Bug 82777 - EDITING: CRASH when "select all" or "select" on page with picture or object anchored to page
Summary: EDITING: CRASH when "select all" or "select" on page with picture or object a...
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
4.4.0.0.alpha0+ Master
Hardware: Other Windows (All)
: high critical
Assignee: Not Assigned
URL:
Whiteboard: BSA target:4.4.0
Keywords: bibisected, haveBacktrace, regression
: 82890 83174 83607 (view as bug list)
Depends on:
Blocks: mab4.4
  Show dependency treegraph
 
Reported: 2014-08-18 17:06 UTC by Bugcruncher
Modified: 2015-12-17 08:30 UTC (History)
7 users (show)

See Also:
Crash report or crash signature:


Attachments
Sample Document (18.51 KB, application/vnd.oasis.opendocument.text)
2014-08-18 17:06 UTC, Bugcruncher
Details
bt with master sources (7.40 KB, text/plain)
2014-08-18 19:15 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Bugcruncher 2014-08-18 17:06:57 UTC
Created attachment 104836 [details]
Sample Document

Problem description: 
Crash when edit page with picture anchored to page. This can be reproduced with any self created page 

Steps to reproduce:
1. Open attachment
2. <ctrl.+a> to select all
   » CRASH with message "SEH Exception: ACCESS VIOLATION"

I observed this with Version: 4.4.0.0.alpha0+
Build ID: 0771823d80abadf8e7f2ccc078f3f9e2c277f8a5
during my attempts to make reproducible
"Bug 80563 - EDITING: Crash with error message "loading library failed: frmlo.dll""
"Bug 80405 - EDITING: Crash, mostly with error message"
But this one seems not related, I can not reproduce this problem here with Versions before 4.4

Also happens with other objects anchored to page like Chart, Frame, 

              
Operating System: Windows 7
Version: 4.4.0.0.alpha0+ Master
Comment 1 Julien Nabet 2014-08-18 19:15:19 UTC
Created attachment 104841 [details]
bt with master sources

On pc Debian x86-64 with master sources updated 2 days ago, I could reproduce this.
I attached bt.
Comment 2 Bugcruncher 2014-08-19 04:59:09 UTC
There are also other similar crashes, for example when I send a single page of a document as PDF, what are not related to a picture anchored to page. I will try to get those problems reproducible with not-confidential documents.
Comment 3 Julien Nabet 2014-08-19 21:18:45 UTC
Crash after all, so let's increase the importance.
Comment 4 Julien Nabet 2014-08-21 05:31:30 UTC
*** Bug 82890 has been marked as a duplicate of this bug. ***
Comment 5 Julien Nabet 2014-08-21 06:19:57 UTC
Michael: one for you?
Comment 6 Jean-Baptiste Faure 2014-08-21 07:52:59 UTC
Two remarks from bug 82890 (duplicate):
- under gdb session Ubuntu / Unity does not like the crash, I had difficulty to return to the terminal to continue the gdb session; changing from LO freezed window to the terminal window in the same workspace was impossible. It worked on a second try, if I moved first the LO window in another workspace.
- on my bugdoc (attachment 105002 [details]), if I anchor the frame on the first page to the paragraph, LO does not crash. If I anchor the frame back to the page, the crash comes back.

Hope this help to fix the bug. 
Best regards. JBF
Comment 7 Terrence Enger 2014-08-26 22:40:47 UTC
In the daily dbgutil bibisect version oldest, ctrl+A did not crash,
but neither did it select the picture.  For purposes of bibisecting, I
call this result "good".


`git bisect good` says:

    ba5b58a62db37685dbd283123bd62fbd2458f4c7 is the first bad commit
    commit ba5b58a62db37685dbd283123bd62fbd2458f4c7
    Author: Miklos Vajna <vmiklos@collabora.co.uk>
    Date:   Wed Aug 13 08:48:59 2014 +0200

        2014-08-13

    :100644 100644 f4798ad03594b7db8a08f376fed5ff5369de2224 dd7293520470d3934353227414231a1bc2afc81d M	build-info.txt
    :040000 040000 8fa6ace9bb0cdd432e72fecee3ce43ff806948f9 1e2fc1aec541730d5ba0af50b233df1304047b21 M	opt

and `git bisect log`:

    # bad: [f5043baf54256feb23ca38332261eaad621d0c21] 2014-08-25
    # good: [b3130c846de5cf1b4be48b48dfc780bb369549fa] 2014-05-21
    git bisect start 'f5043ba' 'oldest'
    # good: [329f284cf0438c52859ca4facd4f4950594352e1] 2014-07-07
    git bisect good 329f284cf0438c52859ca4facd4f4950594352e1
    # good: [10c0baf70759700c275cdd8c6fadf4919800714d] 2014-08-01
    git bisect good 10c0baf70759700c275cdd8c6fadf4919800714d
    # bad: [ba5b58a62db37685dbd283123bd62fbd2458f4c7] 2014-08-13
    git bisect bad ba5b58a62db37685dbd283123bd62fbd2458f4c7
    # good: [f434cb1d38ebf64b5019979e41273478943e87c8] 2014-08-07
    git bisect good f434cb1d38ebf64b5019979e41273478943e87c8
    # good: [369f34427476c645cac930bdf29234638a1b41ae] 2014-08-10
    git bisect good 369f34427476c645cac930bdf29234638a1b41ae
    # good: [59a8d89d4255a1cbcab4fcfeff9270dd56c62aed] 2014-08-12
    git bisect good 59a8d89d4255a1cbcab4fcfeff9270dd56c62aed
    # first bad commit: [ba5b58a62db37685dbd283123bd62fbd2458f4c7] 2014-08-13


The crash I see is a segfault in SwNodeIndex::SwNodeIndex.
Comment 8 Caolán McNamara 2014-08-27 15:07:21 UTC
regression from

commit 78131b6bfc16d739e28024407de253c84cb68a8a
Author: Luboš Luňák <l.lunak@collabora.com>
Date:   Tue Aug 12 20:15:02 2014 +0200

    show fly anchored inside selection as selected too
    
    If part (or whole) document is selected and then the selection
    is e.g. deleted, flys anchored there will be deleted too, so it
    makes sense to show them as part of the selection.
    
    Change-Id: I17bfccebc0cd305c19616159471f0f113c7e71d9
Comment 9 Terrence Enger 2014-09-08 15:57:21 UTC
*** Bug 83607 has been marked as a duplicate of this bug. ***
Comment 10 Cor Nouws 2014-09-08 18:19:56 UTC
note that Bug 83607 involves only simple select, no select all. (FWIW)
Comment 11 Commit Notification 2014-09-14 18:20:23 UTC
LuboÅ¡ LuÅak committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=99cd15fa238886d23bdc429dc1133157d799487a

avoid possible NULL dereference (fdo#82777)



The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 12 Michael Stahl (CIB) 2014-11-10 22:53:07 UTC
*** Bug 83174 has been marked as a duplicate of this bug. ***
Comment 13 Robinson Tryon (qubit) 2015-12-17 08:30:15 UTC
Migrating Whiteboard tags to Keywords: (bibisected)
[NinjaEdit]