Bug 40250 - TABLE: Hidden section causes crash
Summary: TABLE: Hidden section causes crash
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
3.4.3 RC1
Hardware: All All
: medium critical
Assignee: Cédric Bosdonnat
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-08-20 07:51 UTC by Jean-Baptiste Faure
Modified: 2012-01-05 08:56 UTC (History)
3 users (show)

See Also:
Crash report or crash signature:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jean-Baptiste Faure 2011-08-20 07:51:48 UTC 
Follow-up of issue http://openoffice.org/bugzilla/show_bug.cgi?id=117395

Same crash for LibreOffice 3.4.3 rc1 and master under Ubuntu 10.04.

JBF
Comment 1 digital ant 2011-08-20 18:58:59 UTC 
Running OSX Snow Leopard 10.6.8 on a mac book, I dont exactly have a delete key (only backspace) but if I put my cursor after section 2 and try to backspace the section, I can confirm 3.4.3 rc1 crashes. Here is my output:

Process:         soffice [1914]
Path:            /Applications/LibreOffice.app/Contents/MacOS/soffice
Identifier:      org.libreoffice.script
Version:         3.4.3 (???)
Code Type:       X86 (Native)
Parent Process:  launchd [127]

Date/Time:       2011-08-20 21:53:18.665 -0400
OS Version:      Mac OS X 10.6.8 (10K549)
Report Version:  6

Interval Since Last Report:          89283 sec
Crashes Since Last Report:           1
Per-App Interval Since Last Report:  470 sec
Per-App Crashes Since Last Report:   1
Anonymous UUID:                      BC553B34-4860-4953-8D6F-06E4206C6D53

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x000000000000005a
Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   libswmxi.dylib                	0x26a88cff SwFrm::IsProtected() const + 15
1   libswmxi.dylib                	0x26987e67 SwEditShell::DeleteSel(SwPaM&, unsigned char*) + 359
2   libswmxi.dylib                	0x269882b6 SwEditShell::Delete() + 326
3   libswmxi.dylib                	0x27021d70 SwWrtShell::DelLeft() + 992
4   libswmxi.dylib                	0x26f0e57c SwBaseShell::ExecDelete(SfxRequest&) + 108
5   libsfxmxi.dylib               	0x00480a02 SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, unsigned char) + 530
6   libsfxmxi.dylib               	0x004741b8 SfxBindings::Execute_Impl(SfxRequest&, SfxSlot const*, SfxShell*) + 104
7   libsfxmxi.dylib               	0x0049a637 SfxDispatchController_Impl::dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XDispatchResultListener> const&) + 4903
8   libsfxmxi.dylib               	0x0049b0cf SfxOfficeDispatch::dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) + 367
9   libsvtmxi.dylib               	0x00bf0aa9 svt::AsyncAccelExec::impl_ts_asyncCallback(void*) + 137
10  libvclmxi.dylib               	0x019c25a5 vcl::EventPoster::Post(vcl::UserEvent*) + 117
11  libvclmxi.dylib               	0x0195882f vcl::LazyDeletor<Window>::~LazyDeletor() + 22239
12  libvclmxi.dylib               	0x01a23ed3 SalGetDesktopEnvironment() + 1043
13  libvclmxi.dylib               	0x01718190 Application::Yield(bool) + 96
14  libvclmxi.dylib               	0x0171827c Application::Execute() + 76
15  libsofficeapp.dylib           	0x0006a785 0x58000 + 75653
16  libvclmxi.dylib               	0x01720278 DeInitVCL() + 3624
17  libvclmxi.dylib               	0x01a2382b component_getFactory + 209547
18  libvclmxi.dylib               	0x01a28c5b SalGetDesktopEnvironment() + 20891
19  com.apple.AppKit              	0x9981b253 -[NSApplication run] + 917
20  com.apple.AppKit              	0x99813289 NSApplicationMain + 574
21  libvclmxi.dylib               	0x01a245b7 SalGetDesktopEnvironment() + 2807
22  libvclmxi.dylib               	0x01720321 SVMain() + 17
23  libsofficeapp.dylib           	0x00096f65 soffice_main + 245
24  org.libreoffice.script        	0x00001ebe main + 30
25  org.libreoffice.script        	0x00001822 start + 258
26  org.libreoffice.script        	0x00001749 start + 41

Thread 1:
0   libSystem.B.dylib             	0x91d71b5a semaphore_timedwait_signal_trap + 10
1   libSystem.B.dylib             	0x91d9f6e1 _pthread_cond_wait + 1066
2   libSystem.B.dylib             	0x91de826c pthread_cond_timedwait + 47
3   libuno_sal.dylib.3            	0x00035e38 rtl_cache_create + 728
4   libSystem.B.dylib             	0x91d9f259 _pthread_start + 345
5   libSystem.B.dylib             	0x91d9f0de thread_start + 34

Thread 2:  Dispatch queue: com.apple.libdispatch-manager
0   libSystem.B.dylib             	0x91d98382 kevent + 10
1   libSystem.B.dylib             	0x91d98a9c _dispatch_mgr_invoke + 215
2   libSystem.B.dylib             	0x91d97f59 _dispatch_queue_invoke + 163
3   libSystem.B.dylib             	0x91d97cfe _dispatch_worker_thread2 + 240
4   libSystem.B.dylib             	0x91d97781 _pthread_wqthread + 390
5   libSystem.B.dylib             	0x91d975c6 start_wqthread + 30

Thread 3:
0   libSystem.B.dylib             	0x91e39096 accept$NOCANCEL$UNIX2003 + 10
1   libSystem.B.dylib             	0x91e37eff accept + 32
2   libuno_sal.dylib.3            	0x00011d3a osl_acceptPipe + 58
3   libsofficeapp.dylib           	0x00093aae 0x58000 + 244398
4   libsofficeapp.dylib           	0x00095ca2 0x58000 + 253090
5   libuno_sal.dylib.3            	0x0000c1b9 osl_setThreadName + 569
6   libSystem.B.dylib             	0x91d9f259 _pthread_start + 345
7   libSystem.B.dylib             	0x91d9f0de thread_start + 34

Thread 4:  com.apple.CFSocket.private
0   libSystem.B.dylib             	0x91d90ac6 select$DARWIN_EXTSN + 10
1   com.apple.CoreFoundation      	0x9a6d5c83 __CFSocketManager + 1091
2   libSystem.B.dylib             	0x91d9f259 _pthread_start + 345
3   libSystem.B.dylib             	0x91d9f0de thread_start + 34

Thread 0 crashed with X86 Thread State (32-bit):
  eax: 0x00000001  ebx: 0x26987d14  ecx: 0xbfffec38  edx: 0xbfffec38
  edi: 0xbfffecfc  esi: 0x00000000  ebp: 0xbfffecb8  esp: 0xbfffeca0
   ss: 0x00000023  efl: 0x00010286  eip: 0x26a88cff   cs: 0x0000001b
   ds: 0x00000023   es: 0x00000023   fs: 0x00000000   gs: 0x0000000f
  cr2: 0x0000005a
Comment 2 Jeffrey 2011-08-20 19:37:17 UTC 
Downloaded attachment on OO. Crash confirmed for LibreOffice 3.4  340m1(Build:103)
 on OpenSuse Linux.
Comment 3 Rainer Bielefeld Retired 2011-08-22 03:45:49 UTC 
[Reproducible] with sample from OOo Issue and "LibreOffice 3.4.3 RC1  – WIN7  Home Premium  (64bit) English UI [OOO340m1 (Build:301)]".

Steps top reproduce:
1. Download sample document (first attachment) from OOo issue
2. Open document
3. click behind word "Texta"
4. <Del>
   expected: everything expect crash
   actual: crash

@All:
For submitting bug reports you should try <http://wiki.documentfoundation.org/BugReport_Details>

@Cédric:
Please feel free to reassign (or reset Assignee to default) if it’s not your area or if provided information is not sufficient. Please set Status to ASSIGNED if you accept this Bug.
Comment 4 Björn Michaelsen 2011-12-23 13:26:49 UTC 
Since all new unconfirmed bugs start in state UNCONFIRMED now and old unconfirmed bugs were moved to NEEDINFO with a explanatory comment, all bugs promoted above those bug states to NEW and later are automatically confirmed making the CONFIRMED whiteboard status redundant. Thus it will be removed.