Bug 154860

Summary: !!br0ken!! appears in table cell with a mixture of track changes record + undo/redo
Product: LibreOffice Reporter: Telesto <telesto>
Component: WriterAssignee: Not Assigned <libreoffice-bugs>
Status: NEW ---    
Severity: normal CC: aron.budea, stephane.guillou
Priority: medium Keywords: haveBacktrace
Version: 7.6.0.0 alpha0+   
Hardware: All   
OS: All   
Whiteboard:
Crash report or crash signature: Regression By:
Bug Depends on:    
Bug Blocks: 83946, 105537    
Attachments: bt with debug symbols

Description Telesto 2023-04-17 13:07:02 UTC 
Description:
!!br0ken!! appears in table cell with a mixture of track changes record + undo/redo

Steps to Reproduce:
1. Open Writer
2. Insert a 2x2 table
3. Edit -> Track Changes -> Record ON (Show ON)
4. Type 'A' in A1, Type 'B' in A2
5. Press Delete Row Button 2x
6. Press and hold CTRL+Z until everything is undone
7. Press CTRL+Y until everything is redone (empty table, with cursor in A1)
8. Type 'XXX' (text will be black, instead of track changes insert color)
9. Press tab
10. Press and hold CTRL+Z until everything is undone
11. Press CTRL+Y to redo everything

Actual Results:
!!br0ken!! (likely also a assert somewhere, but I'm using a non-debug build right now)

Expected Results:
Proper undo/redo


Reproducible: Always


User Profile Reset: No

Additional Info:
Version: 7.6.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: c4a58634753a84b09f20f7271d6525a6656522d3
CPU threads: 4; OS: Windows 6.3 Build 9600; UI render: Skia/Raster; VCL: win
Locale: nl-NL (nl_NL); UI: en-US
Calc: CL threaded
Comment 1 Stéphane Guillou (stragu) 2023-04-17 15:41:37 UTC 
Tried with a debug build from a few days ago. After these steps:

1. Open Writer
2. Insert a 2x2 table
3. Edit -> Track Changes -> Record ON (Show ON)
4. Type 'A' in A1, Type 'B' in A2
5. Press Delete Row Button 2x
6. Press and hold CTRL+Z until everything is undone
7. Press CTRL+Y until everything is redone

... I get the warnings:

warn:legacy.osl:77021:77021:sw/source/core/doc/DocumentRedlineManager.cxx:1327: Redline end: index after text
warn:legacy.osl:77021:77021:sw/source/core/edit/edattr.cxx:728: Index outside the range - endless loop!

After that, if I type in the cell A2, I get the crash with failed assertion:

soffice.bin: /home/tdf/lode/jenkins/workspace/lo_gerrit/tb/src_master/sal/rtl/strtmpl.hxx:1005: void rtl::str::newFromSubString(IMPL_RTL_STRINGDATA**, const IMPL_RTL_STRINGDATA*, sal_Int32, sal_Int32) [with IMPL_RTL_STRINGDATA = _rtl_uString; sal_Int32 = int]: Assertion `false' failed.

Alternatively, if I click in another cell instead of adding text, I get a different crash with failed assertion:

soffice.bin: /home/tdf/lode/jenkins/workspace/lo_gerrit/tb/src_master/include/rtl/ustring.hxx:2230: std::u16string_view rtl::OUString::subView(sal_Int32, sal_Int32) const: Assertion `count <= getLength() - beginIndex' failed.
Comment 2 Julien Nabet 2023-04-17 15:48:35 UTC 
Created attachment 186732 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today, I could reproduce this.
Comment 3 Stéphane Guillou (stragu) 2023-04-17 16:03:05 UTC 
(In reply to Stéphane Guillou (stragu) from comment #1)
> Tried with a debug build from a few days ago.

Forgot the version details:

Version: 7.6.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 1b463f697405e64a03378fb38a32172c4d3c25e6
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: fr-FR (fr_FR.UTF-8); UI: en-US
Calc: threaded

No crash if not debug.