Bug 70201 - CRASH during undoing of replace all operation
Summary: CRASH during undoing of replace all operation
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
4.1.0.2 rc
Hardware: Other All
: medium normal
Assignee: Arnaud Versini
URL:
Whiteboard: target:4.2.0 target:4.1.4
Keywords: regression
Depends on:
Blocks:
 
Reported: 2013-10-06 17:07 UTC by Arnaud Versini
Modified: 2017-07-12 15:24 UTC (History)
1 user (show)

See Also:
Crash report or crash signature:


Attachments
minimal reproducer bugdoc (6.75 KB, application/vnd.oasis.opendocument.text)
2013-10-08 13:20 UTC, Michael Stahl (allotropia)
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Arnaud Versini 2013-10-06 17:07:54 UTC
Steps to reproduce :

Open this document : https://bugs.launchpad.net/ubuntu/+source/libreoffice/+bug/1235935/+attachment/3862408/+files/Impacting%20the%20bioscience%20progress%20by%20backporting%20software%20fro%20Biolinux.odt
Search Bio-Linux and replace by BioLinux
Undo this operation

Expected behavior :
No modification in the document and no crash

Current behavior :
Crash

Same on the master
Comment 1 Mike Kaganski 2013-10-07 12:57:06 UTC
Reproducible with 4.1.0.2.0 - 4.1.2.3 under Win7x64.
Not reproducible with 4.1.0.1 and older -> regression.
Comment 2 Arnaud Versini 2013-10-07 12:59:49 UTC
I proposed a patch on Gerrit : https://gerrit.libreoffice.org/#/c/6147/
Comment 3 Michael Stahl (allotropia) 2013-10-08 13:16:00 UTC
problematic paragraph:

<text:p text:style-name="P61"><text:span text:style-name="T34">O</text:span>ne other repository <text:span text:style-name="T30">already mentioned above </text:span>is direct from the Bio-Linux team and provide the software that makes Bio-<text:span text:style-name="T110">L</text:span>inux to Bio-<text:span text:style-name="T110">L</text:span>inux. <text:span text:style-name="T30">It could be viewed at:</text:span></text:p>

minimal reproduction:

put cursor before second Bio-Linux in that paragraph,
replace _both_ second and third Bio-Linux,
Undo

crash in SwHistorySetTxt::SetInDoc()

node nOffset = 119

m_nStart = 122
m_nEnd = 122

which is the space in "Linux team" ...

so the hint somehow moved from its original position on the "L" to the right,
and lost its 1-character extent while doing so,
and then is deleted by the SwpHints::TryInsertHint() special case
for RSID-only empty range AUTOFMT.

... the first replace leaves behind the empty-range AUTOFMT and the second replace records it in SwHistorySetTxt...

the empty-range RSID-only AUTOFMT is produced by SwTxtNode::Update.

probably we should delete this somewhere..
Comment 4 Michael Stahl (allotropia) 2013-10-08 13:20:50 UTC
Created attachment 87278 [details]
minimal reproducer bugdoc

just Ctrl+H and replace "bar" with "blah" and Replace All, Undo -> crash

could be used for unit test too...
Comment 5 Michael Stahl (allotropia) 2013-10-08 19:31:43 UTC
fixed on master - although no unit test yet :)
Comment 6 Commit Notification 2013-10-08 19:38:25 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=91159b1c31a7fd474ba0b97828f593604790ce3c

fdo#70201: sw: eliminate no-extent RSID-only AUTOFMT hints



The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 7 Commit Notification 2013-10-09 13:23:05 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-4-1":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=a1d37630ae191f526cc83b0c964df9b9bcb7d41d&h=libreoffice-4-1

fdo#70201: sw: eliminate no-extent RSID-only AUTOFMT hints


It will be available in LibreOffice 4.1.4.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.