Writer crashes when a user uses the "Accept or reject changes" dialogue, enables a filter for changes done by a particular user and deletes the text inserted by that user while "record/track changes" (redlining) is still active. If user 1 deletes a text inserted by user 2, Writer is displays a 2-level revision mark: The insertion by user 2 is superseded by the deletion of user 1. Both are recorded as tracked revisions. Tested with LO 3.5.4.2 and a 3.7 alpha build under Ubuntu 12.04. AOO 3.4.1 has the same problem.
Created attachment 70993 [details] Test kit 57874_crash_track_changes_filter.zip Reproduce: (1) Open file delete_inserted.odt. (2) Select menu Edit / Changes / Accept or reject. In the tracked changes list, select Filter / Author = "User Name2". Go back to list view. (3) The list shows 2 insertions by "User Name2" - this user has inserted 2 spaces. With "track changes" still enabled, go to each tracked change, and delete each of the 2 spaces. LO crashes on deletion of the 2nd space. Attached test kit contains the sample text file and a backtrace done with an alpha build of 3.7. When crashing, LO wrote this to stderr: /usr/include/c++/4.6/debug/vector:320:error: attempt to subscript container with out-of-bounds index 65535, but container only holds 13 elements. Objects involved in the operation: sequence "this" @ 0x0x4d4e6e0 { type = NSt7__debug6vectorIP9SwRedlineSaIS2_EEE; }
Might be related to or DUP of "Bug 49340 - CRASH closing window Edit > Changes > Accept or Reject with ESC" "Bug 51832 - EDITING: CRASH in special case when 'Edit > Changes > Accept or reject > Reject'" "Bug 56549 - CRASH in menu 'Format → Autocorrect → Apply and Edit Changes'"? But none of those is really identical. I will check this one later.
(In reply to comment #2) > Might be related to or DUP of > "Bug 49340 - CRASH closing window Edit > Changes > Accept or Reject with ESC" > "Bug 51832 - EDITING: CRASH in special case when 'Edit > Changes > Accept or > reject > Reject'" > "Bug 56549 - CRASH in menu 'Format → Autocorrect → Apply and Edit Changes'"? > But none of those is really identical. > I will check this one later. All bugs above are FIXED, so is this still an issue in the latest stable release?
I'm unable to reproduce that bug with LO 4.0.2. It looks like it has been fixed.
RESOLVED WORKSFORME per comment 4. Do not hesitate to reopen if this bug is reproducible with the latest stable release.
Pierre-Eric Pelloux-Prayer committed a patch related to this issue. It has been pushed to "master": http://cgit.freedesktop.org/libreoffice/core/commit/?id=1fadebef054b811d8d6487d45d76dea1990e1268 fdo#57874: verify GetRedlinePos return value before usage The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
The issue is fixed on master with the previous commit.