Bug 162035 - Cursor movement causes instant crash with spacing 2 and kanji with furigana
Summary: Cursor movement causes instant crash with spacing 2 and kanji with furigana
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
7.6.4.1 release
Hardware: x86-64 (AMD64) All
: medium critical
Assignee: Michael Stahl (allotropia)
URL:
Whiteboard: target:25.2.0 target:24.8.0.3 target:...
Keywords: bibisected, bisected, regression, wantBacktrace
Depends on:
Blocks: Ruby Crash
  Show dependency treegraph
 
Reported: 2024-07-14 17:21 UTC by 19markos96
Modified: 2024-08-08 22:02 UTC (History)
2 users (show)

See Also:
Crash report or crash signature: ["SwTextCursor::GetModelPositionForViewPoint(SwPosition*, Point const&, bool, SwCursorMoveState*) const"]


Attachments
Crash example (7.79 MB, video/mp4)
2024-07-14 17:21 UTC, 19markos96
Details
sample ODT (9.60 KB, application/vnd.oasis.opendocument.text)
2024-07-30 07:22 UTC, Stéphane Guillou (stragu)
Details

Note You need to log in before you can comment on or make changes to this bug.
Description 19markos96 2024-07-14 17:21:23 UTC
Created attachment 195292 [details]
Crash example

Steps:
1 - Create a new file and change spacing to 2
2 - Type a kanji and add furigana on top of it, do the same thing on the next line
3 - On this second line, type any character to the left of the kanji
4 - Position your cursor below this last kanji and then move it upwards, crash should occur
(attached a video file reproducing this)

Although I couldn't find this exact bug mentioned anywhere, I did try some tips I read online for crashing: restarting in safe mode, disabling hardware acceleration / skia rendering, deleting the lock files... but nothing helped. Changing font type / size didn't solve it either.

Extra Info:
Version: 24.2.5.2 (X86_64) / LibreOffice Community
Build ID: bffef4ea93e59bebbeaf7f431bb02b1a39ee8a59
CPU threads: 4; OS: Windows 10.0 Build 19045; UI render: default; VCL: win
Locale: es-ES (es_ES); UI: en-US
Calc: threaded
Comment 1 Stéphane Guillou (stragu) 2024-07-30 07:20:16 UTC
I could also reproduce on Linux:

Version: 24.2.5.2 (X86_64) / LibreOffice Community
Build ID: bffef4ea93e59bebbeaf7f431bb02b1a39ee8a59
CPU threads: 8; OS: Linux 6.5; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: threaded

It crashes in sw/source/core/text/porlay.hxx:160 :

https://crashreport.libreoffice.org/stats/crash_details/034d8625-343c-4c53-a4f5-69f21f60edcf

Also in recent daily trunk build:

Version: 25.2.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 233af54afb6e493c3538efe7c93d0f53f1b4c3ab
CPU threads: 8; OS: Linux 6.5; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: CL threaded
Comment 2 Stéphane Guillou (stragu) 2024-07-30 07:22:12 UTC
Created attachment 195597 [details]
sample ODT

Open this file, hover over text / ruby text -> crash.

Also in 7.6: https://crashreport.libreoffice.org/stats/crash_details/6c9512ef-f3dc-42f8-84d3-da4e1e0f6480

Version: 7.6.7.2 (X86_64) / LibreOffice Community
Build ID: dd47e4b30cb7dab30588d6c79c651f218165e3c5
CPU threads: 8; OS: Linux 6.5; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: threaded
Comment 3 Stéphane Guillou (stragu) 2024-07-30 07:23:55 UTC
No repro in 7.3.7.2:

Version: 7.3.7.2 / LibreOffice Community
Build ID: 30(Build:2)
CPU threads: 8; OS: Linux 6.5; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Ubuntu package version: 1:7.3.7-0ubuntu0.22.04.5
Calc: threaded
Comment 4 Stéphane Guillou (stragu) 2024-07-30 11:31:21 UTC
Bibisected with linux-64-7.6 to first bad build [26200cbdb491b1f1721f32ad66eba79381e255da] which is 4db49918efa3ae13a74d8a1450f10fb25393ce86, a cherrypick of:

commit 468e5b8e0a7fefe1ca53faeb15f5f6527c37a268
author	Michael Stahl 	Fri Oct 27 16:18:44 2023 +0200
committer	Michael Stahl 	Thu Nov 02 10:39:12 2023 +0100
tdf#157816 sw: fix getting position in field portion follow
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158570

...which matches the crash reports.

Crashes consistently with sample file by moving mouse pointer between the two paragraphs.

Michael, can you please have a look?
Comment 5 Commit Notification 2024-07-31 13:41:54 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/97dcffe188f0dec4dbd0af894fe7739e1a2abcbb

tdf#162035 sw: fix crash with field in SwMultiPortion

It will be available in 25.2.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 6 Michael Stahl (allotropia) 2024-07-31 14:02:14 UTC
crash is fixed
Comment 7 Commit Notification 2024-07-31 18:44:37 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-24-8":

https://git.libreoffice.org/core/commit/ffda0b7d1712e3fdc92bb4b586a40e27f1db244f

tdf#162035 sw: fix crash with field in SwMultiPortion

It will be available in 24.8.1.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 8 Commit Notification 2024-07-31 18:44:40 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-24-2":

https://git.libreoffice.org/core/commit/c988aafbb5fde11a907ba508f6ab7558336fa55d

tdf#162035 sw: fix crash with field in SwMultiPortion

It will be available in 24.2.6.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 9 Commit Notification 2024-08-08 19:25:25 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-24-8-0":

https://git.libreoffice.org/core/commit/0b46d8046aeb42af51308b6b1fa6278d37f74e8f

tdf#162035 sw: fix crash with field in SwMultiPortion

It will be available in 24.8.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.