Bug 153319 - Crash in: SwFrame::GetPhyPageNum() const or SwFrame::ImplFindPageFrame() shortly after opening ODT
Summary: Crash in: SwFrame::GetPhyPageNum() const or SwFrame::ImplFindPageFrame() shor...
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
7.4.5.1 release
Hardware: x86-64 (AMD64) Linux (All)
: medium critical
Assignee: Not Assigned
URL:
Whiteboard: target:7.6.0 target:7.4.6 target:7.5.1
Keywords: bibisected, bisected, regression
Depends on:
Blocks: Crash
  Show dependency treegraph
 
Reported: 2023-02-02 08:49 UTC by Stéphane Guillou (stragu)
Modified: 2023-02-17 15:46 UTC (History)
5 users (show)

See Also:
Crash report or crash signature: ["SwFrame::GetPhyPageNum() const"]


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Stéphane Guillou (stragu) 2023-02-02 08:49:31 UTC
This bug was filed from the crash reporting server and is br-0a84cb90-bb30-418c-8a9e-07514d47cc5b.
=========================================

Steps:
1. Open attachment 185055 [details]
2. Let pages load, maybe scroll to update the number of pages in the status bar


I get two crash signatures with the same file:
- "SwFrame::ImplFindPageFrame()" - https://crashreport.libreoffice.org/stats/signature/SwFrame::ImplFindPageFrame()
- "SwFrame::GetPhyPageNum() const" - https://crashreport.libreoffice.org/stats/signature/SwFrame::GetPhyPageNum()%20const

First one is the most prevalent on crashreport website, with a count of more than 2000.

Versions that crash:

Version: 7.4.5.1 / LibreOffice Community
Build ID: 9c0871452b3918c1019dde9bfac75448afc4b57f
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: threaded

Version: 7.5.0.2 (X86_64) / LibreOffice Community
Build ID: c0dd1bc3f1a385d110b88e26ece634da94921f58
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: threaded

Version: 7.6.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 9740331d8bc56a9b6fbe3e4c1b26fb97f6639cc6
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: threaded

I did not manage to crash 7.3:

Version: 7.3.7.2 / LibreOffice Community
Build ID: e114eadc50a9ff8d8c8a0567d6da8f454beeb84f
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: threaded
Comment 1 Xisco Faulí 2023-02-02 09:31:08 UTC
No crash for me in

Version: 7.6.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: b052ec2f2fbe0f3044ba824c064a280a5ee9cd7f
CPU threads: 8; OS: Linux 5.10; UI render: default; VCL: gtk3
Locale: de-DE (es_ES.UTF-8); UI: en-US
Calc: threaded
Comment 2 Xisco Faulí 2023-02-02 09:48:38 UTC
oh, it didn't crash the first time, but if I open the document and I don't do anything (scrolling up or down ) LibreOffice crashes after a few seconds...
Comment 3 Xisco Faulí 2023-02-02 09:49:41 UTC
duplicate of bug 153315 ?
Comment 4 Stéphane Guillou (stragu) 2023-02-02 09:51:44 UTC
(In reply to Xisco Faulí from comment #3)
> duplicate of bug 153315 ?

In my opinion, no, because different set of crash signatures, different OSs, and this one does not need editing the style.
Comment 5 Stéphane Guillou (stragu) 2023-02-02 15:03:14 UTC
Bibisected with linux-64-7.4 to first bad commit a35860baa8cdc7c32313495b71b80ebfd15b6ada which points to core commit:

commit c79bf7865bff4e88cc201357370d8faeef8e6ad9
author	Michael Stahl <michael.stahl@allotropia.de>	Wed Mar 09 15:24:50 2022 +0100
committer	Michael Stahl <michael.stahl@allotropia.de>	Thu Mar 10 14:31:17 2022 +0100
tree 3884fa837dbb309a49c60fcf00d496779ec32d48
parent 84590ee3a9b681408d174449bf0cd3f9bd92e4e6
(related: tdf#139687) sw: ignore following footnotes in SwTextFrameBreak
Change-Id: I8f4c1332dc471a68539306a8788a0f59d0b12b1d
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131256

Michael, can you please have a look?
Comment 6 Caolán McNamara 2023-02-02 20:39:43 UTC
presumably https://gerrit.libreoffice.org/c/core/+/146534 isn't correct, but this is where I think I see a reference to a deleted object getting left behind and triggering later crashes
Comment 7 Commit Notification 2023-02-07 09:35:38 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/df2ad816288a4729c9cea8d14b7d590ac271d18b

Related: tdf#153319 don't destroy frame with IsDeleteForbidden set

It will be available in 7.6.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 8 Commit Notification 2023-02-09 11:00:15 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-7-4":

https://git.libreoffice.org/core/commit/59d37768321e2975efa2c8be5513d178de899eba

Related: tdf#153319 don't destroy frame with IsDeleteForbidden set

It will be available in 7.4.6.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 9 Commit Notification 2023-02-09 11:00:18 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-7-5":

https://git.libreoffice.org/core/commit/51512d7bce52002ca29c0e6c5264ac34166ede85

Related: tdf#153319 don't destroy frame with IsDeleteForbidden set

It will be available in 7.5.1.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 10 Stéphane Guillou (stragu) 2023-02-13 21:14:19 UTC
Thanks, Caolán. For what it's worth, confirming that commit df2ad816288a4729c9cea8d14b7d590ac271d18b on its own does not fix the crash.

Will test again when https://gerrit.libreoffice.org/c/core/+/146534 lands.