Bug 151736 - Opening Writer document with direct formatting crashes whole LO
Summary: Opening Writer document with direct formatting crashes whole LO
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
7.4.0.0 alpha0+
Hardware: x86-64 (AMD64) All
: medium critical
Assignee: Not Assigned
URL:
Whiteboard: target:7.5.0 target:7.4.3
Keywords: bibisected, bisected, regression
: 151858 152015 (view as bug list)
Depends on:
Blocks: CPU-AT-100%
  Show dependency treegraph
 
Reported: 2022-10-24 15:00 UTC by Robert Großkopf
Modified: 2024-02-20 04:05 UTC (History)
8 users (show)

See Also:
Crash report or crash signature:


Attachments
Open the file in LO 7.4 - LO won't load the file, will freeze. (36.75 KB, application/vnd.oasis.opendocument.text)
2022-10-24 15:00 UTC, Robert Großkopf
Details
Screenshot 1 showing LO needs more and more ram (156.68 KB, image/png)
2022-10-24 23:28 UTC, Richard Kraut
Details
Screenshot 2 showing LO needs more and more ram (177.64 KB, image/png)
2022-10-24 23:28 UTC, Richard Kraut
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Großkopf 2022-10-24 15:00:40 UTC
Created attachment 183237 [details]
Open the file in LO 7.4 - LO won't load the file, will freeze.

Download the attached Writer file.
Try to open the file in LO 7.4.2.3.
LO won't load the file.
You have to kill LO.

Try the same with LO 7.3.6.2.
File will be loaded without any problems.

Now the file has been opened in LO 7.3.6.2.
Mark all content and set Format → Clear direct Formatting.
Save the file.

This file could be opened in LO 7.4.2.3.

All tested with OpenSUSE 15.3 and different versions of LO. Buggy behavior first appears with LO 7.4.0.3
Comment 1 GwenDragon 2022-10-24 15:15:32 UTC
Confirmed for Win 10 22H2

Version: 7.4.2.3 (x64) / LibreOffice Community
Build ID: 382eef1f22670f7f4118c8c2dd222ec7ad009daf
CPU threads: 4; OS: Windows 10.0 Build 19045; UI render: Skia/Vulkan; VCL: win
Locale: de-DE (de_DE); UI: de-DE
Comment 2 Julien Nabet 2022-10-24 17:52:49 UTC
On pc Debian x86-64 with master sources updated today, I could reproduce this.

Loop in this part:
#0  0x00007f321226f5d1 in SwFrame::GetDep() const (this=0x0) at sw/source/core/inc/frame.hxx:479
#1  0x00007f3212f67305 in SwTextFrame::GetTextNodeFirst() const (this=0x55ecf2ecc9d0) at sw/source/core/text/txtfrm.cxx:1335
#2  0x00007f3212f6c4c5 in SwTextFrame::GetDoc() const (this=0x55ecf2ecc9d0) at sw/source/core/text/txtfrm.cxx:1340
#3  0x00007f3212c5cb15 in SwTextFrame::GetDoc() (this=0x55ecf2ecc9d0) at sw/source/core/inc/txtfrm.hxx:467
#4  0x00007f3212ea728d in SwTextFormatter::InsertPortion(SwTextFormatInfo&, SwLinePortion*) (this=0x7ffd41530f70, rInf=..., pPor=0x55ecfc4ac9c0) at sw/source/core/text/itrform2.cxx:352
#5  0x00007f3212eaa35f in SwTextFormatter::BuildPortions(SwTextFormatInfo&) (this=0x7ffd41530f70, rInf=...) at sw/source/core/text/itrform2.cxx:757
#6  0x00007f3212eb19e3 in SwTextFormatter::FormatLine(o3tl::strong_int<int, Tag_TextFrameIndex>) (this=0x7ffd41530f70, nStartPos=...) at sw/source/core/text/itrform2.cxx:1932
#7  0x00007f3212e5d173 in SwTextFrame::FormatLine(SwTextFormatter&, bool) (this=0x55ecf2ecc9d0, rLine=..., bPrev=false) at sw/source/core/text/frmform.cxx:1212
#8  0x00007f3212e5f593 in SwTextFrame::Format_(SwTextFormatter&, SwTextFormatInfo&, bool) (this=0x55ecf2ecc9d0, rLine=..., rInf=..., bAdjust=false) at sw/source/core/text/frmform.cxx:1572
#9  0x00007f3212e602ca in SwTextFrame::Format_(OutputDevice*, SwParaPortion*) (this=0x55ecf2ecc9d0, pRenderContext=0x55ecf2f33810, pPara=0x55ecf3208ce0) at sw/source/core/text/frmform.cxx:1762
#10 0x00007f3212e6166e in SwTextFrame::Format(OutputDevice*, SwBorderAttrs const*) (this=0x55ecf2ecc9d0, pRenderContext=0x55ecf2f33810) at sw/source/core/text/frmform.cxx:1951
#11 0x00007f3212c05214 in SwContentFrame::MakeAll(OutputDevice*) (this=0x55ecf2ecc9d0) at sw/source/core/layout/calcmove.cxx:1518
#12 0x00007f3212bfce02 in SwFrame::PrepareMake(OutputDevice*) (this=0x55ecf2ecc9d0, pRenderContext=0x55ecf2f33810) at sw/source/core/layout/calcmove.cxx:375
#13 0x00007f3212d5fa1e in SwFrame::Calc(OutputDevice*) const (this=0x55ecf2ecc9d0, pRenderContext=0x55ecf2f33810) at sw/source/core/layout/trvlfrm.cxx:1803
#14 0x00007f3212c063b8 in SwContentFrame::MakeAll(OutputDevice*) (this=0x55ecf2e0f180) at sw/source/core/layout/calcmove.cxx:1707
#15 0x00007f3212bfce02 in SwFrame::PrepareMake(OutputDevice*) (this=0x55ecf2e0f180, pRenderContext=0x55ecf2f33810) at sw/source/core/layout/calcmove.cxx:375
#16 0x00007f3212d5fa1e in SwFrame::Calc(OutputDevice*) const (this=0x55ecf2e0f180, pRenderContext=0x55ecf2f33810) at sw/source/core/layout/trvlfrm.cxx:1803
#17 0x00007f3212c063b8 in SwContentFrame::MakeAll(OutputDevice*) (this=0x55ecf2e1c510) at sw/source/core/layout/calcmove.cxx:1707

and after some gdb debug more specifically in:
sw/source/core/text/itrform2.cxx

Michael: thought you might be interested in this one.
Comment 3 Richard Kraut 2022-10-24 23:28:02 UTC
Created attachment 183247 [details]
Screenshot 1 showing LO needs more and more ram
Comment 4 Richard Kraut 2022-10-24 23:28:55 UTC
Created attachment 183248 [details]
Screenshot 2 showing LO needs more and more ram
Comment 5 Richard Kraut 2022-10-24 23:32:57 UTC
I also confirm the bug.

One new thing is that LO needs more and more memory during the time it hangs and trys to open the document.

I've taken two screenshots which are showing this instance.

Version: 7.4.1.2 / LibreOffice Community
Build ID: 40(Build:2)
CPU threads: 32; OS: Linux 5.19; UI render: default; VCL: gtk3
Locale: de-DE (de_DE.UTF-8); UI: de-DE
Debian package version: 1:7.4.1-1~bpo11+2
Calc: CL
OS: Debian GNU/Linux 11.5 (amd64)
Comment 6 Richard Kraut 2022-10-24 23:39:04 UTC
(In reply to Richard Kraut from comment #5)
> I also confirm the bug.
> 
> One new thing is that LO needs more and more memory during the time it hangs
> and trys to open the document.
> 
> I've taken two screenshots which are showing this instance.
> 
> Version: 7.4.1.2 / LibreOffice Community
> Build ID: 40(Build:2)
> CPU threads: 32; OS: Linux 5.19; UI render: default; VCL: gtk3
> Locale: de-DE (de_DE.UTF-8); UI: de-DE
> Debian package version: 1:7.4.1-1~bpo11+2
> Calc: CL
> OS: Debian GNU/Linux 11.5 (amd64)

One thing I've forgot but you'll see it also in the screenshots. LibreOffice is occupying one whole CPU core with 100% usage during it hangs.
Comment 7 Gabor Kelemen (allotropia) 2022-10-27 13:47:45 UTC
Bibisected in linux-7.4 to:

https://git.libreoffice.org/core/+/9a44807ff3a11afa8f7ce9857ae6a6144a61d481

author	Noel Grandin <noel.grandin@collabora.co.uk>	Wed Mar 02 17:58:31 2022 +0200
committer	Noel Grandin <noel.grandin@collabora.co.uk>	Thu Mar 03 08:52:49 2022 +0100

use SfxItemSet::GetItemIfSet in sw/source/core/txt

Adding CC to: Noel Grandin
Comment 8 Commit Notification 2022-10-27 19:04:19 UTC
Noel Grandin committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/7d63176bcfbc80fc4045a0f0580c5bf9ccea7a89

tdf#151736 writer direct formatting crash

It will be available in 7.5.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 9 Robert Großkopf 2022-10-28 16:07:38 UTC
(In reply to Commit Notification from comment #8)
> Noel Grandin committed a patch related to this issue.
> It has been pushed to "master":
> 
> https://git.libreoffice.org/core/commit/
> 7d63176bcfbc80fc4045a0f0580c5bf9ccea7a89
> 
> tdf#151736 writer direct formatting crash
> 
> It will be available in 7.5.0.
> 
Tested in
Version: 7.5.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 876d9d6d333cafc0649abebc757f397faf86fc4d
CPU threads: 6; OS: Linux 5.3; UI render: default; VCL: kf5 (cairo+xcb)
Locale: de-DE (de_DE.UTF-8); UI: en-US
Calc: threaded

Document could be loaded without any problem.
Thanks for the fast fix.
Could it also be backported to LO 7.4?
Comment 10 Commit Notification 2022-11-01 18:40:15 UTC
Noel Grandin committed a patch related to this issue.
It has been pushed to "libreoffice-7-4":

https://git.libreoffice.org/core/commit/14f019827d73178b3bdf166c642720f49314a514

tdf#151736 writer direct formatting crash

It will be available in 7.4.3.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 11 Robert Großkopf 2022-11-12 18:45:33 UTC
*** Bug 152015 has been marked as a duplicate of this bug. ***
Comment 12 Stéphane Guillou (stragu) 2024-02-20 04:05:00 UTC
*** Bug 151858 has been marked as a duplicate of this bug. ***