500 (view as bug list)
Depends on:
Blocks: Paste Crash-Assert Undo-Redo Crash
  Show dependency treegraph
 
Reported: 2022-03-02 10:11 UTC by Xisco Faulí
Modified: 2022-06-14 02:40 UTC (History)
6 users (show)

See Also:
Crash report or crash signature: ["BigPtrArray::Index2Block(long)"]
Regression By: Michael Stahl


Attachments
sample file (155.97 KB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2022-03-02 10:11 UTC, Xisco Faulí
Details
Backtrace (20.46 KB, text/plain)
2022-06-14 01:51 UTC, Aron Budea
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Xisco Faulí 2022-03-02 10:11:06 UTC
Created attachment 178614 [details]
sample file

Steps to reproduce:
1. Open attached document
2. Select all 3 times
3. Copy
4. Paste
5. Undo

Reproduced in

Version: 7.4.0.0.alpha0+ / LibreOffice Community
Build ID: c97a3592c78ce276a353f95ce68c70a8a39174a0
CPU threads: 8; OS: Linux 5.10; UI render: default; VCL: gtk3
Locale: es-ES (es_ES.UTF-8); UI: en-US
Calc: threaded

and

Version: 6.4.0.0.alpha1+
Build ID: 9bc848cf0d301aa57eabcffa101a1cf87bad6470
CPU threads: 8; OS: Linux 5.10; UI render: default; VCL: gtk3; 
Locale: es-ES (es_ES.UTF-8); UI-Language: en-US
Calc: threaded
Comment 1 Xisco Faulí 2022-03-02 17:44:48 UTC
Also reproduced in

Version: 5.2.0.0.alpha0+
Build ID: 3ca42d8d51174010d5e8a32b96e9b4c0b3730a53
Threads 4; Ver: 5.10; Render: default; 

Locale: en-US (en_US.UTF-8)
Comment 2 Xisco Faulí 2022-03-02 17:46:12 UTC
Not reproduced in

Version: 4.3.0.0.alpha1+
Build ID: c15927f20d4727c3b8de68497b6949e72f9e6e9e
Comment 3 Dieter 2022-03-15 20:49:03 UTC
I confirm it with

Version: 7.3.1.3 (x64) / LibreOffice Community
Build ID: a69ca51ded25f3eefd52d7bf9a5fad8c90b87951
CPU threads: 4; OS: Windows 10.0 Build 19044; UI render: Skia/Raster; VCL: win
Locale: de-DE (de_DE); UI: en-GB
Calc: CL

https://crashreport.libreoffice.org/stats/crash_details/14829a4b-993f-43e8-82e7-cc8c65593f9b
Comment 4 raal 2022-03-19 09:35:33 UTC
This seems to have begun at the below commit.
Adding Cc: to Michael Stahl ; Could you possibly take a look at this one?
Thanks
bibisect-50max$ 3551e5dfdb75ecca07f759422bda10d3a7117489 is the first bad commit
commit 3551e5dfdb75ecca07f759422bda10d3a7117489
Author: Matthew Francis <mjay.francis@gmail.com>
Date:   Wed May 27 21:08:00 2015 +0800

    source-hash-b24a15a0aaea310806259eaa20a7d509ce30e5c8
    
    commit b24a15a0aaea310806259eaa20a7d509ce30e5c8
    Author:     Michael Stahl <mstahl@redhat.com>
    AuthorDate: Thu Apr 2 23:33:41 2015 +0200
    Commit:     Michael Stahl <mstahl@redhat.com>
    CommitDate: Thu Apr 2 23:53:30 2015 +0200
    
        sw: fix crash on SwUndoDelete after select-all with table at start
    
        Somehow the Redo leaves the shell cursor at an invalid offset into the
        paragraph, which then leads to out-of-bounds string access.
    
        Noticed that SwUndRng::SetPaM() leaves an invalid nContent.m_nIndex on
        the start position, due to a surprising omission in SwIndex::ChgValue().
    
        (regression from 555ff26501d1bbd8a7872c20671c6303db1e1701)
    
        Change-Id: I6e6ad7f70835d7e9d6da1fb680e2ae15469fad71
Comment 5 Telesto 2022-04-09 05:37:53 UTC
Assertion failed: (pTextNd), function UndoImpl, file undel.cxx, line 918.

* thread #1, queue = 'com.apple.main-thread', stop reason = hit program assert
    frame #4: 0x0000000173e6a668 libswlo.dylib`SwUndoDelete::UndoImpl(this=0x0000600003ac9380, rContext=0x00007ff7bfefc130) at undel.cxx:918:13
   915 	                    lcl_ReAnchorAtContentFlyFrames(*rDoc.GetSpzFrameFormats(), aPos, nOldIdx);
   916 	                pTextNd = aPos.nNode.GetNode().GetTextNode();
   917 	            }
-> 918 	            assert(pTextNd); // else where does m_aEndStr come from?
   919 	            if( pTextNd )
   920 	            {
   921 	                OUString const ins( pTextNd->InsertText(*m_aEndStr, aPos.nContent,
Comment 6 Aron Budea 2022-06-14 01:51:44 UTC
Created attachment 180742 [details]
Backtrace

Attaching backtrace taken with LO 7.5.0.0.alpha0+ (3ad12672e924f7aef394119f9fe5f0b06a900b9e) debug build.
Comment 7 Aron Budea 2022-06-14 02:32:25 UTC
*** Bug 149500 has been marked as a duplicate of this bug. ***
Comment 8 Aron Budea 2022-06-14 02:40:45 UTC
*** Bug 147197 has been marked as a duplicate of this bug. ***