Bug 89348

Created attachment 113349 [details]
reproduction case

Reproduced with 4.3.3.2 (Debian x86-64 build) and master as of 2015-02-05 (my own debug build).

Reproduction instructions

1. Open attached odt file.

2. In the table, go to the middle cell in the row that starts with
   "AMN Healthcare".

3. Go to any other program (emacs, terminal, ...)

4. Select any text; copy it if you are not using X11.

5. Go back to the LibreOffice window.

6. Paste the text (with middle mouse button on X11)

Expected behaviour: the text is pasted and LibreOffice continues to function.

Actual behaviour: nearly each time, LibreOffice goes into an infinite CPU loop (pumps 100% CPU and is completely unresponsive). Sometimes it doesn't enter infinite loop immediately after the paste, the paste happens, but if one presses the left arrow button on the keyboard, LibreOffice then goes into infinite CPU loop.

I ran LibreOffice (master) under gdb to see the infinite loop. It happens in function SwCntntFrm::MakeAll in file sw/source/core/layout/calcmove.cxx.

The overall execution pattern is:

The loop starts on line 1194:

    while ( !mbValidPos || !mbValidSize || !mbValidPrtArea )
    {
       ....
    }

It executes until line 1445:

        // - loop prevention
        {
            if ( aOldFrm_StopFormat == Frm() &&
                 aOldPrt_StopFormat == Prt() )
            {
                ++nConsecutiveFormatsWithoutChange;
            }
            else
            {
                nConsecutiveFormatsWithoutChange = 0;
            }
        }

        // Yet again an invalid value? Repeat from the start...
        if ( !mbValidPos || !mbValidSize || !mbValidPrtArea )
            continue;


Each time it arrives there, the state has been toggled between two states:

STATE 1
=======

aOldFrm_StopFormat and aOldPrt_StopFormat look good. Frm() and Prt() have zero height in their size.

We have !mbValidPos && !mbValidSize && !mbValidPrtArea

STATE 2
=======

Frm() and Prt() look good. aOldFrm_StopFormat and aOldPrt_StopFormat have zero height in their size.

We have mbValidPos && mbValidSize && !mbValidPrtArea



In each case, nConsecutiveFormatsWithoutChange is set to zero and the "continue" is invoked since at least one flag is false.


The backtrace looks like:

#7  0x00007fa2397d1d73 in SwCntntFrm::MakeAll (this=0x4035030)
    at /home/master/src/libreoffice/workdirs/libreoffice-4-5/sw/source/core/layout/calcmove.cxx:1333
#8  0x00007fa2397cc546 in SwFrm::OptPrepareMake (this=this@entry=0x4035030)
    at /home/master/src/libreoffice/workdirs/libreoffice-4-5/sw/source/core/layout/calcmove.cxx:359
#9  0x00007fa23982afdc in SwFrm::OptCalc (this=this@entry=0x4035030)
    at /home/master/src/libreoffice/workdirs/libreoffice-4-5/sw/source/core/inc/frame.hxx:1001
#10 0x00007fa239828c70 in SwLayAction::_FormatCntnt (this=this@entry=0x7ffffd004180, pCntnt=pCntnt@entry=0x4035030, 
    pPage=pPage@entry=0x40394f0)
    at /home/master/src/libreoffice/workdirs/libreoffice-4-5/sw/source/core/layout/layact.cxx:1818
#11 0x00007fa23982810c in SwLayAction::FormatCntnt (this=this@entry=0x7ffffd004180, pPage=pPage@entry=0x40394f0)
    at /home/master/src/libreoffice/workdirs/libreoffice-4-5/sw/source/core/layout/layact.cxx:1649
#12 0x00007fa2398246a1 in SwLayAction::InternalAction (this=this@entry=0x7ffffd004180)
    at /home/master/src/libreoffice/workdirs/libreoffice-4-5/sw/source/core/layout/layact.cxx:780
#13 0x00007fa239822fdb in SwLayAction::Action (this=this@entry=0x7ffffd004180)
    at /home/master/src/libreoffice/workdirs/libreoffice-4-5/sw/source/core/layout/layact.cxx:370
#14 0x00007fa23982a248 in SwLayIdle::SwLayIdle (this=0x7ffffd0043b0, pRt=0x3fc04e0, pI=0x3fbde80)
    at /home/master/src/libreoffice/workdirs/libreoffice-4-5/sw/source/core/layout/layact.cxx:2167
#15 0x00007fa239cf1a88 in SwViewShell::LayoutIdle (this=0x3fc0e80)
    at /home/master/src/libreoffice/workdirs/libreoffice-4-5/sw/source/core/view/viewsh.cxx:701
#16 0x00007fa239543296 in sw::DocumentTimerManager::DoIdleJobs (this=this@entry=0x3cdd8a0, pTimer=pTimer@entry=0x3cdd8b8)
    at /home/master/src/libreoffice/workdirs/libreoffice-4-5/sw/source/core/doc/DocumentTimerManager.cxx:120
#17 0x00007fa239542fb3 in sw::DocumentTimerManager::LinkStubDoIdleJobs (pThis=0x3cdd8a0, pCaller=0x3cdd8b8)
    at /home/master/src/libreoffice/workdirs/libreoffice-4-5/sw/source/core/doc/DocumentTimerManager.cxx:82
#18 0x00007fa254b05ffa in Link::Call (this=this@entry=0x3cdd8d8, pCaller=pCaller@entry=0x3cdd8b8)
    at /home/master/src/libreoffice/workdirs/libreoffice-4-5/include/tools/link.hxx:139
#19 0x00007fa2550da76d in Idle::DoIdle (this=this@entry=0x3cdd8b8)
    at /home/master/src/libreoffice/workdirs/libreoffice-4-5/vcl/source/app/timer.cxx:436
#20 0x00007fa254da0678 in Idle::Timeout (this=0x3cdd8b8)
    at /home/master/src/libreoffice/workdirs/libreoffice-4-5/include/vcl/timer.hxx:118
#21 0x00007fa2550da8c4 in ImplTimerData::Invoke (this=this@entry=0x86c1510)
    at /home/master/src/libreoffice/workdirs/libreoffice-4-5/vcl/source/app/timer.cxx:54
#22 0x00007fa2550d9e75 in Timer::ImplTimerCallbackProc (idle=<optimized out>)
    at /home/master/src/libreoffice/workdirs/libreoffice-4-5/vcl/source/app/timer.cxx:162
#23 0x00007fa2454a4c74 in SalTimer::CallCallback (this=0x37351a0, idle=idle@entry=true)
    at /home/master/src/libreoffice/workdirs/libreoffice-4-5/vcl/inc/saltimer.hxx:53