Bug 92995 - EDITING: Undo of Drag&Drop with annotation/comment object causes crash
Summary: EDITING: Undo of Drag&Drop with annotation/comment object causes crash
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
3.6.0.4 release
Hardware: All All
: high critical
Assignee: Eike Rathke
URL:
Whiteboard: target:5.1.0 target:4.4.6 target:5.0.2
Keywords: bibisected, regression
Depends on:
Blocks:
 
Reported: 2015-07-29 08:50 UTC by Weisz Roland
Modified: 2016-10-25 19:17 UTC (History)
8 users (show)

See Also:
Crash report or crash signature:


Attachments
Select and move in non-printing area (55.98 KB, image/jpeg)
2015-07-29 08:50 UTC, Weisz Roland
Details
testcase (31.05 KB, application/vnd.oasis.opendocument.spreadsheet)
2015-07-29 13:07 UTC, Weisz Roland
Details
backtrace (51.86 KB, text/plain)
2015-08-17 17:12 UTC, Timur
Details
backtrace WinDBG.txt (70.48 KB, text/plain)
2015-08-19 13:15 UTC, Timur
Details
gdbtrace.log (25.40 KB, text/x-log)
2015-08-19 16:42 UTC, Timur
Details
gdbtrace.log (33.10 KB, text/x-log)
2015-08-24 07:47 UTC, Timur
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Weisz Roland 2015-07-29 08:50:25 UTC
Created attachment 117511 [details]
Select and move in non-printing area

Required steps to reproduce:
1. Sheets with non-printing areas (.ods)
2. Select some cells in non-printing area, for copy
3. "Accidentally" move these cells with the mouse
4. Undo this move
5. Select again, copy and try to paste it somewhere
6. Blows up without a trace
Comment 1 tommy27 2015-07-29 12:48:40 UTC
please upload a test .ods file where you constantly reproduce the bug so it's easier and faster for QA to reproduce.

otherwise we have to create such a file from scratch which is time-consuming and may not entirely correspond to your bug scenario.

also consider testing a 4.4.x release to see if the bug is fixed in the newer branch.

you can find in the link below a portable version of LibO 4.4.4.3 so you don't have to uninstall your current 4.3.7 release

http://www.winpenpack.com/main/download.php?view.1354

status NEEDINFO
Comment 2 Weisz Roland 2015-07-29 13:07:22 UTC
Created attachment 117514 [details]
testcase

Bug can be reproduced with this .ods
Comment 3 Weisz Roland 2015-07-29 13:28:04 UTC
Installed 4.4.4.3 and can confirm that bug is still present
Comment 4 raal 2015-07-29 17:02:02 UTC
I can confirm crash with Verze: 5.0.0.4 (x64)
ID sestavení: cf112dc905650fb985306a7a03d2fe3fcc6c978f
and Version: 5.1.0.0.alpha1+
Build ID: 74d4168f8830f7bbec6b784c3fb774296d9adafa
TinderBox: Linux-rpm_deb-x86_64@46-TDF, Branch:master, Time: 2015-07-22_06:14:00
Comment 5 tommy27 2015-07-29 19:15:31 UTC
tested with older releases under Win8.1 x64

works fine with LibO 3.5.7
crashes with LibO 3.6.0 and following releases

regression of the 3.6.x branch
Comment 6 Michael Weghorn 2015-08-07 23:19:51 UTC
bibisect result (using the bibisect-43all repository):

79e02001f27d33b3b478324ab6fba5683413b4d9 is the first bad commit
commit 79e02001f27d33b3b478324ab6fba5683413b4d9
Author: Bjoern Michaelsen <bjoern.michaelsen@canonical.com>
Date:   Tue Dec 11 04:56:54 2012 +0000

    source-hash-b6c016da23d309b4ac7d154bc33a22397974ed73
    
    commit b6c016da23d309b4ac7d154bc33a22397974ed73
    Author:     Tor Lillqvist <tml@iki.fi>
    AuthorDate: Mon Nov 19 11:16:15 2012 +0200
    Commit:     Tor Lillqvist <tlillqvist@suse.com>
    CommitDate: Mon Nov 19 12:26:44 2012 +0200
    
        Use gb_VISIBILITY_FLAGS
    
        Change-Id: I6be70c0b8d73f4d1d1428c0df94ea6d8bdc782f7

:100644 100644 26157d38356b3591abc92ee949953d37ac93201f 99e65e2d132b0f467d52718cb5574bbd276b84c5 M	autogen.log
:100644 100644 5f3674b08eed2ed4a5a89db302b5a9c11e5cc33e d1dffcac5e20f137981a1ee53d82819296660d8f M	ccache.log
:100644 100644 1b372eb248c5d4846b8e34b67c97c86ee2137d7a e90409ec8ead05c8fe982311c4fad9412f935b8b M	commitmsg
:100644 100644 fe6de78bab06d66b4dcc7daf3e8da0a9bd028bcd 76efee933474fa0d7569b3e6f0943d3bd9dc876a M	dev-install.log
:100644 100644 15080cbc9084e133603b9c0a387bc9f590c8e05b 3891157aa7844c43f80ea5b431309453836479b8 M	make.log
:040000 040000 af9223892695b7550d228ad3a89f09d98ffb9e44 5522d7515450a2abddaca0ef2d8c2d6e5d03572a M	opt
michi@michilaptop:~/development/lo-bibisecting/bibisect-43all$ git bisect log
# bad: [2e0fa432485d1db6abd355dad8ccb06f0b97e4fb] source-hash-ce90f99a2d66c2b998ad3f9f028e2ea623a757f5
# good: [65fd30f5cb4cdd37995a33420ed8273c0a29bf00] source-hash-d6cde02dbce8c28c6af836e2dc1120f8a6ef9932
git bisect start 'last40onmaster' 'oldest'
# skip: [aed6d9e275e4560aa251d23dd7ba6a0a725afab7] source-hash-c77918bb03974ff9be90c889f77e62ea0755052f
git bisect skip aed6d9e275e4560aa251d23dd7ba6a0a725afab7
# good: [7d3d1a6f00503d8d402f5069e746ec5eb492a096] source-hash-f9a453fb01908e16032abdbf1f895666e1d260a6
git bisect good 7d3d1a6f00503d8d402f5069e746ec5eb492a096
# good: [6de635532dbabb9b181c251e5fc4d1c08a6eaccf] source-hash-2c270eeff422ef93100376ce0717a131d4f3cc2f
git bisect good 6de635532dbabb9b181c251e5fc4d1c08a6eaccf
# good: [ba6eb41acb8df58f3009920f8ab8b32a3e1b764e] source-hash-ae4e4a11d4300f7448cb6bd170fcb034542caddc
git bisect good ba6eb41acb8df58f3009920f8ab8b32a3e1b764e
# bad: [1f14665c5624bc7a502738aa8f4f2bd70a211e72] source-hash-d85fd8a85501547d5bb87822d2589a07aed7f2d6
git bisect bad 1f14665c5624bc7a502738aa8f4f2bd70a211e72
# good: [7fd8bdb3b18f50ea0adbc0a5e611f6a844b23189] source-hash-a1ac2538e9b287444500618ab4d2f0f06c25cf34
git bisect good 7fd8bdb3b18f50ea0adbc0a5e611f6a844b23189
# good: [221bf5c0db153e24c67ff29fe614af7cc010a356] source-hash-9210b95bcfd65ae558f445666d9b880e794d4c74
git bisect good 221bf5c0db153e24c67ff29fe614af7cc010a356
# bad: [79e02001f27d33b3b478324ab6fba5683413b4d9] source-hash-b6c016da23d309b4ac7d154bc33a22397974ed73
git bisect bad 79e02001f27d33b3b478324ab6fba5683413b4d9
# first bad commit: [79e02001f27d33b3b478324ab6fba5683413b4d9] source-hash-b6c016da23d309b4ac7d154bc33a22397974ed73
Comment 7 Eike Rathke 2015-08-17 15:16:59 UTC
I can't reproduce, neither in 5-0 (to be 5.0.2) nor 4-4 (to be 4.4.6) branch nor 4.4.5
Comment 8 Timur 2015-08-17 17:12:31 UTC
Created attachment 117977 [details]
backtrace

Reproduced both in Windows and Linux.
Comment 9 Eike Rathke 2015-08-18 12:15:19 UTC
@Timur:
Can you attach a backtrace with symbols, preferably produced on Linux?
Comment 10 Timur 2015-08-19 13:15:51 UTC
Created attachment 118019 [details]
backtrace WinDBG.txt

I don't know why I get errors while debugging, especially those nt...
Here are 3 different debug logs. Please take a look, the last one should be correct, but I'm not sure.
Comment 11 Timur 2015-08-19 16:42:54 UTC
Created attachment 118026 [details]
gdbtrace.log
Comment 12 Timur 2015-08-24 07:47:52 UTC
Created attachment 118108 [details]
gdbtrace.log
Comment 13 Timur 2015-08-24 08:36:18 UTC
There's another problem with this file, crash on close:

Required steps to reproduce:
1. Sheets with non-printing areas (.ods)
2. Select some cells in non-printing area, for copy (for example K11-K19)
3. move these cells with the mouse
4. Undo this move
5. Close worksheet or Calc
6. Crash
Comment 14 Timur 2015-09-08 15:53:46 UTC
@Eike: would you be so kind to confirm that debug/trace is useful, if not, to ask someone to do it better?
I'm eager to have this one fixed, hoping it's the same as non-reproducible 46406.
Comment 15 Eike Rathke 2015-09-09 11:04:19 UTC
Ha, indeed it is as it pointed out the Sdr... undo stuff, also the K11:K19 hint. Seems I never included a cell with an annotation in my earlier attempts to reproduce. Now I get nice crashes ;) already in the Undo step, at least in dbgutil dev build due to an invalidated pointer.
Comment 16 Eike Rathke 2015-09-09 12:22:16 UTC
I'm trying to grasp that.. apparently an already deleted caption object of an ScPostIt is accessed.
Comment 17 Commit Notification 2015-09-10 13:57:37 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=44f34c1163882c2e3086282374fee9cd55ee211f

Resolves: tdf#92995 do not delete caption objects that are held by Undo

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 18 Eike Rathke 2015-09-10 17:10:55 UTC
Pending review
https://gerrit.libreoffice.org/18470 for 5-0
https://gerrit.libreoffice.org/18472 for 5-0-2
https://gerrit.libreoffice.org/18474 for 4-4
Comment 19 Commit Notification 2015-09-11 09:43:15 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "libreoffice-4-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=a07333a3f88ab39db554751146687fa6351d2ea0&h=libreoffice-4-4

Resolves: tdf#92995 do not delete caption objects that are held by Undo

It will be available in 4.4.6.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 20 Commit Notification 2015-09-11 09:43:24 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "libreoffice-5-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=fa26aa0bdb0c93c2a3e5d0bfc879e9185a6e910e&h=libreoffice-5-0

Resolves: tdf#92995 do not delete caption objects that are held by Undo

It will be available in 5.0.3.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 21 Commit Notification 2015-09-11 09:51:23 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "libreoffice-5-0-2":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=b6f31e1025d658f15ed8280225c4b5c032639629&h=libreoffice-5-0-2

Resolves: tdf#92995 do not delete caption objects that are held by Undo

It will be available in 5.0.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 22 Commit Notification 2015-09-11 17:27:08 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=04e66812efedb0be635d60b4c1bb3f89113dfdad

unit test for MoveBlock / ScUndoDragDrop caption life cycle, tdf#92995

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 23 Robinson Tryon (qubit) 2015-12-17 10:29:53 UTC Comment hidden (obsolete)