Bug 57874 - EDITING: Writer crashes while editing text using filtered "recorded changes" list
Summary: EDITING: Writer crashes while editing text using filtered "recorded changes" ...
Status: RESOLVED WORKSFORME
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
3.5.4 release
Hardware: Other All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard: target:4.2.0
Keywords:
Depends on:
Blocks:
 
Reported: 2012-12-04 12:24 UTC by stfhell
Modified: 2013-06-06 14:06 UTC (History)
2 users (show)

See Also:
Crash report or crash signature:


Attachments
Test kit 57874_crash_track_changes_filter.zip (26.11 KB, application/zip)
2012-12-04 12:36 UTC, stfhell
Details

Note You need to log in before you can comment on or make changes to this bug.
Description stfhell 2012-12-04 12:24:13 UTC
Writer crashes when a user uses the "Accept or reject changes" dialogue, enables a filter for changes done by a particular user and deletes the text inserted by that user while "record/track changes" (redlining) is still active.

If user 1 deletes a text inserted by user 2, Writer is displays a 2-level revision mark: The insertion by user 2 is superseded by the deletion of user 1. Both are recorded as tracked revisions.

Tested with LO 3.5.4.2 and a 3.7 alpha build under Ubuntu 12.04. AOO 3.4.1 has the same problem.
Comment 1 stfhell 2012-12-04 12:36:39 UTC
Created attachment 70993 [details]
Test kit 57874_crash_track_changes_filter.zip

Reproduce:

(1) Open file delete_inserted.odt.
(2) Select menu Edit / Changes / Accept or reject. In the tracked changes list, select Filter / Author = "User Name2". Go back to list view.
(3) The list shows 2 insertions by "User Name2" - this user has inserted 2 spaces. With "track changes" still enabled, go to each tracked change, and delete each of the 2 spaces. LO crashes on deletion of the 2nd space.

Attached test kit contains the sample text file and a backtrace done with an alpha build of 3.7. When crashing, LO wrote this to stderr:

/usr/include/c++/4.6/debug/vector:320:error: attempt to subscript container 
    with out-of-bounds index 65535, but container only holds 13 elements.

Objects involved in the operation:
sequence "this" @ 0x0x4d4e6e0 {
  type = NSt7__debug6vectorIP9SwRedlineSaIS2_EEE;
}
Comment 2 Rainer Bielefeld Retired 2012-12-07 05:32:40 UTC
Might be related to or DUP of
"Bug 49340 - CRASH closing window Edit > Changes > Accept or Reject with ESC"
"Bug 51832 - EDITING: CRASH in special case when 'Edit > Changes > Accept or reject > Reject'"
"Bug 56549 - CRASH in menu 'Format → Autocorrect → Apply and Edit Changes'"?

But none of those is really identical. 

I will check this one later.
Comment 3 bfoman (inactive) 2013-01-29 11:49:10 UTC
(In reply to comment #2)
> Might be related to or DUP of
> "Bug 49340 - CRASH closing window Edit > Changes > Accept or Reject with ESC"
> "Bug 51832 - EDITING: CRASH in special case when 'Edit > Changes > Accept or
> reject > Reject'"
> "Bug 56549 - CRASH in menu 'Format → Autocorrect → Apply and Edit Changes'"?
> But none of those is really identical. 
> I will check this one later.

All bugs above are FIXED, so is this still an issue in the latest stable release?
Comment 4 Lionel Dricot 2013-04-22 13:56:10 UTC
I'm unable to reproduce that bug with LO 4.0.2.

It looks like it has been fixed.
Comment 5 bfoman (inactive) 2013-05-15 07:25:54 UTC
RESOLVED WORKSFORME per comment 4.

Do not hesitate to reopen if this bug is reproducible with the latest stable release.
Comment 6 Commit Notification 2013-06-03 07:36:33 UTC
Pierre-Eric Pelloux-Prayer committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=1fadebef054b811d8d6487d45d76dea1990e1268

fdo#57874: verify GetRedlinePos return value before usage



The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 7 Pierre-Eric Pelloux-Prayer 2013-06-06 14:06:30 UTC
The issue is fixed on master with the previous commit.