Bug 153319 - Crash in: SwFrame::GetPhyPageNum() const or SwFrame::ImplFindPageFrame() shortly after opening ODT
Summary: Crash in: SwFrame::GetPhyPageNum() const or SwFrame::ImplFindPageFrame() shor...
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
7.4.5.1 release
Hardware: x86-64 (AMD64) Linux (All)
: medium critical
Assignee: Michael Stahl (allotropia)
URL:
Whiteboard: target:7.6.0 target:7.4.6 target:7.5....
Keywords: bibisected, bisected, regression
: 153315 (view as bug list)
Depends on:
Blocks: Crash
  Show dependency treegraph
 
Reported: 2023-02-02 08:49 UTC by Stéphane Guillou (stragu)
Modified: 2023-09-15 22:12 UTC (History)
6 users (show)

See Also:
Crash report or crash signature: ["SwFrame::GetPhyPageNum() const"]


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Stéphane Guillou (stragu) 2023-02-02 08:49:31 UTC
This bug was filed from the crash reporting server and is br-0a84cb90-bb30-418c-8a9e-07514d47cc5b.
=========================================

Steps:
1. Open attachment 185055 [details]
2. Let pages load, maybe scroll to update the number of pages in the status bar


I get two crash signatures with the same file:
- "SwFrame::ImplFindPageFrame()" - https://crashreport.libreoffice.org/stats/signature/SwFrame::ImplFindPageFrame()
- "SwFrame::GetPhyPageNum() const" - https://crashreport.libreoffice.org/stats/signature/SwFrame::GetPhyPageNum()%20const

First one is the most prevalent on crashreport website, with a count of more than 2000.

Versions that crash:

Version: 7.4.5.1 / LibreOffice Community
Build ID: 9c0871452b3918c1019dde9bfac75448afc4b57f
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: threaded

Version: 7.5.0.2 (X86_64) / LibreOffice Community
Build ID: c0dd1bc3f1a385d110b88e26ece634da94921f58
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: threaded

Version: 7.6.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 9740331d8bc56a9b6fbe3e4c1b26fb97f6639cc6
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: threaded

I did not manage to crash 7.3:

Version: 7.3.7.2 / LibreOffice Community
Build ID: e114eadc50a9ff8d8c8a0567d6da8f454beeb84f
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: threaded
Comment 1 Xisco Faulí 2023-02-02 09:31:08 UTC
No crash for me in

Version: 7.6.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: b052ec2f2fbe0f3044ba824c064a280a5ee9cd7f
CPU threads: 8; OS: Linux 5.10; UI render: default; VCL: gtk3
Locale: de-DE (es_ES.UTF-8); UI: en-US
Calc: threaded
Comment 2 Xisco Faulí 2023-02-02 09:48:38 UTC
oh, it didn't crash the first time, but if I open the document and I don't do anything (scrolling up or down ) LibreOffice crashes after a few seconds...
Comment 3 Xisco Faulí 2023-02-02 09:49:41 UTC
duplicate of bug 153315 ?
Comment 4 Stéphane Guillou (stragu) 2023-02-02 09:51:44 UTC
(In reply to Xisco Faulí from comment #3)
> duplicate of bug 153315 ?

In my opinion, no, because different set of crash signatures, different OSs, and this one does not need editing the style.
Comment 5 Stéphane Guillou (stragu) 2023-02-02 15:03:14 UTC
Bibisected with linux-64-7.4 to first bad commit a35860baa8cdc7c32313495b71b80ebfd15b6ada which points to core commit:

commit c79bf7865bff4e88cc201357370d8faeef8e6ad9
author	Michael Stahl <michael.stahl@allotropia.de>	Wed Mar 09 15:24:50 2022 +0100
committer	Michael Stahl <michael.stahl@allotropia.de>	Thu Mar 10 14:31:17 2022 +0100
tree 3884fa837dbb309a49c60fcf00d496779ec32d48
parent 84590ee3a9b681408d174449bf0cd3f9bd92e4e6
(related: tdf#139687) sw: ignore following footnotes in SwTextFrameBreak
Change-Id: I8f4c1332dc471a68539306a8788a0f59d0b12b1d
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131256

Michael, can you please have a look?
Comment 6 Caolán McNamara 2023-02-02 20:39:43 UTC
presumably https://gerrit.libreoffice.org/c/core/+/146534 isn't correct, but this is where I think I see a reference to a deleted object getting left behind and triggering later crashes
Comment 7 Commit Notification 2023-02-07 09:35:38 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/df2ad816288a4729c9cea8d14b7d590ac271d18b

Related: tdf#153319 don't destroy frame with IsDeleteForbidden set

It will be available in 7.6.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 8 Commit Notification 2023-02-09 11:00:15 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-7-4":

https://git.libreoffice.org/core/commit/59d37768321e2975efa2c8be5513d178de899eba

Related: tdf#153319 don't destroy frame with IsDeleteForbidden set

It will be available in 7.4.6.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 9 Commit Notification 2023-02-09 11:00:18 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-7-5":

https://git.libreoffice.org/core/commit/51512d7bce52002ca29c0e6c5264ac34166ede85

Related: tdf#153319 don't destroy frame with IsDeleteForbidden set

It will be available in 7.5.1.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 10 Stéphane Guillou (stragu) 2023-02-13 21:14:19 UTC
Thanks, Caolán. For what it's worth, confirming that commit df2ad816288a4729c9cea8d14b7d590ac271d18b on its own does not fix the crash.

Will test again when https://gerrit.libreoffice.org/c/core/+/146534 lands.
Comment 11 Commit Notification 2023-07-18 09:15:20 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/7e9b2b71db72b8c4c9c6ca83d08d3b6b05775ac8

tdf#153319 sw: don't move footnotes to follow if portions in master

It will be available in 24.2.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 12 Michael Stahl (allotropia) 2023-07-18 09:30:09 UTC
fixed on master
Comment 13 Michael Stahl (allotropia) 2023-07-18 16:09:29 UTC
*** Bug 153315 has been marked as a duplicate of this bug. ***
Comment 14 Yves Poissant 2023-07-18 18:37:46 UTC
I still get a crash. Way to reproduce:
- Load still the same file from 153315 "JAS - HEA - Linux Libertine.odt"
- Open the style panel -> paragraph styles -> Default Paragraph Style -> Edit style -> "Font" tab
- Change "Linux Libertine G" to "Linux Libertine Display G"
- On my system, I get a crash
Comment 15 Yves Poissant 2023-07-18 19:20:42 UTC
Sorry, I'm trying to help. I tried to send a crash report 8 times today but this doesn't seem to work, 1) I don't get back a URL so I can check the report and 2) even when I search the ID, from the generated .dmp filename, in the crash report web page, I get a page not found error.
Comment 16 Stéphane Guillou (stragu) 2023-07-20 12:01:59 UTC
(In reply to Yves Poissant from comment #15)
> Sorry, I'm trying to help. I tried to send a crash report 8 times today but
> this doesn't seem to work, 1) I don't get back a URL so I can check the
> report and 2) even when I search the ID, from the generated .dmp filename,
> in the crash report web page, I get a page not found error.

The crash reporter does not submit crash reports from master builds.
Can you share the version information from Help > About LibreOffice, to double-check that the build you used does include the patch?
Comment 17 Yves Poissant 2023-07-21 19:33:53 UTC
Here is the build: 6256d5fe2e7cb1bb002d5fe59527d3a3fbf6963f
Comment 18 Yves Poissant 2023-07-21 21:00:42 UTC
It seems I didn't have the latest build. This time I retried with build: 58a4459627a92958ef133868f72af10d8d56ccad
and I didn't get a crash whatever changes I made to the text.

I see some troublesome pages formatting with footnotes, some I can fix easily but sone I can't fix whatever I try. But since those don't result in a crash, this will be for another bug report.
Comment 19 Commit Notification 2023-07-27 13:25:03 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-7-5":

https://git.libreoffice.org/core/commit/f70f822532d96feebd24645009f0368405dac9e4

tdf#153319 sw: don't move footnotes to follow if portions in master

It will be available in 7.5.6.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 20 Commit Notification 2023-07-27 13:25:06 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-7-6":

https://git.libreoffice.org/core/commit/7d044e0293357153294d1ca86897ef4088608a82

tdf#153319 sw: don't move footnotes to follow if portions in master

It will be available in 7.6.1.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 21 Yves Poissant 2023-09-15 21:36:33 UTC
Hi there,

I still get crashes related to footnotes using:
Version: 7.6.0.3 (X86_64) / LibreOffice Community
Build ID: 69edd8b8ebc41d00b4de3915dc82f8f0fc3b6265
CPU threads: 12; OS: Windows 10.0 Build 22621; UI render: Skia/Raster; VCL: win
Locale: fr-CA (en_US); UI: en-US
Calc: CL threaded

The top of the stack frame shows ImplFindPageFrame()
For example, see: https://crashreport.libreoffice.org/stats/crash_details/fd2d1ff3-b17b-479e-8270-c89b13e54102

I have new repro steps.

Should I add this in this thread here or open a new bug report?
Comment 22 Telesto 2023-09-15 22:12:07 UTC
(In reply to Yves Poissant from comment #21)
> Hi there,
> 
> I still get crashes related to footnotes using:
> Version: 7.6.0.3 (X86_64) / LibreOffice Community
> Build ID: 69edd8b8ebc41d00b4de3915dc82f8f0fc3b6265
> CPU threads: 12; OS: Windows 10.0 Build 22621; UI render: Skia/Raster; VCL:
> win
> Locale: fr-CA (en_US); UI: en-US
> Calc: CL threaded
> 
> The top of the stack frame shows ImplFindPageFrame()
> For example, see:
> https://crashreport.libreoffice.org/stats/crash_details/fd2d1ff3-b17b-479e-
> 8270-c89b13e54102
> 
> I have new repro steps.
> 
> Should I add this in this thread here or open a new bug report?

I would say, a new bug report with this bug as see also