Bug 85424 - The execution of a little macro produces a LibreOffice crash
Summary: The execution of a little macro produces a LibreOffice crash
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
3.5.0 release
Hardware: All Linux (All)
: medium normal
Assignee: Michael Stahl (CIB)
URL:
Whiteboard: target:5.0.0 target:4.4.4
Keywords: haveBacktrace, preBibisect, regression
Depends on:
Blocks:
 
Reported: 2014-10-24 23:00 UTC by Oswald Luc
Modified: 2015-12-17 11:00 UTC (History)
5 users (show)

See Also:
Crash report or crash signature:


Attachments
gdb backtrace / strace.log / hs_err_pid.log / +2 files in order to reproduce the crash (1.67 MB, application/x-tar)
2014-10-24 23:00 UTC, Oswald Luc
Details
the macro I run (1.02 KB, text/plain)
2014-10-27 21:47 UTC, Oswald Luc
Details
gdb backtrace log (27.90 KB, text/plain)
2014-10-27 21:51 UTC, Oswald Luc
Details
LO document in which I run the macro (26.36 KB, application/vnd.oasis.opendocument.text)
2014-10-27 21:52 UTC, Oswald Luc
Details
bt with debug symbols (master sources) (11.03 KB, text/plain)
2015-04-01 20:00 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Oswald Luc 2014-10-24 23:00:02 UTC
Created attachment 108374 [details]
gdb backtrace / strace.log / hs_err_pid.log / +2 files in order to reproduce the crash

LibreOffice Version: 4.2.6.3
Build ID: 420m0(Build:3)
Ubuntu 14.04

The crash is easily reproductible.
In the attached files, you find the code of the macro.
Its execution leads to a crash on almost ( but not all ) documents.
I also include the document with which I got the backtrace and the strace log files.
Comment 1 Julien Nabet 2014-10-24 23:30:04 UTC
Oswald: on which Linux distrib are you? Could you give a try to last stable LO version 4.3.2?
Comment 2 Oswald Luc 2014-10-27 21:47:37 UTC
Created attachment 108534 [details]
the macro I run
Comment 3 Oswald Luc 2014-10-27 21:51:10 UTC
Created attachment 108535 [details]
gdb backtrace log
Comment 4 Oswald Luc 2014-10-27 21:52:16 UTC
Created attachment 108537 [details]
LO document in which I run the macro
Comment 5 Oswald Luc 2014-10-27 21:55:13 UTC
Version: 4.3.2.2
Build ID: edfb5295ba211bd31ad47d0bad0118690f76407d

Still crashes with LO version 4.3.2
Comment 6 Julien Nabet 2014-10-27 22:23:49 UTC
Thank you for your feedback.
I put it at NEW since there's a feedback.
Comment 7 Julien Nabet 2014-11-02 11:12:04 UTC
Re reading my last comment, I meant I put it at NEW since there's a stacktrace.
Comment 8 Matthew Francis 2015-03-31 15:30:48 UTC
Bibisect result from 43all:

89740762f0af849e492932bd71e59149cdcd5a00 is the first bad commit
commit 89740762f0af849e492932bd71e59149cdcd5a00
Author: Bjoern Michaelsen <bjoern.michaelsen@canonical.com>
Date:   Mon Dec 10 01:57:45 2012 +0000

    source-hash-06f20d73da21342046a480a6b22af69901351328
    
    commit 06f20d73da21342046a480a6b22af69901351328
    Author:     Stephan Bergmann <sbergman@redhat.com>
    AuthorDate: Fri Jul 20 11:10:05 2012 +0200
    Commit:     Stephan Bergmann <sbergman@redhat.com>
    CommitDate: Fri Jul 20 11:10:05 2012 +0200
Comment 9 Julien Nabet 2015-04-01 20:00:58 UTC
Created attachment 114535 [details]
bt with debug symbols (master sources)

the bt is equivalent to the previous one but with more information (since debug build)
Comment 10 Matthew Francis 2015-04-15 11:37:39 UTC
In fact, comment 8 is wrong - it is harder to reproduce before that point, but running the macro twice still ends in a crash with what appears to be the same backtrace.

Testing on release versions suggests the issue was introduced between 3.4 and 3.5.0
Comment 11 Michael Stahl (CIB) 2015-05-13 22:13:05 UTC
there's a SwPaM on the stack, then the node its SwIndex points to is deleted but the SwPam is still used later - good thing we added the assert there.

fixed on master
Comment 12 Commit Notification 2015-05-13 22:13:42 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=847b4537928ff64cfdd6532704f7c48d947ac00f

tdf#85424: sw: fix ~SwIndexReg assert in SwXText::insertControlCharacter()

It will be available in 5.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 13 Commit Notification 2015-05-14 09:21:31 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-4-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=1a2a094795e10f514eb421e68bbd705ea5251b76&h=libreoffice-4-4

tdf#85424: sw: fix ~SwIndexReg assert in SwXText::insertControlCharacter()

It will be available in 4.4.4.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 14 Robinson Tryon (qubit) 2015-12-17 11:00:39 UTC
Migrating Whiteboard tags to Keywords: (preBibisect)
[NinjaEdit]