Bug Hunting Session
Bug 91995 - CRASH when drag-copy cell with comment after Chinese conversion and Undo
Summary: CRASH when drag-copy cell with comment after Chinese conversion and Undo
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
4.2.0.4 release
Hardware: Other All
: high major
Assignee: Caolán McNamara
URL:
Whiteboard: target:5.3.0 target:5.2.0.2 target:5.1.5
Keywords: haveBacktrace, regression
: 89226 (view as bug list)
Depends on:
Blocks:
 
Reported: 2015-06-11 01:30 UTC by Mike Kaganski
Modified: 2016-10-25 18:55 UTC (History)
5 users (show)

See Also:
Crash report or crash signature:


Attachments
bt with symbols (21.57 KB, text/plain)
2016-07-02 15:35 UTC, Julien Nabet
Details
Another bt but with slight changes in step by step process (22.86 KB, text/plain)
2016-07-02 15:56 UTC, Julien Nabet
Details
Valgrind trace (33.87 KB, application/x-bzip)
2016-07-02 16:30 UTC, Julien Nabet
Details
easier demo (7.79 KB, application/vnd.oasis.opendocument.spreadsheet)
2016-07-04 14:51 UTC, Caolán McNamara
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Mike Kaganski 2015-06-11 01:30:35 UTC
Steps to reproduce:

1. Create a new spreadsheet.
2. Type to A1 some Chinese text, like 中国
3. Ctrl+Alt+C to add a comment, put some text there
4. Having the A1 selected, chose menu Tools->Language->Chinese Conversion...->Simplified Chinese to traditional Chinese->OK.
5. Ctrl+Z to Undo once.
6. Drag the lower-right corner cell mark of A1 to copy the cell to A2 and release the mouse button.

Expected result: the cell A1 contents should be copied to A2.

Actual result: LO crashes.

The problem started in version 4.2.0.4. It was OK in 4.2.0.3 -> regression.
Comment 1 Mike Kaganski 2015-06-11 01:34:39 UTC
Suspecting possible cause by
commit aa94b17208a5512a344301345f26a9418f943a00
Author: Kohei Yoshida <kohei.yoshida at collabora.com>
Date:   Fri Jan 24 21:29:54 2014 -0500

    Stop leaking all ScPostIt instances.
    
    And re-implement correct swapping of two ScPostIt instances during
    sort.
    
    (cherry picked from commit ab05317c79f665bcf9d5cff7b8312ce6963ff969)
Comment 2 raal 2015-06-11 12:06:54 UTC
I can confirm crash with LO 4.4.3, win7
Comment 3 Luke 2015-07-25 04:37:09 UTC
Has anyone tested this bug in Linux to confirm that it's Windows only?
Comment 4 Julien Nabet 2016-07-02 15:35:26 UTC
Created attachment 126036 [details]
bt with symbols

On pc Debian x86-64 with master sources updated today, I could reproduce this.

I attached a bt.
Comment 5 Julien Nabet 2016-07-02 15:56:26 UTC
Created attachment 126037 [details]
Another bt but with slight changes in step by step process

I followed the step by step process except I haven't done the "Undo" part.
The drag and drop was ok but when trying to close LO without saving, it crashed.

Thought it might help to add this bt here.
Perhaps both problems are related.
Comment 6 Julien Nabet 2016-07-02 16:30:02 UTC
Created attachment 126038 [details]
Valgrind trace

I wanted to retrieve a Valgrind trace but had a crash when doing first step (copy-paste Chinese symbols from bugtracker to Calc).
Anyway, there's perhaps some interesting thing here, eg:
  33423 ==29535== Invalid read of size 8
  33424 ==29535==    at 0x839C43A: rtl::OUString::getLength() const (ustring.hxx:542)
  33425 ==29535==    by 0x83DD02B: ContentNode::Len() const (editdoc.cxx:1671)
  33426 ==29535==    by 0x848278A: ImpEditEngine::SelectWord(EditSelection const&, short, bool) (impedit2.cxx:1511)
  33427 ==29535==    by 0x84885EF: ImpEditEngine::ImpInsertText(EditSelection const&, rtl::OUString const&) (impedit2.cxx:2659)
  33428 ==29535==    by 0x848CD45: ImpEditEngine::InsertText(com::sun::star::uno::Reference<com::sun::star::datatransfer::XTransferable>&, rtl::OUString const&, EditPaM const&, bool) (impedit2.cxx:3525) 
  33429 ==29535==    by 0x840DE9B: EditEngine::InsertText(com::sun::star::uno::Reference<com::sun::star::datatransfer::XTransferable>&, rtl::OUString const&, EditPaM const&, bool) (editeng.cxx:798)
  33430 ==29535==    by 0x847268F: ImpEditView::Paste(com::sun::star::uno::Reference<com::sun::star::datatransfer::clipboard::XClipboard>&, bool) (impedit.cxx:1495)
Comment 7 Caolán McNamara 2016-07-04 14:50:54 UTC
I looked at this, saw that the transliterate code was similar to the spellchecking code and so checked with an equivalent spelling demo. And that crashes in the same way, so the actual "chinese conversion" is innocent. Its a generic problem with spell-checking replacement and transliteration/hanga-hangul replacement and undo
Comment 8 Caolán McNamara 2016-07-04 14:51:57 UTC
Created attachment 126065 [details]
easier demo

load, use spellchecking, say convert all, close document, dismiss save, crash
Comment 9 Caolán McNamara 2016-07-04 15:51:40 UTC
bug #99255 seems similar
Comment 10 Caolán McNamara 2016-07-04 16:12:49 UTC
*** Bug 89226 has been marked as a duplicate of this bug. ***
Comment 11 Caolán McNamara 2016-07-04 16:13:20 UTC
https://gerrit.libreoffice.org/#/c/26913/ for my effort
Comment 12 Commit Notification 2016-07-05 09:15:35 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=7566851d653ec052e9b7baa98ec2a993328f84e4

Resolves: tdf#91995 copying cells to undo doc shallow copied note pointer

It will be available in 5.3.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 13 Commit Notification 2016-07-05 09:21:41 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-5-2":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=da2aad871bfccd28b47d8ddf47dd6b5b1f834220&h=libreoffice-5-2

Resolves: tdf#91995 copying cells to undo doc shallow copied note pointer

It will be available in 5.2.0.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 14 Commit Notification 2016-07-05 09:26:42 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-5-1":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=7bcd59241495fe474387abb176185d8775aa104c&h=libreoffice-5-1

Resolves: tdf#91995 copying cells to undo doc shallow copied note pointer

It will be available in 5.1.5.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.