Bug 91228 - Writer crash Insert Image, Anchor as character, Go after image, press enter
Summary: Writer crash Insert Image, Anchor as character, Go after image, press enter
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
4.4.0.3 release
Hardware: Other All
: medium critical
Assignee: Philippe Jung
URL:
Whiteboard: target:5.1.0 target:5.0.0.0.beta2 tar...
Keywords: regression
: 92798 (view as bug list)
Depends on:
Blocks:
 
Reported: 2015-05-11 18:59 UTC by Philippe Jung
Modified: 2016-10-25 19:24 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Philippe Jung 2015-05-11 18:59:55 UTC
Writer crash:
New document
Insert Image
Right click on it => Anchor => as character
Click after the image
Press enter

soffice.bin: /home/philippe/src/git-repo/libreoffice/core/sw/source/core/layout/atrfrm.cxx:3507: void sw::CheckAnchoredFlyConsistency(const SwDoc&): Assertion `&rAnchor.GetCntntAnchor()->nNode.GetNode() == pNode' failed.

Program received signal SIGABRT, Aborted.
0x00007ffff7519cc9 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56	../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0  0x00007ffff7519cc9 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007ffff751d0d8 in __GI_abort () at abort.c:89
#2  0x00007ffff7512b86 in __assert_fail_base (fmt=0x7ffff7663830 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", 
    assertion=assertion@entry=0x7fffbb1657a8 "&rAnchor.GetCntntAnchor()->nNode.GetNode() == pNode", 
    file=file@entry=0x7fffbb165330 "/home/philippe/src/git-repo/libreoffice/core/sw/source/core/layout/atrfrm.cxx", line=line@entry=3507, 
    function=function@entry=0x7fffbb165b20 <sw::CheckAnchoredFlyConsistency(SwDoc const&)::__PRETTY_FUNCTION__> "void sw::CheckAnchoredFlyConsistency(const SwDoc&)") at assert.c:92
#3  0x00007ffff7512c32 in __GI___assert_fail (assertion=0x7fffbb1657a8 "&rAnchor.GetCntntAnchor()->nNode.GetNode() == pNode", 
    file=0x7fffbb165330 "/home/philippe/src/git-repo/libreoffice/core/sw/source/core/layout/atrfrm.cxx", line=3507, 
    function=0x7fffbb165b20 <sw::CheckAnchoredFlyConsistency(SwDoc const&)::__PRETTY_FUNCTION__> "void sw::CheckAnchoredFlyConsistency(const SwDoc&)") at assert.c:101
#4  0x00007fffbaa9090f in sw::CheckAnchoredFlyConsistency(SwDoc const&) ()
   from /home/philippe/src/git-repo/libreoffice/core/instdir/program/../program/libswlo.so
#5  0x00007fffba9427ef in sw::DocumentRedlineManager::SetRedlineMode(unsigned short) ()
   from /home/philippe/src/git-repo/libreoffice/core/instdir/program/../program/libswlo.so
#6  0x00007fffba9f991f in SwAutoFormat::SwAutoFormat(SwEditShell*, SvxSwAutoFmtFlags&, SwNodeIndex*, SwNodeIndex*) ()
   from /home/philippe/src/git-repo/libreoffice/core/instdir/program/../program/libswlo.so
#7  0x00007fffba9faf55 in SwEditShell::AutoFmtBySplitNode() ()
   from /home/philippe/src/git-repo/libreoffice/core/instdir/program/../program/libswlo.so
#8  0x00007fffbaa078e7 in SwEditShell::SplitNode(bool, bool) ()
   from /home/philippe/src/git-repo/libreoffice/core/instdir/program/../program/libswlo.so
#9  0x00007fffbb0d9afe in SwWrtShell::SplitNode(bool, bool) ()
   from /home/philippe/src/git-repo/libreoffice/core/instdir/program/../program/libswlo.so
#10 0x00007fffbaf6e592 in SwEditWin::KeyInput(KeyEvent const&) ()
   from /home/philippe/src/git-repo/libreoffice/core/instdir/program/../program/libswlo.so
#11 0x00007ffff1f6214f in ImplHandleKey (pWindow=0x409a680, nSVEvent=KEYINPUT, nKeyCode=1280, nCharCode=0, nRepeat=0, bForward=true)
    at /home/philippe/src/git-repo/libreoffice/core/vcl/source/window/winproc.cxx:1025
#12 0x00007ffff1f66564 in ImplWindowFrameProc (_pWindow=0x409a680, nEvent=5, pEvent=0x7fffffffd120)
    at /home/philippe/src/git-repo/libreoffice/core/vcl/source/window/winproc.cxx:2459
#13 0x00007fffe359ecac in SalFrame::CallCallback (this=0x409ae20, nEvent=5, pEvent=0x7fffffffd120)
    at /home/philippe/src/git-repo/libreoffice/core/vcl/inc/salframe.hxx:244
#14 0x00007fffe3591ae9 in GtkSalFrame::doKeyCallback (this=0x409ae20, state=33554432, keyval=65293, hardware_keycode=36, group=0 '\000', 
    time=254122018, aOrigCode=0, bDown=true, bSendRelease=false)
Comment 1 Joel Madero 2015-05-11 19:26:48 UTC
Ubuntu 15.04 x64
LibreOffice
Version: 5.0.0.0.alpha1+
Build ID: 7d890d0482abb8e051144d8177917c21844638c3
Locale: en-US (en_US.UTF-8)

Build Date: 05/10/2015

No crash.
Comment 2 Gordo 2015-05-11 22:46:33 UTC
Reproduced.

Windows Vista 64
Version: 5.0.0.0.alpha1+
Build ID: 25a0bd7b909fb8c87387d1413060f6c4ba5a51bd
TinderBox: Win-x86@39, Branch:master, Time: 2015-05-11_01:05:55
Comment 3 Philippe Jung 2015-05-27 20:47:11 UTC
Fresh version from master shows this:

soffice.bin: /home/philippe/src/git-repo/libreoffice/master/sw/source/core/layout/atrfrm.cxx :3507 : void sw::CheckAnchoredFlyConsistency(const SwDoc&):  l'assertion « &rAnchor.GetContentAnchor()->nNode.GetNode() == pNode » a échoué.
Comment 4 Philippe Jung 2015-05-29 17:31:41 UTC
Taking a writer doc with just an image anchored as character, the GetDoc Nodes are:
 count=14
 rNodes[0]=0x2943c90
 rNodes[1]=0x296c2a0
 rNodes[2]=0x2956330
 rNodes[3]=0x294abe0
 rNodes[4]=0x2944fa0
 rNodes[5]=0x2a116e0
 rNodes[6]=0x2a10d10
 rNodes[7]=0x2a0fe90
 rNodes[8]=0x2951750
 rNodes[9]=0x296bec0
 rNodes[10]=0x295ac30
 rNodes[11]=0x295ad50
 rNodes[12]=0x297b7a0
 There is a fly anchored in pNode
 rAnchor.GetContentAnchor()->nNode 12
 rNodes[13]=0x296b300

When I go after the image and press Return, the GetDoc Nodes are:
 count=15
 rNodes[0]=0x2943c90
 rNodes[1]=0x296c2a0
 rNodes[2]=0x2956330
 rNodes[3]=0x294abe0
 rNodes[4]=0x2944fa0
 rNodes[5]=0x2a116e0
 rNodes[6]=0x2a10d10
 rNodes[7]=0x2a0fe90
 rNodes[8]=0x2951750
 rNodes[9]=0x296bec0
 rNodes[10]=0x295ac30
 rNodes[11]=0x295ad50
 rNodes[12]=0x2f1a220
 rNodes[13]=0x297b7a0
 There is a fly anchored in pNode
 rAnchor.GetContentAnchor()->nNode 12

rNodes 12 has become 13, new node inserted in 12.
But the FlyFrame (at pos 13) is still referencing nNode 12.

Either new node has to be inserted After the FlyFrame or nNode has to be updated during insert.
Comment 5 Philippe Jung 2015-06-02 12:14:11 UTC
Same problem with

text
(put cursor here)text - image anchored at char 

and press backspace
Comment 6 Michael Stahl (CIB) 2015-06-02 21:08:52 UTC
regression from the SwFrmFmtAnchorMap stuff in 4.4

(which perhaps doesnt crash immediately but has its map borked at least)
Comment 7 Commit Notification 2015-06-02 22:08:09 UTC
Philippe Jung committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=9f01951b858453684f2622541af0eb85d4544fc6

tdf#91228 Fix Writer crash

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 8 Commit Notification 2015-06-02 22:10:36 UTC
Philippe Jung committed a patch related to this issue.
It has been pushed to "libreoffice-5-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=f25e4aff17aa88b0620b9067f3f4f490f36ca9f6&h=libreoffice-5-0

tdf#91228 Fix Writer crash

It will be available in 5.0.0.0.beta2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 9 Commit Notification 2015-06-02 22:17:21 UTC
Philippe Jung committed a patch related to this issue.
It has been pushed to "libreoffice-4-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=7ea3a2b5747f148cbdc9a065728cefff1a660bd7&h=libreoffice-4-4

tdf#91228 Fix Writer crash

It will be available in 4.4.5.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 10 Commit Notification 2015-06-10 16:58:39 UTC
Philippe Jung committed a patch related to this issue.
It has been pushed to "libreoffice-4-4-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=677b373427d3db8d751600b8c540a6afe07f142e&h=libreoffice-4-4-4

tdf#91228 Fix Writer crash

It will be available in 4.4.4.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 11 Commit Notification 2015-06-12 16:02:39 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=fae87e03ea3829718ec0381ed3b04ceb52c23720

tdf#91228: need to check the format's IsLockModified(), not the node's

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 12 Commit Notification 2015-06-15 12:55:32 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-5-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=f21bf5984269c4d96d5290e8127b383f26c36e08&h=libreoffice-5-0

tdf#91228: need to check the format's IsLockModified(), not the node's

It will be available in 5.0.0.0.beta4.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 13 Commit Notification 2015-06-23 15:03:35 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-4-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=2f874b1030d1062c446993af272d99eafdf674e7&h=libreoffice-4-4

tdf#91228: need to check the format's IsLockModified(), not the node's

It will be available in 4.4.5.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 14 Gordo 2015-07-18 16:29:39 UTC
*** Bug 92798 has been marked as a duplicate of this bug. ***