Bug 150498 - CRASH: Copying change tracked content and closing Writer
Summary: CRASH: Copying change tracked content and closing Writer
Status: RESOLVED DUPLICATE of bug 149548
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
6.1.0.3 release
Hardware: All All
: medium normal
Assignee: Michael Stahl (allotropia)
URL:
Whiteboard:
Keywords: bibisected, bisected, regression
Depends on:
Blocks: Track-Changes Clipboard Crash
  Show dependency treegraph
 
Reported: 2022-08-19 12:16 UTC by Gabor Kelemen (allotropia)
Modified: 2022-12-15 13:49 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Gabor Kelemen (allotropia) 2022-08-19 12:16:12 UTC
This is a followup to bug 149548

When the example file attachment 180723 [details] content is copied and LO is closed, it crashes.

1, Open attachment 180723 [details]
2, Ctrl-A
3, Close Writer

-> crash. An empty Document Recovery dialog shows up, which cannot be closed.

Version: 7.5.0.0.alpha0+ (x64) / LibreOffice Community
Build ID: 8475b367298de73aec6abc60a159cc015baf9734
CPU threads: 14; OS: Windows 10.0 Build 19044; UI render: Skia/Raster; VCL: win
Locale: en-US (hu_HU); UI: en-US
Calc: threaded

Does not happen on Linux, only on Windows.
Version: 7.5.0.0.alpha0+ / LibreOffice Community
Build ID: 9135cdbc1a5fa09d00aee76215ff5cd369f82756
CPU threads: 8; OS: Linux 5.4; UI render: default; VCL: gtk3
Locale: hu-HU (hu_HU.UTF-8); UI: en-US
Calc: threaded

Seems to have started with the same commit as bug 149548, but this still happens despite the fixes there.

https://git.libreoffice.org/core/+/7b1d50e97eaa00855152e74f42b789fc643e0bac 

tdf#106746: pDelPam is a bit special
Comment 1 Dieter 2022-09-03 11:16:05 UTC
Can't confirm with

Version: 7.5.0.0.alpha0+ (x64) / LibreOffice Community
Build ID: 4c96abd81460977d413d4d28e891bbbac5769ede
CPU threads: 4; OS: Windows 10.0 Build 19044; UI render: Skia/Raster; VCL: win
Locale: de-DE (de_DE); UI: en-GB
Calc: CL

Please have a look at the steps, because there is nothing about copying as mentioned in bug summary
=> NEEDINFO
Comment 2 Gabor Kelemen (allotropia) 2022-09-04 12:32:37 UTC
Yes, it should be:

1, Open attachment 180723 [details]
2, Ctrl-A
3, Ctrl-C
4, Close Writer
Comment 3 Telesto 2022-09-04 14:29:45 UTC
Confirm
Version: 7.5.0.0.alpha0+ (x64) / LibreOffice Community
Build ID: dc92a4d973086ce8a6a5f75ba0f4d4c9ca05537a
CPU threads: 4; OS: Windows 6.3 Build 9600; UI render: Skia/Raster; VCL: win
Locale: nl-NL (nl_NL); UI: en-US
Calc: CL threaded
Comment 4 Telesto 2022-09-04 14:31:57 UTC
I assume bug 149548 comment 2 applies here too..
Comment 5 Aron Budea 2022-09-06 04:06:10 UTC
(In reply to Telesto from comment #4)
> I assume bug 149548 comment 2 applies here too..
It's somewhat similar. There's no crash before the commit identified in bug 106746 comment 11, but soffice.bin/exe processes linger on after quitting.
Note: Ctrl+A in this document crashes LO in these old versions, but Edit -> Select All worked fine.

https://cgit.freedesktop.org/libreoffice/core/commit/?id=db17d3c17c40d6b0e92392cf3c6e343d1d17b771
author		Noel Grandin <noel@peralex.com>	2015-11-10 13:36:34 +0200
committer	Noel Grandin <noelgrandin@gmail.com>	2015-11-11 07:16:20 +0000

"new loplugin: memoryvar"

Then going back further, before Michael's commit identified in bug 149548 comment 2, the processes terminate fine.

https://cgit.freedesktop.org/libreoffice/core/commit/?id=c4cf85766453982f1aa94a7f2cb22af19ed100be
author		Michael Stahl <mstahl@redhat.com>	2015-05-05 23:15:20 +0200
committer	Michael Stahl <mstahl@redhat.com>	2015-05-06 00:10:17 +0200

"sw: fix crash due to redlines on tables on ooo121112-2.docx"
Comment 6 Michael Stahl (allotropia) 2022-12-15 13:46:26 UTC
1. the steps in comment #2 do crash on master, but that is for another reason, that is already tracked at bug 147731

the stack matches the attachments on that bug, and after disabling the SwPageDesc-copying code pointed out in that bug it stops crashing

2. the problem cannot be reproduced on master, but it happens on 6.4 branch

here it happens that a redline from node 401 to 422 overlaps the start of a table but does not contain the end of the table.

when copying to the clipboard, the function lcl_DeleteRedlines deletes all the tracked deletion changes, and this causes the problem - some table cell's nodes are deleted, but the cell is not removed from the SwTable, which eventually causes use-after-free on shutdown, in some code to export the clipboard document to ODT.

the code in commit c4cf85766453982f1aa94a7f2cb22af19ed100be was supposed to split the offending redline at cell boundaries, but didn't work due to there being overlapping redlines, which was fixed by commit de49e1c55dc10ce1b59345af5cc49fde3adf65b7, which fixes this bug.

=> this is a duplicate of bug 149548

*** This bug has been marked as a duplicate of bug 149548 ***