Bug 51845 - CRASH on EDITING undo for section deletion
Summary: CRASH on EDITING undo for section deletion
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
(earliest affected) Master
Hardware: Other All
: medium normal
Assignee: Not Assigned
Depends on:
Reported: 2012-07-07 15:02 UTC by Michael Meeks
Modified: 2013-10-25 15:09 UTC (History)
1 user (show)

See Also:
Crash report or crash signature:

Sample document without crash (546.90 KB, application/vnd.oasis.opendocument.text)
2012-11-15 06:09 UTC, Rainer Bielefeld Retired

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Meeks 2012-07-07 15:02:55 UTC
Running vs. master around: 3f281b6f0ad73eae72b77fa4dcab9008b7e14187

After cutting / a big section I did an undo:

#0  0xb7cd756e in __GI_memmove (dest=0x0, src=0x9e5be84, len=56) at memmove.c:76
#1  0xaf2611ea in __copy_m<SwHistoryHint*> (__last=0x9e5bedc, __result=<optimized out>, __first=0x9e5be84)
    at /usr/include/c++/4.6/bits/stl_algobase.h:366
#2  __copy_move_a<false, SwHistoryHint**, SwHistoryHint**> (__result=<optimized out>, __last=0x9e5bedc, __first=0x9e5be84)
    at /usr/include/c++/4.6/bits/stl_algobase.h:384
#3  __copy_move_a2<false, __gnu_cxx::__normal_iterator<SwHistoryHint**, std::vector<SwHistoryHint*> >, __gnu_cxx::__normal_iterator<SwHistoryHint**, std::vector<SwHistoryHint*> > > (__result=<optimized out>, __last=..., __first=...) at /usr/include/c++/4.6/bits/stl_algobase.h:422
#4  copy<__gnu_cxx::__normal_iterator<SwHistoryHint**, std::vector<SwHistoryHint*> >, __gnu_cxx::__normal_iterator<SwHistoryHint**, std::vector<SwHistoryHint*> > > (__result=<optimized out>, __last=..., __first=...) at /usr/include/c++/4.6/bits/stl_algobase.h:454
#5  SwHistory::Move (this=0xbfffdfac, nPos=0, pIns=0x8f70ee8, nStart=1) at /data/opt/libreoffice/master/sw/source/core/inc/rolbck.hxx:402
#6  0xaf25ee20 in SwUndoDelete::UndoImpl (this=0x9d46cd8, rContext=...) at /data/opt/libreoffice/master/sw/source/core/undo/undel.cxx:911
#7  0xaf261e09 in SwUndo::UndoWithContext (this=0x9d46cd8, rContext=...) at /data/opt/libreoffice/master/sw/source/core/undo/undobj.cxx:241
#8  0xb75a6d20 in SfxListUndoAction::UndoWithContext (this=0x9e54710, i_context=...)
    at /data/opt/libreoffice/master/svl/source/undo/undo.cxx:1334
#9  0xb75a8c97 in SfxUndoManager::ImplUndo (this=0x99afa6c, i_contextOrNull=0xbfffe148)
    at /data/opt/libreoffice/master/svl/source/undo/undo.cxx:794
#10 0xb75a8def in SfxUndoManager::UndoWithContext (this=0x99afa6c, i_context=...) at /data/opt/libreoffice/master/svl/source/undo/undo.cxx:761
#11 0xaf25677b in sw::UndoManager::impl_DoUndoRedo (this=0x99afa68, undoOrRedo=sw::UndoManager::UNDO)
    at /data/opt/libreoffice/master/sw/source/core/undo/docundo.cxx:488
#12 0xaf256878 in sw::UndoManager::Undo (this=0x99afa68) at /data/opt/libreoffice/master/sw/source/core/undo/docundo.cxx:515
#13 0xaf0feb13 in SwEditShell::Undo (this=0x9be7260, nCount=1) at /data/opt/libreoffice/master/sw/source/core/edit/edundo.cxx:136
#14 0xaf55b153 in SwWrtShell::Do (this=0x9be7260, eDoType=SwWrtShell::UNDO, nCnt=1)
    at /data/opt/libreoffice/master/sw/source/ui/wrtsh/wrtundo.cxx:58
#15 0xaf491db0 in SwBaseShell::ExecUndo (this=0x9c33f48, rReq=...) at /data/opt/libreoffice/master/sw/source/ui/shells/basesh.cxx:493
#16 0xb7737fd6 in CallExec (rReq=..., pFunc=<optimized out>, this=0x9c33f48) at /data/opt/libreoffice/master/sfx2/inc/sfx2/shell.hxx:199
#17 SfxDispatcher::Call_Impl (this=0x99b6b28, rShell=..., rSlot=..., rReq=..., bRecord=1 '\001')
    at /data/opt/libreoffice/master/sfx2/source/control/dispatch.cxx:259
#18 0xb7732ded in SfxBindings::Execute_Impl (this=0x9991358, aReq=..., pSlot=0xaf9b0b18, pShell=0x9c33f48)
    at /data/opt/libreoffice/master/sfx2/source/control/bindings.cxx:1295
#19 0xb7748afe in SfxDispatchController_Impl::dispatch (this=0x9c52008, aURL=..., aArgs=..., rListener=...)
    at /data/opt/libreoffice/master/sfx2/source/control/unoctitm.cxx:749
#20 0xb77490e3 in SfxOfficeDispatch::dispatch (this=0x9c51dc8, aURL=..., aArgs=...)
    at /data/opt/libreoffice/master/sfx2/source/control/unoctitm.cxx:378
#21 0xb7343fcd in svt::AsyncAccelExec::impl_ts_asyncCallback (this=0x9caf7a0)
    at /data/opt/libreoffice/master/svtools/source/misc/acceleratorexecute.cxx:502
#22 0xb69d1e7c in Call (pCaller=0x0, this=0x9caf7a4) at /data/opt/libreoffice/master/solver/unxlngi6.pro/inc/tools/link.hxx:143
#23 DoEvent_Impl (pEvent=0x0, this=0x9caf7a0) at /data/opt/libreoffice/master/vcl/source/helper/evntpost.cxx:47
#24 vcl::EventPoster::LinkStubDoEvent_Impl (pThis=0x9caf7a0, pCaller=0x0) at /data/opt/libreoffice/master/vcl/source/helper/evntpost.cxx:50
#25 0xb6a4bc07 in Call (pCaller=<optimized out>, this=<optimized out>)
    at /data/opt/libreoffice/master/solver/unxlngi6.pro/inc/tools/link.hxx:143
#26 ImplHandleUserEvent (pSVEvent=0x9d430b0) at /data/opt/libreoffice/master/vcl/source/window/winproc.cxx:2003
#27 ImplWindowFrameProc (pWindow=0x87c3db0, nEvent=22, pEvent=0x9d430b0) at /data/opt/libreoffice/master/vcl/source/window/winproc.cxx:2575
#5  SwHistory::Move (this=0xbfffdfac, nPos=0, pIns=0x8f70ee8, nStart=1) at /data/opt/libreoffice/master/sw/source/core/inc/rolbck.hxx:402
402	        std::copy( itSourceBegin, itSourceEnd, m_SwpHstry.begin() + nPos );
(gdb) l
397	    void Move( sal_uInt16 nPos, SwHistory *pIns,
398	               sal_uInt16 const nStart = 0)
399	    {
400	        SwpHstry::iterator itSourceBegin = pIns->m_SwpHstry.begin() + nStart;
401	        SwpHstry::iterator itSourceEnd = pIns->m_SwpHstry.end();
402	        std::copy( itSourceBegin, itSourceEnd, m_SwpHstry.begin() + nPos );
403	        pIns->m_SwpHstry.erase( itSourceBegin, itSourceEnd );
404	    }
406	    // helper methods for recording attribute in History
(gdb) p itSourceEnd
$1 = {_M_current = 0x9e5bedc}
(gdb) p *pIns
$2 = {m_SwpHstry = {<std::vector<SwHistoryHint*, std::allocator<SwHistoryHint*> >> = 
    {<std::_Vector_base<SwHistoryHint*, std::allocator<SwHistoryHint*> >> = {_M_impl = {<std::allocator<SwHistoryHint*>> = 
    {<__gnu_cxx::new_allocator<SwHistoryHint*>> = {<No data fields>}, <No data fields>}, _M_start = 0x9e5be80, _M_finish = 0x9e5bedc, 
          _M_end_of_storage = 0x9e5bf00}}, <No data fields>}, <No data fields>}, m_nEndDiff = 22}

Odd :-)
Comment 1 Rainer Bielefeld Retired 2012-11-15 06:09:14 UTC
Created attachment 70098 [details]
Sample document without crash

NOT reproducible with attached Sample document and parallel installation of Master "LOdev   -  ENGLISH UI / German Locale  [Build ID: a2b3ee)]"  {tinderbox: @6, pull time 2012-11-13 06:07:28} on German WIN7 Home Premium (64bit) with separate /4 User Profile for Master Branch.

My steps:

1. Open document from LibO start Center.
2. In Navibator click section "2011"
3. 'right click -> Edit -> Select section "2011" -> <Remove> -> >OK>'
   Dialog will be closed, Section no longer visible in Navigator
4. Click 'Undo' Icon
   Section reappears, no crash

Build-Related? Document related? Wrong steps?
Comment 2 Rainer Bielefeld Retired 2012-11-15 06:14:25 UTC
Or OS related?

Also not reproducible after I had increased size of section to 90 pages by copy / paste.
Comment 3 QA Administrators 2013-07-18 06:16:16 UTC
Dear Bug Submitter,

Please read the entire message in its entirety before continuing - also please respond directly to FDO when replying - do not reply via email.

This bug has been in NEEDINFO status with no change for at least 6 months. Please provide the requested information as soon as possible and mark the bug as UNCONFIRMED. Due to regular bug tracker maintenance, if the bug is still in NEEDINFO status with no change in 30 days the QA team will close the bug as INVALID due to lack of needed information.

For more information about our NEEDINFO policy please read the wiki located here: 

If you have already provided the requested information, please mark the bug as UNCONFIRMED so that the QA team knows that the bug is ready to be confirmed.

Thank you for helping us make LibreOffice even better for everyone!

Warm Regards,
QA Team
Comment 4 QA Administrators 2013-10-25 15:09:30 UTC
Dear Bug Submitter,

Please read this message in its entirety before proceeding.

Your bug report is being closed as INVALID due to inactivity and a lack of information which is needed in order to accurately reproduce and confirm the problem. We encourage you to retest your bug against the latest release. If the issue is still present in the latest stable release, we need the following information (please ignore any that you've already provided):

a) Provide details of your system including your operating system and the latest version of LibreOffice that you have confirmed the bug to be present

b) Provide easy to reproduce steps – the simpler the better

c) Provide any test case(s) which will help us confirm the problem

d) Provide screenshots of the problem if you think it might help

e) Read all comments and provide any requested information

Once all of this is done, please set the bug back to UNCONFIRMED and we will attempt to reproduce the issue. 
Please do not:
a) respond via email 
b) update the version field in the bug or any of the other details on the top section of FDO