Bug 163539 - Odd LO Writer crash in SwTextFormatter::InsertPortion while editing the document / at fileopen
Summary: Odd LO Writer crash in SwTextFormatter::InsertPortion while editing the docum...
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
6.0.0.3 release
Hardware: All All
: medium critical
Assignee: Not Assigned
URL:
Whiteboard:
Keywords: bibisectRequest, regression, wantBacktrace
Depends on:
Blocks: File-Opening Crash
  Show dependency treegraph
 
Reported: 2024-10-20 05:58 UTC by Benjamim Sousa
Modified: 2025-03-13 12:46 UTC (History)
4 users (show)

See Also:
Crash report or crash signature: ["SwTextFormatter::InsertPortion(SwTextFormatInfo &,SwLinePortion *)","SwTextFormatter::InsertPortion","SwTextFormatter::InsertPortion(SwTextFormatInfo&, SwLinePortion*) const"]


Attachments
File with such bug (756.23 KB, application/vnd.oasis.opendocument.text)
2024-11-09 16:22 UTC, Benjamim Sousa
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Benjamim Sousa 2024-10-20 05:58:01 UTC
Description:
Sorry for not being clear in the title i couldn't be clearer than this but the fact is:
I'm writing math with TexMaths extension and the document has a lot of svg, sections, toc, equations etc.

Later when i decided to change the text font the program crashed. Now i decided to type something but i'm not able to, it's crashing just after a few words typed.
Here the crash report: https://crashreport.libreoffice.org/stats/crash_details/cabcd0be-579c-46fd-9cdf-41ae0b5d27d6

I also tested this document with a fresh installation and the behavior is worst it crashes right after it opens.

I'll try to provide whatever info i can. Thanks in advance. 

Version: 24.8.2.1 (X86_64) / LibreOffice Community
Build ID: 0f794b6e29741098670a3b95d60478a65d05ef13
CPU threads: 24; OS: Windows 10 X86_64 (10.0 build 19045); UI render: Skia/Raster; VCL: win
Locale: pt-BR (pt_BR); UI: en-US
Calc: threaded

Steps to Reproduce:
1. Open the document
2. Write some stuff or change the font

Actual Results:
It suddenly crash

Expected Results:
Make changes to the document, test some fonts


Reproducible: Always


User Profile Reset: Yes

Additional Info:
It's kinda hard to explain how it really happens. I use a two collumns layout and have SVG on it and a list for questions. In a specific point of the text I can't go any further (when the tex would go to the next line), it stop there crashing.

Hope it helps!
Comment 1 Dieter 2024-11-05 06:29:59 UTC
Thank you for reporting the bug. Does it only happen when using the extension? Is it possible for you to provide a sample document?
=> NEEDINFO
Comment 2 Benjamim Sousa 2024-11-09 16:22:39 UTC
Created attachment 197503 [details]
File with such bug

I openned it and tested on a sandbox with a LO fresh install, with no extensions.

Steps to reproduce:
1. go to sections -> unhide 'Arco de Circunferência e Ângulos'
if it not crash do:
2. go to "Matemática 1" heading -> go to exercise 4 (the one starting with 'ITA-SP 1973')
3. then inside the blue frame after it, on the line below "Resolução:" press enter two times.
Comment 3 Benjamim Sousa 2024-11-09 16:23:33 UTC
Version: 24.8.2.1 (X86_64) / LibreOffice Community
Build ID: 0f794b6e29741098670a3b95d60478a65d05ef13
CPU threads: 24; OS: Windows 10 X86_64 (10.0 build 19041); UI render: Skia/Raster; VCL: win
Locale: en-US (en_US); UI: en-US
Calc: threaded
Comment 4 Benjamim Sousa 2024-11-09 16:26:56 UTC
This crash is about breaking lines.

The one with the fonts i don't know to reproduce now.
Comment 5 QA Administrators 2024-11-11 03:13:35 UTC Comment hidden (obsolete)
Comment 6 mkt 2024-11-11 10:07:08 UTC
Hello, 

I could reproduce this issue in both version 24.8.2.1 and 25.2.0.0 by opening the attached file and typing some random text. The Writer crashed.


Version: 24.8.2.1 (X86_64) / LibreOffice Community
Build ID: 0f794b6e29741098670a3b95d60478a65d05ef13
CPU threads: 2; OS: Windows 10 X86_64 (10.0 build 19045); UI render: Skia/Raster; VCL: win
Locale: en-US (en_US); UI: en-US
Calc: threaded



Version: 25.2.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: ce4ae4f082d8fe80da242836c57d55a456eac5e0
CPU threads: 2; OS: Windows 10 X86_64 (10.0 build 19045); UI render: Skia/Raster; VCL: win
Locale: en-US (en_US); UI: en-US
Calc: threaded
Comment 7 Stéphane Guillou (stragu) 2024-11-11 14:28:10 UTC
Attachment 197503 [details] crashes on fileopen for me with:

Version: 24.2.6.2 (X86_64) / LibreOffice Community
Build ID: ef66aa7e36a1bb8e65bfbc63aba53045a14d0871
CPU threads: 8; OS: Linux 6.8; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
https://crashreport.libreoffice.org/stats/crash_details/3c9c04ae-b729-404e-8ebd-ad4494787fe9

Version: 24.8.2.1 (X86_64) / LibreOffice Community
Build ID: 0f794b6e29741098670a3b95d60478a65d05ef13
https://crashreport.libreoffice.org/stats/crash_details/170c1b9f-dece-44a1-9150-cfa8f51a06a2

And own recent build:
Version: 25.2.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 0746914ed0778ff82329162508985fc6f7655aba

7.0: https://crashreport.libreoffice.org/stats/crash_details/78321509-4ac3-4fa1-a3d4-d7337bd0af21

6.0: https://crashreport.libreoffice.org/stats/crash_details/dea7eb5b-41cf-40f1-a8c4-b59634048914

No crash in 5.4.0.2.
Comment 8 Eric Rodriguez 2024-12-06 00:36:33 UTC Comment hidden (obsolete)
Comment 9 Eric Rodriguez 2024-12-06 23:32:09 UTC Comment hidden (obsolete)
Comment 10 Stéphane Guillou (stragu) 2024-12-07 00:08:00 UTC
Still crashes for me on fileopen with own master build:

Version: 25.8.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 6926c820ceea1a1337a97b0afda95b072027a6ff
CPU threads: 8; OS: Linux 6.8; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: CL threaded

Oldest builds in linux-64-5.4 and linux-64-6.0 repos also crash, but 5.4.0.2 in the linux-64-releases repo does not crash.

@Xisco, any idea why that might be the case?

This crashes:

Version: 5.4.0.1.0+
Build ID: 238d6e367b3bcbc14cc7579dda866488a2c7f4c3
CPU threads: 8; OS: Linux 6.8; UI render: default; VCL: x11; 
Locale: en-AU (en_AU.UTF-8); Calc: CL

This doesn't crash:

Version: 5.4.0.2
Build ID: 2b906d450a44f2bbe506dcd22c51b3fa11dc65fd
CPU threads: 8; OS: Linux 6.8; UI render: default; VCL: x11; 
Locale: en-AU (en_AU.UTF-8); Calc: group

(only difference between the two logs is the branching, version bumping and tagging)
Comment 11 Stéphane Guillou (stragu) 2024-12-07 00:08:23 UTC
Stack in the terminal:

Fatal exception: Signal 6
Stack:
/home/stragu/lobibi/linux-64-5.4/instdir/program/libuno_sal.so.3(+0x3bc60)[0x7b336d63bc60]
/home/stragu/lobibi/linux-64-5.4/instdir/program/libuno_sal.so.3(+0x3bdd0)[0x7b336d63bdd0]
/lib/x86_64-linux-gnu/libc.so.6(+0x45320)[0x7b336cc45320]
/lib/x86_64-linux-gnu/libc.so.6(pthread_kill+0x11c)[0x7b336cc9eb1c]
/lib/x86_64-linux-gnu/libc.so.6(gsignal+0x1e)[0x7b336cc4526e]
/lib/x86_64-linux-gnu/libc.so.6(abort+0xdf)[0x7b336cc288ff]
/home/stragu/lobibi/linux-64-5.4/instdir/program/libvcllo.so(+0x5b13b5)[0x7b33625b13b5]
/home/stragu/lobibi/linux-64-5.4/instdir/program/libvcllo.so(_ZN11Application5AbortERKN3rtl8OUStringE+0x9a)[0x7b336251ad8a]
/home/stragu/lobibi/linux-64-5.4/instdir/program/libsofficeapp.so(+0x216ff)[0x7b336d0216ff]
/home/stragu/lobibi/linux-64-5.4/instdir/program/libvcllo.so(+0x520a2a)[0x7b3362520a2a]
/home/stragu/lobibi/linux-64-5.4/instdir/program/libuno_sal.so.3(+0x16ba2)[0x7b336d616ba2]
/home/stragu/lobibi/linux-64-5.4/instdir/program/libuno_sal.so.3(+0x3bd8f)[0x7b336d63bd8f]
/lib/x86_64-linux-gnu/libc.so.6(+0x45320)[0x7b336cc45320]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(+0x73f679)[0x7b330f53f679]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(+0x74505e)[0x7b330f54505e]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(+0x745ff9)[0x7b330f545ff9]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(_ZN11SwTextFrame10FormatLineER15SwTextFormatterb+0xa4)[0x7b330f51ecb4]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(_ZN11SwTextFrame7Format_ER15SwTextFormatterR16SwTextFormatInfob+0x3bc)[0x7b330f522b2c]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(+0x774849)[0x7b330f574849]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(_ZN11SwTextFrame10TestFormatEPK7SwFrameRlRb+0x4f)[0x7b330f57599f]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(+0x649a1b)[0x7b330f449a1b]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(+0x64a88b)[0x7b330f44a88b]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(+0x65528b)[0x7b330f45528b]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(+0x647cd2)[0x7b330f447cd2]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(_ZN7SwFrame11PrepareMakeEP12OutputDevice+0x208)[0x7b330f444d68]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(+0x658886)[0x7b330f458886]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(+0x6d77db)[0x7b330f4d77db]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(+0x6b3865)[0x7b330f4b3865]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(+0x646406)[0x7b330f446406]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(+0x6b2fdf)[0x7b330f4b2fdf]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(_ZN7SwFrame11PrepareMakeEP12OutputDevice+0x208)[0x7b330f444d68]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(+0x67c47a)[0x7b330f47c47a]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(+0x67c7b6)[0x7b330f47c7b6]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(+0x67c7b6)[0x7b330f47c7b6]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(+0x67dc79)[0x7b330f47dc79]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(+0x67e663)[0x7b330f47e663]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(+0x67f4da)[0x7b330f47f4da]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(_ZN11SwViewShell10LayoutIdleEv+0xc7)[0x7b330f7c9487]
/home/stragu/lobibi/linux-64-5.4/instdir/program/../program/libswlo.so(+0x4bfd56)[0x7b330f2bfd56]
/home/stragu/lobibi/linux-64-5.4/instdir/program/libvcllo.so(+0x50dc48)[0x7b336250dc48]
/home/stragu/lobibi/linux-64-5.4/instdir/program/libvcllo.so(_ZN9Scheduler21ProcessTaskSchedulingEb+0xb1)[0x7b336250de21]
/home/stragu/lobibi/linux-64-5.4/instdir/program/libvcllo.so(_ZN11Application5YieldEv+0x66)[0x7b336251b686]
/home/stragu/lobibi/linux-64-5.4/instdir/program/libvcllo.so(_ZN11Application7ExecuteEv+0x45)[0x7b336251d3f5]
/home/stragu/lobibi/linux-64-5.4/instdir/program/libsofficeapp.so(+0x2a2ca)[0x7b336d02a2ca]
/home/stragu/lobibi/linux-64-5.4/instdir/program/libvcllo.so(+0x522146)[0x7b3362522146]
/home/stragu/lobibi/linux-64-5.4/instdir/program/libvcllo.so(_Z6SVMainv+0x22)[0x7b3362522232]
/home/stragu/lobibi/linux-64-5.4/instdir/program/libsofficeapp.so(soffice_main+0x8a)[0x7b336d0555ba]
/home/stragu/lobibi/linux-64-5.4/instdir/program/soffice.bin[0x40071b]
/lib/x86_64-linux-gnu/libc.so.6(+0x2a1ca)[0x7b336cc2a1ca]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x8b)[0x7b336cc2a28b]
/home/stragu/lobibi/linux-64-5.4/instdir/program/soffice.bin[0x400751]
Comment 12 Noel Grandin 2025-03-13 12:46:36 UTC
Noting that whoever looks at this, should check it with ASAN, because ASAN indicates that a problem occurs well before the actual crash. ASAN says:

sw/source/core/text/itrform2.cxx:3183:35: runtime error: member call on address 0x79a57c7a0c80 which does not point to an object of type 'SwLinePortion'
0x79a57c7a0c80: note: object has invalid vptr
 00 00 00 00  b4 a3 0d 00 00 00 00 00  00 00 00 00 00 00 00 00  47 01 00 00 00 00 00 00  00 00 00 00
              ^~~~~~~~~~~~~~~~~~~~~~~
              invalid vptr
    #0 0x784549ffe72f in SwTextFormatter::NewFlyCntPortion(SwTextFormatInfo&, SwTextAttr*) const sw/source/core/text/itrform2.cxx:3183:35
    #1 0x78454a299a81 in SwTextFormatter::NewExtraPortion(SwTextFormatInfo&) sw/source/core/text/txtfld.cxx:283:20
    #2 0x784549fcd9dc in SwTextFormatter::NewPortion(SwTextFormatInfo&, std::optional<o3tl::strong_int<int, Tag_TextFrameIndex>>) sw/source/core/text/itrform2.cxx:1860:28
    #3 0x784549fbb3f5 in SwTextFormatter::BuildPortions(SwTextFormatInfo&) sw/source/core/text/itrform2.cxx:440:27
    #4 0x784549fe6cf4 in SwTextFormatter::FormatLine(o3tl::strong_int<int, Tag_TextFrameIndex>) sw/source/core/text/itrform2.cxx:2076:9
    #5 0x784549e13433 in SwTextFrame::FormatLine(SwTextFormatter&, bool) sw/source/core/text/frmform.cxx:1460:44
    #6 0x784549e1ebe6 in SwTextFrame::Format_(SwTextFormatter&, SwTextFormatInfo&, bool) sw/source/core/text/frmform.cxx:1827:23