Bug 150457 - Crash on hovering footnote references after removing footnote
Summary: Crash on hovering footnote references after removing footnote
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: LibreOffice (show other bugs)
Version:
(earliest affected)
7.0.0.3 release
Hardware: All All
: medium major
Assignee: Hossein
URL:
Whiteboard: target:7.5.0
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2022-08-17 09:40 UTC by Hossein
Modified: 2022-08-26 22:56 UTC (History)
5 users (show)

See Also:
Crash report or crash signature:
Regression By: Canberk TURAN


Attachments
screen record (2.87 MB, video/webm)
2022-08-17 18:48 UTC, Hossein
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Hossein 2022-08-17 09:40:35 UTC
Description:
After removing references, hovering the footnote reference in the text, crashes LibreOffice.

The logic of removing footnotes has problems, because:

1. Removing footnote numbers was not once possible in LO 6.4. Now, it is possible, but not for the first footnote in the selection.
2. After removal of footnotes, the references remain, and clicking on them leads to wrong place, which is the next remaining reference.

Steps to Reproduce:
1. Open attachment 177482 [details] from bug 146713
2. Go to the bottom of the first page in the footnotes section, select from the first footnote and extend selection to covert all footnotes.
3. Press DEL to delete footnotes. You will see that "1" remains
4. Even hovering the mouse on footnote references like 2 leads to crash.

Actual Results:
LibreOffice crashes

Expected Results:
LibreOffice should not crash


Reproducible: Always


User Profile Reset: No



Additional Info:
Reproducible in the latest 7.5 dev master:

Version: 7.5.0.0.alpha0+ / LibreOffice Community
Build ID: 895d6716ba8f12d98e3685145d433fce72270faa
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: en-US (en_US.UTF-8); UI: en-US
Calc: threaded

Also in 7.4:
Version: 7.4.0.1 / LibreOffice Community
Build ID: 43e5fcfbbadd18fccee5a6f42ddd533e40151bcf
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: en-US (en_US.UTF-8); UI: en-US
Calc: threaded

In LibreOffice 6.4, it is not possible to select and remove the references. You can only select one line, and even by selecting one line, the reference number is not removable.
Version: 6.4.0.1
Build ID: 1b6477b31f0334bd8620a96f0aeeb449b587be9f
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3; 
Locale: en-US (en_US.UTF-8); UI-Language: en-US
Calc: threaded

In LiberOffice 7.2, it is possible to select and remove footnotes, but it does not lead to crash:
Version: 7.2.4.1 / LibreOffice Community
Build ID: 27d75539669ac387bb498e35313b970b7fe9c4f9
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: en-US (en_US.UTF-8); UI: en-US
Calc: threaded
Comment 1 Xisco Faulí 2022-08-17 10:18:37 UTC
Not reproduced in

Version: 7.5.0.0.alpha0+ / LibreOffice Community
Build ID: da46f3db22814c03fbc303275342f7182ea288b4
CPU threads: 8; OS: Linux 5.10; UI render: default; VCL: x11
Locale: es-ES (es_ES.UTF-8); UI: en-US
Calc: threaded

Note: for the selection, I use the keyboard. selecting multiple footnotes with the mouse doesn't work.

COuld you please try with a clean profile ?
Comment 2 Hossein 2022-08-17 10:50:43 UTC
This is the behavior in MSO 2007:

1. If you select multiple footnotes and press DEL, you will get this popup:

    "This is not a valid action for footnotes."

2. If you remove a footnote and press backspace, the footnote number is removed.
3. You can select a single footnote and remove all of it including the number. The footnote reference remains, which is a problem.
Comment 3 Hossein 2022-08-17 10:56:57 UTC
> Not reproduced in
> 
> Version: 7.5.0.0.alpha0+ / LibreOffice Community
> Build ID: da46f3db22814c03fbc303275342f7182ea288b4
> CPU threads: 8; OS: Linux 5.10; UI render: default; VCL: x11
> Locale: es-ES (es_ES.UTF-8); UI: en-US
> Calc: threaded
> 
> Note: for the selection, I use the keyboard. selecting multiple footnotes
> with the mouse doesn't work.
> 
> COuld you please try with a clean profile ?
Removed the profile (~/.config/libreofficedev and ~/.config/libreoffice), and also ran with this option:

$ instdir/program/soffice --safe-mode

The same crash happens.
Comment 4 Hossein 2022-08-17 11:55:12 UTC
Backtrace, created using Qt Creator:

1  BigPtrEntry::GetArray          bparr.hxx       106  0x7fffd11624b6 
2  SwNode::GetNodes               node.hxx        721  0x7fffd11624fc 
3  SwNodeIndex::SwNodeIndex       ndindex.hxx     84   0x7fffd119b61a 
4  SwPosition::SwPosition         pam.cxx         95   0x7fffd133807e 
5  SwPaM::SwPaM                   pam.cxx         522  0x7fffd1339f9e 
6  SwContentAtPos::IsInRTLText    crstrvl.cxx     2036 0x7fffd130682a 
7  SwEditWin::RequestHelp         edtwin2.cxx     251  0x7fffd24d7b8b 
8  ImplHandleMouseHelpRequest     winproc.cxx     183  0x7fffeec56d78 
9  ImplHandleMouseEvent           winproc.cxx     737  0x7fffeec596e4 
10 ImplHandleSalMouseMove         winproc.cxx     2274 0x7fffeec5fb1d 
11 ImplWindowFrameProc            winproc.cxx     2613 0x7fffeec60da1 
12 SalFrame::CallCallback         salframe.hxx    306  0x7fffe4845a3e 
13 X11SalFrame::HandleMouseEvent  salframe.cxx    2748 0x7fffe49175c6 
14 X11SalFrame::Dispatch          salframe.cxx    3811 0x7fffe491b154 
15 SalX11Display::Dispatch        saldisp.cxx     2000 0x7fffe485f5d7 
16 SalX11Display::Yield           saldisp.cxx     1899 0x7fffe485ef25 
17 DisplayYield                   saldisp.cxx     381  0x7fffe48568ab 
18  ::YieldEntry::HandleNextEvent saldata.cxx     562  0x7fffe48514a7 
19 SalXLib::Yield                 saldata.cxx     754  0x7fffe485246c 
20 X11SalInstance::DoYield        salinst.cxx     192  0x7fffe4875249 
21 ImplYield                      svapp.cxx       475  0x7fffef3a14fa 
22 Application::Yield             svapp.cxx       559  0x7fffef3a21dc 
23 Application::Execute           svapp.cxx       453  0x7fffef3a119a 
24 desktop::Desktop::Main         app.cxx         1604 0x7ffff7c05f74 
25 ImplSVMain                     svmain.cxx      203  0x7fffef3c1023 
26 SVMain                         svmain.cxx      235  0x7fffef3c114c 
27 soffice_main                   sofficemain.cxx 94   0x7ffff7c700e7 
28 sal_main                       main.c          51   0x555555554a60 
29 main                           main.c          49   0x555555554a42
Comment 5 m.a.riosv 2022-08-17 14:32:18 UTC
I can't repro, but same problem for selection as @xisco.
The marks in text like ^2 point to the second footnote live, in this case 11

Version: 7.4.0.2 (x64) / LibreOffice Community
Build ID: 1512ce97d7ed39dce3121f7e15651fd8895f950e
CPU threads: 4; OS: Windows 10.0 Build 19044; UI render: Skia/Raster; VCL: win
Locale: es-ES (es_ES); UI: en-US Calc: CL
Comment 6 Xisco Faulí 2022-08-17 15:54:32 UTC
@Hossein, Could you please bisect this issue ?
Comment 7 BogdanB 2022-08-17 16:22:38 UTC
No crash, but I can not delete "1".

Version: 7.5.0.0.alpha0+ / LibreOffice Community
Build ID: 641d92a73e5b3d0e062e16ed4b42236e1a4796a5
CPU threads: 16; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: ro-RO (ro_RO.UTF-8); UI: en-US
Calc: threaded
Comment 8 Hossein 2022-08-17 18:02:59 UTC
Reproduced in the latest 7.5 dev master on Windows:

Version: 7.5.0.0.alpha0+ (x64) / LibreOffice Community
Build ID: 94e8f2e0cd07a90d0d2fd0138bdb8fd1f241ad58
CPU threads: 32; OS: Windows 10.0 Build 19044; UI render: Skia/Raster; VCL: win
Locale: en-US (en_DE); UI: en-US
Calc: threaded

Also in 7.2:

Version: 7.2.4.1 / LibreOffice Community
Build ID: 27d75539669ac387bb498e35313b970b7fe9c4f9
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: x11
Locale: en-US (en_US.UTF-8); UI: en-US
Calc: threaded

Version: 7.2.4.1 (x64) / LibreOffice Community
Build ID: 27d75539669ac387bb498e35313b970b7fe9c4f9
CPU threads: 32; OS: Windows 10.0 Build 19044; UI render: Skia/Raster; VCL: win
Locale: en-US (en_DE); UI: en-US
Calc: threaded
Comment 9 Hossein 2022-08-17 18:48:47 UTC
Created attachment 181838 [details]
screen record

Screen recording of the steps that leads to the crash

Please note that you should select and delete all the 22 footnotes, and not a subset of them.
Comment 10 BogdanB 2022-08-17 19:20:59 UTC
Based on comment 9, confirm with
Version: 7.4.0.2 / LibreOffice Community
Build ID: 1512ce97d7ed39dce3121f7e15651fd8895f950e
CPU threads: 16; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: ro-RO (ro_RO.UTF-8); UI: en-US
Calc: threaded
Comment 11 m.a.riosv 2022-08-17 20:32:06 UTC
Repro, deleting all footnotes.
Version: 7.5.0.0.alpha0+ (x64) / LibreOffice Community
Build ID: 6c81a09e3ef239a2d7a991d00fe3620a67298b99
CPU threads: 4; OS: Windows 10.0 Build 19044; UI render: Skia/Vulkan; VCL: win
Locale: es-ES (es_ES); UI: en-US Calc: CL
Comment 12 Hossein 2022-08-17 22:01:12 UTC
linux-64-7.0 $ git bisect log
git bisect start
# bad: [28c2621cf6a6d383bd0dfa3231adce6a6bff1fb4] source sha:626ea4e62a3e5005fe9825923a1c0c5bdb61cc08
git bisect bad 28c2621cf6a6d383bd0dfa3231adce6a6bff1fb4
# good: [d67926cda658cfe40d35f9f0f203c3407f3700c9] source sha:9bc848cf0d301aa57eabcffa101a1cf87bad6470
git bisect good d67926cda658cfe40d35f9f0f203c3407f3700c9
# good: [056a86d70b2c4322bac1bc3685eacd5364c1dbcf] source sha:368e9a829e07b3f8624898d69d2c00ec3bc590ec
git bisect good 056a86d70b2c4322bac1bc3685eacd5364c1dbcf
# good: [0dcf6f593cd9eb8abf3fa3cd0f4ef8f47097c3b2] source sha:d37aa807fe264b7172416a52ef21b178fb502b71
git bisect good 0dcf6f593cd9eb8abf3fa3cd0f4ef8f47097c3b2
# bad: [8e0083c274fc9ad13c2fc4984cffe5bbe3a0e41e] source sha:2562df42f8a95f33f339405354b422e52cf42fbf
git bisect bad 8e0083c274fc9ad13c2fc4984cffe5bbe3a0e41e
# good: [9321cfae0630b5598a97cb7043a0abc177e670e8] source sha:983ff8d90deb511e43d5fbdeaf602f7f4de49122
git bisect good 9321cfae0630b5598a97cb7043a0abc177e670e8
# good: [fb5a38fcc683defbdfc6f9119dc973b31538cf81] source sha:c90ccc85a9d10d3bf71b1c7721ce5124394ef91f
git bisect good fb5a38fcc683defbdfc6f9119dc973b31538cf81
# bad: [4c99bc24242ab7f508af92e8979115cba96e42d7] source sha:44041005186b0556a06695920de842c5998851f1
git bisect bad 4c99bc24242ab7f508af92e8979115cba96e42d7
# bad: [89eda56a5709d0c486b40de693a5c685f7ceb3c0] source sha:22cb73dcc682edb15a2425339377ff54dde5dba6
git bisect bad 89eda56a5709d0c486b40de693a5c685f7ceb3c0
# good: [acf2c1e4a212354c03295f328ca4f9f32bfc407e] source sha:c46219e6afdb0a448393f69a69cb4e71d6d04a77
git bisect good acf2c1e4a212354c03295f328ca4f9f32bfc407e
# good: [c3fd8e85beab6bdef1add77a72968c63c05a0e8d] source sha:6dd15d39c11384ebd7cd5a2efea666724fcfe0ba
git bisect good c3fd8e85beab6bdef1add77a72968c63c05a0e8d
# bad: [797990fcb4da845f2fd6c9f6b6537f440c63dd21] source sha:2da8c272528386e38deb679712adb879f2f412b2
git bisect bad 797990fcb4da845f2fd6c9f6b6537f440c63dd21
# bad: [187fffe96a8fd159ac222d6390cf4fc9b22bdf2a] source sha:e0e1c3bcc9445c177a4d97ba11639ae4f2f83163
git bisect bad 187fffe96a8fd159ac222d6390cf4fc9b22bdf2a
# bad: [e266e4d8ef4064984b2dd3328d4ce7b5f0f77431] source sha:c46a704943be830d603ba0421a329ccb58b8b209
git bisect bad e266e4d8ef4064984b2dd3328d4ce7b5f0f77431
# bad: [c9dc690126cb894dc6ab2546dddd8878dd769ced] source sha:402f36efb215338ad545caa65d39fb8a39685ea1
git bisect bad c9dc690126cb894dc6ab2546dddd8878dd769ced
# first bad commit: [c9dc690126cb894dc6ab2546dddd8878dd769ced] source sha:402f36efb215338ad545caa65d39fb8a39685ea1

bibisected to:

commit 402f36efb215338ad545caa65d39fb8a39685ea1
Author: Canberk TURAN <canberkkturann@gmail.com>
Date:   Sun Jun 7 16:26:16 2020 +0300

    tdf#131990 MACROS: fixes return value of UpDown Method
    
    This patch fixes bRet return value of UpDown method in
    sw/source/core/crsr/swcrsr.cxx. Before this patch UpDown method always returns true.

I reverted the above commit, then the up down key behavior changed. Subsequently the crash did not happen anymore, as the removal of multiple footnotes and their numbers was not possible anymore.
Comment 13 Commit Notification 2022-08-26 22:54:37 UTC
Hossein committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/d05c176cc022f1b771f7c064f6ce74e9f8c27a1b

tdf#150457 Fix crash on hovering removed footnote reference

It will be available in 7.5.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.