Bug 147938 - Crash in: msvcp140.dll
Summary: Crash in: msvcp140.dll
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
6.2.0.3 release
Hardware: All All
: medium critical
Assignee: Michael Stahl (allotropia)
URL:
Whiteboard: target:24.2.0 target:7.6.1
Keywords: bibisected, bisected, regression
Depends on:
Blocks: Crash redlinehide-regressions
  Show dependency treegraph
 
Reported: 2022-03-12 13:26 UTC by robb
Modified: 2024-07-31 06:12 UTC (History)
7 users (show)

See Also:
Crash report or crash signature: ["msvcp140.dll","std::_Xlength_error(char const *)","libc.so.6"]


Attachments
sample Writer file to demonstrate bug (12.79 MB, application/octet-stream)
2022-03-12 20:03 UTC, robb
Details
Select the graphic then copy/paste it in a new doc in LO Writer (39.72 KB, application/vnd.oasis.opendocument.spreadsheet)
2022-12-03 12:11 UTC, Abraxas
Details
minimal sample file for bisected bug (819.50 KB, application/vnd.oasis.opendocument.text)
2023-03-31 22:28 UTC, Stéphane Guillou (stragu)
Details

Note You need to log in before you can comment on or make changes to this bug.
Description robb 2022-03-12 13:26:42 UTC
This bug was filed from the crash reporting server and is br-d80d4b88-c9b3-4724-b3a9-33619f1b74ce.
=========================================

In attempting to delete the extra newline between 2 tables I first converted the first table to text with "Table --> Convert --> Table to Text". Then I deleted the newline after this text. Then I tried to convert the text to table with "Table --> Convert --> Text to Table". Writer ended and showed me the file recovery window. The status bar moved about 2/3 of the way, then stopped and didn't move for about 10 minutes, at which point I closed the window. When opening the Writer file again, the crash report was created.
Comment 1 raal 2022-03-12 16:28:40 UTC
Hello,

Thank you for filing the bug. I cannot reproduce the bug. Please send us a sample document, as this makes it easier for us to verify the bug. 
I have set the bug's status to 'NEEDINFO', so please do change it back to 'UNCONFIRMED' once you have attached a document.
(Please note that the attachment will be public, remove any sensitive information before attaching it.)
How can I eliminate confidential data from a sample document?
https://wiki.documentfoundation.org/QA/FAQ#How_can_I_eliminate_confidential_data_from_a_sample_document.3F
Thank you
Comment 2 robb 2022-03-12 20:03:34 UTC
Created attachment 178841 [details]
sample Writer file to demonstrate bug
Comment 3 robb 2022-03-12 20:07:53 UTC
I have attached a sample document. I tested copying the page where the error occurred to a new document, but the error did not occur in the one-page document. Therefore I copied my whole document (about 180 pages, 515,939 KB) and sanitized it as described. The text was converted to x's, but many of the images are intact.
Then I deleted as many images as needed to get the file size under 30,000 KB in order to attach it to the bug report.
To reproduce the error:
- Go to page 142 or search for the word "CRASH".
- Hit Ctrl-F10 to display formatting marks. Note the newline between the tables that I can't delete by simply pressing Del.
- Mark the first table on this page (the one with the word "CRASH" in the first cell.
- Table --> Convert --> Table to Text --> OK
- Place the cursor after the second image (that was in the third table cell), and hit Del to delete the following newline. (The bug occurs whether one does this step or not).
- Mark the portion that was in the table (from the word "CRASH" to after the second image).
- Table --> Convert --> Text to Table --> OK
- The document disappears and a "Document Recovery" window appears. Hit OK.
- A "Documents Are Being Saved" window appears. The progress bar progresses almost all the way (about 2/3 of the way in my original document) and then stops. Close this window with the "X" in the upper right corner.
- Open the document again. A "Crash Report" window appears.
Comment 4 Tex2002ans 2022-11-13 08:49:03 UTC
I was able to reproduce:

https://crashreport.libreoffice.org/stats/crash_details/0eb54e13-476b-4870-b29e-1be034cff809

- - -

Version: 7.4.2.3 (x64) / LibreOffice Community
Build ID: 382eef1f22670f7f4118c8c2dd222ec7ad009daf
CPU threads: 8; OS: Windows 10.0 Build 19044; UI render: Skia/Raster; VCL: win
Locale: en-US (en_US); UI: en-US
Calc: threaded

- - -

Followed the instructions in Comment #3:

1) Opened attached file.

2) Scrolled to final page.
--- (With "ERROR" at top + "CRASH" in 1st table.)

3) Highlighted the entire "CRASH" table:
- "CRASH" cell
- "Eotapoifia on" image
- "Emil Wuollet Dies" image

4) Table > Convert > Table to Text.

Press OK.

5) Highlighted the text from "CRASH" all the way to the end of "Emil Wuollet Dies" image.

6) Table > Convert > Text to Table.

CRASH.
Comment 5 raal 2022-11-13 09:01:41 UTC
No crash with Version: 7.5.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: cfc8a8f5d841b3f84d207196153be67da7f60652
CPU threads: 4; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: cs-CZ (cs_CZ.UTF-8); UI: en-US
Calc: threaded

@Tex2002ans, can you test with dev version?  You can download it here:
http://dev-builds.libreoffice.org/daily/master/
But maybe it's windows-only bug. Also checking LO's old version (4.1 for instance) would be useful - for regression checking. Thank you.
Comment 6 Tex2002ans 2022-11-13 22:54:30 UTC
I also got crash in current dev:

Version: 7.5.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 55cd20e6228a06836285c14ca6726adb1bb4ffcb
CPU threads: 8; OS: Windows 10.0 Build 19045; UI render: Skia/Vulkan; VCL: win
Locale: en-US (en_US); UI: en-US
Calc: CL threaded

NO CRASH in:

- Version: 4.1.6.2
- Build ID: 40ff705089295be5be0aae9b15123f687c05b0a
Comment 7 Abraxas 2022-12-03 12:10:29 UTC
I have this crash with version of LO (v7.3.7.2):

STR:
1/ Open the sheet .ods with LO Calc (see joined file)
2/ Select the graph and paste it (ctrl+c)
3/ Open a new document in LO Writer
4/ Copy (ctrl+v) the graph into the new document
5/ Enjoy the crash


Crash in v7.3.7.2: msvcp140.dll 
https://crashreport.libreoffice.org/stats/crash_details/f21efae2-efba-4d9c-9a88-44d38ad2b8ad

Crash in v7.3.5.2: std::_Xlength_error(char const *) 
https://crashreport.libreoffice.org/stats/crash_details/f1186a54-7934-42e5-9967-7d2b05b04876
Comment 8 Abraxas 2022-12-03 12:11:39 UTC
Created attachment 183975 [details]
Select the graphic then copy/paste it in a new doc in LO Writer
Comment 9 raal 2022-12-04 07:48:55 UTC
(In reply to Abraxas from comment #8)
> Created attachment 183975 [details]
> Select the graphic then copy/paste it in a new doc in LO Writer

no crash with Version: 7.5.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: ebe151d919a454f98c36013245bca9eb41d92707
CPU threads: 4; OS: Windows 10.0 Build 19044; UI render: Skia/Raster; VCL: win
Locale: cs-CZ (cs_CZ); UI: en-US
Calc: CL threaded
Comment 10 Marina Latini (SUSE) 2023-01-25 13:09:50 UTC
Reproduced with:

Version: 7.6.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: af6f87e66bc7f6257524df68ca9d90e6072558f6
CPU threads: 2; OS: Windows 10.0 Build 19045; UI render: Skia/Raster; VCL: win
Locale: en-US (en_DE); UI: en-US
Calc: threaded


Using steps in comment #4
Comment 11 Marina Latini (SUSE) 2023-01-25 13:44:05 UTC
reproduced with:

Version: 7.4.0.0.alpha1+ (x64) / LibreOffice Community
Build ID: c94961c6869c34b3874d21cfaa5ec1488609acfe
CPU threads: 2; OS: Windows 10.0 Build 19045; UI render: Skia/Raster; VCL: win
Locale: en-US (en_DE); UI: en-US
Calc: threaded

Using steps in comment #4

The bug can be reproduced with:
* https://bibisect.libreoffice.org/win64-7.5.git
* https://bibisect.libreoffice.org/win64-7.6.git

On both repos all the tested commits via git bisect are bad.
Comment 12 Ximena Alcaman 2023-01-25 14:58:43 UTC
Reproduced with:
Version: 6.4.7.2 (x64)
Build ID: 639b8ac485750d5696d7590a72ef1b496725cfb5
CPU threads: 12; OS: Windows 10.0 Build 22621; UI render: GL; VCL: win; 
Locale: en-US (en_GG); UI-Language: en-US
Calc: threaded

Followed instructions in comment #4

I got a fatal error: invalid string_view position.
Then it crashes.
Comment 13 Stéphane Guillou (stragu) 2023-03-31 22:26:10 UTC
Quite a few things in here. I tested two crashes: comment 7 is resolved, and I bibisected comment 4.

----- comment 7 crash:

Reproduced in 7.3.7.2, with crash signature libc.so.6 : https://crashreport.libreoffice.org/stats/crash_details/0008f17b-e2ee-4165-99ee-f29fcaa23920

Version: 7.3.7.2 / LibreOffice Community
Build ID: e114eadc50a9ff8d8c8a0567d6da8f454beeb84f
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: threaded

However, not reproduced in 7.4.6, nor 7.5.2, nor a recent master build, so comment 7 is resolved as "works for me".

------ comment 4 crash:

Reproduced in recent master:

Version: 7.6.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 1b463f697405e64a03378fb38a32172c4d3c25e6
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: threaded

Also in 7.5.5.2, with crash signature libc.so.6 as well: https://crashreport.libreoffice.org/stats/crash_details/ad4e8bce-e354-4365-b47f-99e3aa38d98b

Bibisected with linux-64-6.2 bibisect repo to first bad commit ae82aa93d4536e9529688f412def4a23908f1d40 which points to core commit 94c1af65367dcbc7272455cf6d4940252a289b62 which is a cherrypick of:

commit 32902f66e7749b2d06d13f50416be5323a0c0ea9
author	Michael Stahl <Michael.Stahl@cib.de>	Fri Nov 30 17:54:41 2018 +0100
committer	Michael Stahl <Michael.Stahl@cib.de>	Tue Dec 18 17:55:30 2018 +0100
tree 901ab6577d25102c0a855d2a63964dfef67b34c4
parent b310378e874bc8fa7005352fcd85fa64eb075f54
sw_redlinehide: make layout based Show/Hide mode the default
remove ExperimentalMode checks
https://gerrit.libreoffice.org/c/core/+/64351

Michael, can you please have a look?
Comment 14 Stéphane Guillou (stragu) 2023-03-31 22:28:42 UTC
Created attachment 186379 [details]
minimal sample file for bisected bug

I made the original attachment smaller to test more easily.

Steps used to bisect:
1. Open file
2. Select whole table
3. Table > Convert > Table to Text > OK
4. Select all with Ctrl + A
5. Table > Convert > Text to Table > OK

Result: crash
Comment 15 Gabor Kelemen (allotropia) 2023-07-19 22:29:20 UTC
Went for another round of bibisect, started with this:

https://git.libreoffice.org/core/+/f609eba8b979620dc8f1c4a47d710360f8aae9e6

author	Michael Stahl <Michael.Stahl@cib.de>	Tue Oct 09 14:49:23 2018 +0200
committer	Michael Stahl <Michael.Stahl@cib.de>	Thu Nov 15 15:09:58 2018 +0100

sw_redlinehide_3: convert even more SwAccessibleParagraph functions

Before this even opening the example files crashed.
Comment 16 Gabor Kelemen (allotropia) 2023-07-19 22:58:13 UTC
The crashing on open started with

https://git.libreoffice.org/core/+/4532845e22c10f252840887e55002307227b2390

author	Michael Stahl <Michael.Stahl@cib.de>	Thu Jul 26 14:12:53 2018 +0200
committer	Michael Stahl <Michael.Stahl@cib.de>	Wed Sep 19 10:18:20 2018 +0200

sw_redlinehide_2: add *another* flag to DocumentRedlineManager

Before this the conversion back to table (last step of comment #14) was successful.
Comment 17 Commit Notification 2023-08-04 16:14:57 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/3d8697dab9a4a29666440a30c5c7a6d9d9f76d76

tdf#147938 sw: Undo of table to text uses ContentIdxStore wrong

It will be available in 24.2.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 18 Commit Notification 2023-08-04 16:14:59 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/5b55ccfd384d3c0c11e05f22bd7e956b4bc7e43a

tdf#147938 sw_redlinehide: fix undo of table to text

It will be available in 24.2.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 19 Michael Stahl (allotropia) 2023-08-04 16:15:50 UTC
fixed on master
Comment 20 Stéphane Guillou (stragu) 2023-08-08 20:21:47 UTC
Thanks Michael, verified the fix for comment 14 steps with:

Version: 24.2.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 42364fbfafaa95773c073cc080142b64ec1786fb
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: threaded
Comment 21 Commit Notification 2023-08-09 14:26:25 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/b5a41467efdce02b80ffe3824fdefe9fbc01fc95

tdf#147938 sw_redlinehide: move fix into SwNodes::UndoTableOfText()

It will be available in 24.2.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 22 Commit Notification 2023-08-14 09:21:33 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-7-6":

https://git.libreoffice.org/core/commit/28a3435cda15509dd9832f48607aac908bde3954

tdf#147938 sw: Undo of table to text uses ContentIdxStore wrong

It will be available in 7.6.1.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 23 Commit Notification 2023-08-14 09:29:48 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-7-6":

https://git.libreoffice.org/core/commit/7eec6b434445bac246bb75cc436fd77cad6af163

tdf#147938 sw_redlinehide: fix undo of table to text

It will be available in 7.6.1.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.