Bug 87760 - CRASH when drawing above hidden text in table
Summary: CRASH when drawing above hidden text in table
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
Inherited From OOo
Hardware: Other All
: highest critical
Assignee: Caolán McNamara
URL:
Whiteboard: target:4.5.0 target:4.3.7 target:4.4.1
Keywords: haveBacktrace
Depends on:
Blocks: mab4.3
  Show dependency treegraph
 
Reported: 2014-12-27 05:55 UTC by Mike Kaganski
Modified: 2015-01-23 10:12 UTC (History)
3 users (show)

See Also:
Crash report or crash signature:


Attachments
Screencast (Windows) (1.03 MB, video/mp4)
2014-12-28 10:23 UTC, Mike Kaganski
Details
bt with debug symbols (7.09 KB, text/plain)
2014-12-29 22:55 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Mike Kaganski 2014-12-27 05:55:57 UTC
Steps to reproduce:

1. Create a new text document in Writer
2. Add new table, say, 2x2 (doesn't matter, may be reproduced with 1x1)
3. Put caret to cell A1, menu Format->Character->Font Effects->check Hidden
4. Menu View->uncheck Nonprinting Characters (default Ctrl+F10)
5. Show Draw Functions (menu View->Toolbars->Drawing), Draw a Rectangle, so that its top-right corner is above cell A1. This makes the rectangle to be anchored to that cell.

Expected result: the rectangle is drawn, and possibly is hidden, as it is anchored to the hidden paragraph

Actual result: writer crashes, and recovery dialog hangs, it is impossible to close it gracefully, only task kill helps.

Tested with: 4.2.5.2 and 4.3.5.2 under Win7x64.

Marking HIGH/CRITICAL as it is crash, affects the component that is used by most users, but the functionality is not very common.
Comment 1 Mike Kaganski 2014-12-27 07:03:18 UTC
Also reproducible with 
Version: 4.5.0.0.alpha0+
Build ID: 57626f2132f73e4e42b31e364b25c5867336e718
TinderBox: Win-x86@42, Branch:master, Time: 2014-12-26_09:26:33
Locale: ru_RU

and with OOo 3.3.0 under Win7x64 -> Inherited from OOo,
as well as with 4.3.5.2 under Ubuntu 14.04 64-bit -> All OS.
Comment 2 Robinson Tryon (qubit) 2014-12-27 15:41:09 UTC
TESTING on Ubuntu 14.04 + LO 4.4.0.1

(In reply to Mike Kaganski from comment #0)
> Steps to reproduce:
> 1. Create a new text document in Writer
> 2. Add new table, say, 2x2 (doesn't matter, may be reproduced with 1x1)
> 3. Put caret to cell A1, menu Format->Character->Font Effects->check Hidden

clicked "OK"

> 4. Menu View->uncheck Nonprinting Characters (default Ctrl+F10)

Was already unchecked for me.

> 5. Show Draw Functions (menu View->Toolbars->Drawing), Draw a Rectangle, so
> that its top-right corner is above cell A1. This makes the rectangle to be
> anchored to that cell.

Ok  (I'm not entirely sure about the specifics of where the corners of the rectangle should lie)

> Expected result: the rectangle is drawn, and possibly is hidden, as it is
> anchored to the hidden paragraph
> 
> Actual result: writer crashes, and recovery dialog hangs, it is impossible
> to close it gracefully, only task kill helps.

I drew the rectangle, and nothing happened.

> 
> Tested with: 4.2.5.2 and 4.3.5.2 under Win7x64.
> 
> Marking HIGH/CRITICAL as it is crash, affects the component that is used by
> most users, but the functionality is not very common.

I can't repro. Maybe just an issue on Windows?
Comment 3 Robinson Tryon (qubit) 2014-12-27 15:45:29 UTC
(In reply to Robinson Tryon (qubit) from comment #2)
> TESTING on Ubuntu 14.04 + LO 4.4.0.1
> 
> (In reply to Mike Kaganski from comment #0)
> > Steps to reproduce:
> ...
> Draw a Rectangle, so
> > that its top-right corner is above cell A1. This makes the rectangle to be
> > anchored to that cell.

I poked around a bit more, and was able to crash the program if I drew the rectangle as follows:
- Top corners in A1
- Bottom corners in A2

> > Actual result: writer crashes, and recovery dialog hangs, it is impossible
> > to close it gracefully, only task kill helps.

(No recovery dialog for me on Ubuntu)

CONFIRMED: Crash on drawing rectangle

Status -> NEW
Comment 4 Mike Kaganski 2014-12-27 23:28:25 UTC
(In reply to Robinson Tryon (qubit) from comment #3)
> (No recovery dialog for me on Ubuntu)

Yes, you are right.
I didn't mention it in comment 1.

Also, starting with 4.4.0.0.beta1 under Windows, the recovery dialog no more hangs, and after cancelling it, another error message appears:

---------------------------
LibreOfficeDev 4.4 - Fatal Error
---------------------------
Unknown SEH Exception
---------------------------
ОК   
---------------------------
Comment 5 Robinson Tryon (qubit) 2014-12-27 23:48:51 UTC
As this is a MAB: Priority -> Highest
Comment 6 Julien Nabet 2014-12-28 08:10:12 UTC
On pc Debian x86-64 with master sources updated yesterday or with 4.3 sources updated some days ago, I don't reproduce this even if I begin rectangle at top left of first cell and end it at bottom right of the last cell.
Comment 7 Mike Kaganski 2014-12-28 10:23:33 UTC
Created attachment 111421 [details]
Screencast (Windows)

This screencast is to clarify how to reproduce this bug
Comment 8 Julien Nabet 2014-12-29 22:55:45 UTC
Created attachment 111493 [details]
bt with debug symbols

Thank you Mike for your screencast!
On pc Debian x86-64 with master sources updated today, I could reproduce the crash, I attached a bt.
Comment 9 Julien Nabet 2014-12-29 23:18:33 UTC
Michael: the problem is here:
   1593         pAnch = aPos.nNode.GetNode().GetCntntNode()->getLayoutFrm( GetLayout(), &aPoint, 0, false );
   1594 
   1595         if( !bAtPage )

(see http://opengrok.libreoffice.org/xref/core/sw/source/core/frmedt/feshview.cxx#1593)
gdb session indicates that aPos.nNode.GetNode().GetCntntNode() is empty so no pAnch here.
Any idea what to do?
Comment 10 Commit Notification 2015-01-22 17:05:52 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=ef3b6fa0cf3e4f2c7b29e9373a8afc8c2c7c7ca0

Related: fdo#87760 don't crash on searching for a place to put the anchor

It will be available in 4.5.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 11 Commit Notification 2015-01-22 17:05:56 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=15faeb4f9f111f7ea8d04fd64b3d065971cd4570

Resolves: fdo#87760 if we can't anchor at hidden text then...

It will be available in 4.5.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 12 Commit Notification 2015-01-22 22:42:26 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-4-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=87eb4fb1a43d799c9ae8df11bd8b9381d2d88cdb&h=libreoffice-4-3

Resolves: fdo#87760 if we can't anchor at hidden text then...

It will be available in 4.3.7.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 13 Commit Notification 2015-01-22 22:42:34 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-4-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=94506a71fab6f6d6e8d62b02ec78004f85c87aeb&h=libreoffice-4-4

Resolves: fdo#87760 if we can't anchor at hidden text then...

It will be available in 4.4.1.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 14 Commit Notification 2015-01-23 10:12:55 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=c5b6b206c0e80fae7de4d452334541d2198d41ba

sw: redo check in SwFEShell::FindAnchorPos() a bit (related: fdo#87760)

It will be available in 4.5.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.