https://bugs.documentfoundation.org/show_bug.cgi?id=172892
Bug ID: 172892
Summary: Writer CRASH: std::vector<double> out-of-bounds
assertion in SwFntObj::GetTextSize (KernArray) during
PDF export / layout of a document with an anchored
image
Product: LibreOffice
Version: 26.2.4.2 release
Hardware: All
OS: Linux (All)
Status: UNCONFIRMED
Severity: normal
Priority: medium
Component: Writer
Assignee: [email protected]
Reporter: [email protected]
Description:
Exporting a specific document to PDF (equivalently: any full layout pass)
aborts with a hardened-libstdc++ assertion. A std::vector<double> is indexed
past its end inside SwFntObj::GetTextSize
(sw/source/core/txtnode/fntcache.cxx),
reached from the line-breaking code (SwTextGuess::Guess) during CalcLayout.
The vector is the glyph-advance / KernArray. The document opens and exports
correctly in an older release (7.3.7.2); it aborts in 26.2.4.2, so this is a
regression.
Steps to Reproduce:
1. Open the affected document.
2. Export to PDF (File > Export As > Export as PDF), or headless:
soffice --headless --convert-to pdf file.odt
3. The application aborts during layout / rendering, before a PDF is produced.
Actual Results:
Abort. Assertion '__n < this->size()' failed for
std::vector<double>::operator[], in SwFntObj::GetTextSize
(fntcache.cxx), via SwTextGuess::Guess (line break) during
SwViewShell::CalcLayout, triggered by SwXTextDocument::getRendererCount
for the PDF export.
- Works: LibreOffice 7.3.7.2
- Crashes: LibreOffice 26.2.4.2 (see build ID below)
Expected Results:
Document lays out and the PDF is exported without crashing.
Reproducible: Always
User Profile Reset: No
Additional Info:
- The crash is knife-edge and disappears on ANY perturbation of the layout:
* re-saving the file in LibreOffice (any version) produces a file that
opens fine;
* inserting a single space before the anchored image removes it;
* inserting a page break after the image (after the table of contents)
removes it.
It therefore reproduces ONLY from the original, un-round-tripped
serialization. A file that has been saved by LibreOffice no longer
reproduces it.
- An image anchored near the start of the document is part of the trigger:
removing that image avoids the crash. The image itself appears innocent;
it shifts the line-break position such that one specific text portion is
formatted at the offending index.
- No text grid is enabled (page style: "no grid").
- The overflowing structure is a std::vector<double>. This may be related to
the KernArray sal_Int32 -> double conversion and the surrounding
layout-context / justification bounds work; noting it only as a pointer,
not a diagnosis.
[optional: Font / script of the paragraph next to the image, e.g. whether
CJK or complex-script text is involved — this affects glyph-vs-character
counting and may matter for reproduction.]
Reproducing file:
The document is an unpublished manuscript and cannot be attached publicly.
Backtrace (top frames):
#0 0x00007ffff7cb551c in __pthread_kill_implementation ()
at /usr/lib/x86_64-linux-gnu/libc.so.6
#1 0x00007ffff7c5b2be in raise () at /usr/lib/x86_64-linux-gnu/libc.so.6
#2 0x00007ffff7c428ed in abort () at /usr/lib/x86_64-linux-gnu/libc.so.6
#3 0x00007ffff78b55ca in std::__glibcxx_assert_fail(char const*, int, char
const*, char const*) () at /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#4 0x00007fffe5a192cd in std::vector<double, std::allocator<double>
>::operator[] (__n=<optimized out>, this=<optimized out>)
at /usr/include/c++/15.2.0/bits/stl_vector.h:1263
#5 0x00007fffe5a19589 in std::vector<double, std::allocator<double>
>::operator[] (this=<optimized out>, __n=<optimized out>)
at /run/build/libreoffice/sw/source/core/txtnode/fntcache.cxx:525
#6 SwFntObj::GetTextSize (this=<optimized out>, rInf=...)
at /run/build/libreoffice/sw/source/core/txtnode/fntcache.cxx:1787
#7 0x00007fffe6094cf6 in SwSubFont::GetTextSize_
(this=0x7fffd4349380, rInf=...)
at /run/build/libreoffice/sw/source/core/txtnode/swfont.cxx:1043
#8 0x00007fffe5fc341e in SwFont::GetTextSize_ (this=<optimized out>, rInf=...)
at /run/build/libreoffice/sw/source/core/inc/swfont.hxx:320
#9 SwTextSizeInfo::GetTextSize
(this=this@entry=0x7fffffff9240, pSI=pSI@entry=0x55555c3f2a40, nIndex=...,
nLength=...,
nLength@entry=..., nLayoutContext=std::optional [no contained value],
nComp=0, nMinSize=@0x7fffffff8130: 0, nMaxSizeDiff=@0x7fffffff7f30:
140737488322384, nExtraAscent=@0x7fffffff7f38: 0,
nExtraDescent=@0x7fffffff7f40: 0, pCache=0x7fffdc236f90) at
/run/build/libreoffice/sw/source/core/text/inftxt.cxx:465
#10 0x00007fffe5fc0963 in SwTextGuess::Guess
(this=this@entry=0x7fffffff8110, rPor=..., rInf=..., nPorHeight=<optimized
out>, nSpacesInLine=nSpacesInLine@entry=0,
nPropWordSpacing=nPropWordSpacing@entry=100, nSpaceWidth=0)
at /run/build/libreoffice/sw/source/core/text/guess.cxx:881
#11 0x00007fffe6012745 in SwTextPortion::Format_
(this=0x55555ab62ef0, rInf=...)
at /run/build/libreoffice/sw/source/core/text/portxt.cxx:536
#12 0x00007fffe5fe4c99 in SwTextFormatter::BuildPortions
(this=this@entry=0x7fffffff9480, rInf=<optimized out>)
at /run/build/libreoffice/sw/source/core/text/itrform2.cxx:640
#13 0x00007fffe5fe629e in SwTextFormatter::FormatLine
(this=this@entry=0x7fffffff9480, nStartPos=...)
at /run/build/libreoffice/sw/source/core/text/itrform2.cxx:2102
#14 0x00007fffe5fb1f0e in SwTextFrame::FormatLine
(this=this@entry=0x5555597dcb80, rLine=..., bPrev=bPrev@entry=false)
at /run/build/libreoffice/sw/source/core/text/itrtxt.hxx:88
#15 0x00007fffe5fb6da3 in SwTextFrame::Format_
(this=this@entry=0x5555597dcb80, rLine=..., rInf=...,
bAdjust=bAdjust@entry=false) at
/run/build/libreoffice/sw/source/core/text/frmform.cxx:1873
#16 0x00007fffe5fb7afa in SwTextFrame::FormatImpl
(this=this@entry=0x5555597dcb80,
pRenderContext=pRenderContext@entry=0x555559388450,
pPara=pPara@entry=0x55555c3f2920, rIntersectingObjs=std::vector of length 0,
capacity 0)
at /run/build/libreoffice/sw/source/core/text/frmform.cxx:2064
#17 0x00007fffe5fb8b5e in SwTextFrame::Format
(this=0x5555597dcb80, pRenderContext=0x555559388450)
at /run/build/libreoffice/sw/source/core/text/frmform.cxx:2318
#18 0x00007fffe5e8c1e1 in SwContentFrame::MakeAll (this=0x5555597dcb80)
a t /run/build/libreoffice/sw/source/core/layout/calcmove.cxx:1635
#19 0x00007fffe5e89959 in SwFrame::OptPrepareMake (this=0x5555597dcb80)
at /run/build/libreoffice/sw/source/core/layout/calcmove.cxx:420
#20 0x00007fffe5ed2313 in SwFrame::OptCalc (this=<optimized out>)
at /run/build/libreoffice/sw/source/core/inc/frame.hxx:1135
#21 0x00007fffe5ed2951 in SwLayAction::FormatContent
(this=this@entry=0x7fffffffb100, pPage=pPage@entry=0x55555c322100)
at /run/build/libreoffice/sw/source/core/layout/layact.cxx:1849
#22 0x00007fffe5ed6483 in SwLayAction::InternalAction
(this=0x7fffffffb100, pRenderContext=0x555559388450)
at /run/build/libreoffice/sw/source/core/layout/layact.cxx:641
#23 0x00007fffe5ed6db9 in SwLayAction::Action
(this=this@entry=0x7fffffffb100, pRenderContext=0x555559388450)
at /run/build/libreoffice/sw/source/core/layout/layact.cxx:404
#24 0x00007fffe6309e46 in SwViewShell::CalcLayout
(this=this@entry=0x5555593ee960)
at /run/build/libreoffice/include/rtl/ref.hxx:203
#25 0x00007fffe5df81cd in SwEditShell::CalcLayout (this=0x5555593ee960)
at /run/build/libreoffice/sw/source/core/edit/edws.cxx:89
#26 0x00007fffe6719851 in SwXTextDocument::getRendererCount
(this=0x5555592370c0, rSelection=<optimized out>, rxOptions=...)
at /run/build/libreoffice/sw/source/uibase/uno/unotxdoc.cxx:2767
#27 0x00007fffddc292b6 in PDFExport::Export
(this=this@entry=0x7fffffffbd40, rFile=<optimized out>, rFilterData=...)
at /run/build/libreoffice/filter/source/pdf/pdfexport.cxx:1148
System:
Version: 26.2.4.2 (X86_64)
Build ID: 0229ac93fcf0d7cbc6376066c6f35021cef002dc
CPU threads: 12; OS: Linux 6.8; UI render: default; VCL: gtk3
Locale: de-DE (de_DE.UTF-8); UI: de-DE
Flatpak
Calc: threaded
--
You are receiving this mail because:
You are the assignee for the bug.
