https://bugs.documentfoundation.org/show_bug.cgi?id=173902
Bug ID: 173902
Summary: Crash in SwSectionFrame::IsEndnoteAtMyEnd() when
inserting a section around a nested section whose
leading frame has been emptied
Product: LibreOffice
Version: 26.2.2.2 release
Hardware: x86-64 (AMD64)
OS: Linux (All)
Status: UNCONFIRMED
Severity: normal
Priority: medium
Component: Writer
Assignee: [email protected]
Reporter: [email protected]
Description:
Disclosure: The analysis, the reproducer and this report were produced with
Claude (AI assistant by Anthropic). The crashes and the backtrace below come
from actual runs; the explanation of the cause is derived from reading the
source and has not been verified with a debug build.
Reproducible: Always (headless, fresh profile; GUI not tested)
Tested: 26.2.2.2 (Ubuntu 26.04 package), 26.8.0.3 (NixOS build)
Without step d: no crash.
Via remote UNO (attached .py) it crashes reliably only with lockControllers();
without it, it crashed sporadically in our CI. Forcing a layout between d and e
(controller property "PageCount") prevents the crash.
Cause (from the source):
Step d empties MIDDLE's first SwSectionFrame; SwContentFrame::Cut() calls
SwSectionFrame::DelEmpty(false), which sets m_pSection = nullptr and leaves the
frame registered at MIDDLE's format until the next layout runs
DeleteEmptySct().
In step e, SwNodes::InsertTextSection() re-parents MIDDLE's format
(SetDerivedFrom), the format change reaches the half-dead frame, and
UpdateAttrForFormatChange() -> IsEndnoteAtMyEnd() dereferences m_pSection
without a check. Unchanged on master.
Related: tdf#173357 has the same root cause in SwSectionFrame::Notify(); a fix
only there would not cover this path. tdf#173357 was bisected to the
tdf#146605 commit cb188ce336e434c2b7002b3d8a41a681e73ae51a; this bug is not
bibisected.
Crash reporter: about 100 reports for this signature (7.4 .. 25.2), none
linked to a bug. They show the same path, also from HTML paste
(SwHTMLParser::NewDivision), e.g.
https://crashreport.libreoffice.org/stats/crash_details/2dee1219-9d6f-4f6b-8a4f-27999c3e03c7
Steps to Reproduce:
1. Run the attached macro nested_section_crash.bas (Tools > Macros). Via the
API it:
a. creates a Writer document with the paragraphs "a", "b", "c"
b. inserts section INNER around "c"
c. inserts section MIDDLE around "b" .. "c" -> MIDDLE { b, INNER { c } }
d. disposes paragraph "b"
e. inserts section OUTER around "a" .. "c"
Actual Results:
Crash in step e.
Expected Results:
No crash.
Reproducible: Always
User Profile Reset: Yes
Additional Info:
Backtrace (gdb, 26.8.0.3, no debug symbols):
#0 SwSectionFrame::IsEndnoteAtMyEnd() const
#1 SwSectionFrame::UpdateAttrForFormatChange(SwSectionFrameInvFlags&)
#2 SwSectionFrame::SwClientNotify(SwModify const&, SfxHint const&)
#3 SwModify::CallSwClientNotify(SfxHint const&) const
#4 sw::BroadcastingModify::CallSwClientNotify(SfxHint const&) const
#5 SwModify::SwClientNotify(SwModify const&, SfxHint const&)
#6 SwFormat::SetDerivedFrom(SwFormat*)
#7 SwNodes::InsertTextSection(...)
#8 SwDoc::InsertSwSection(...)
#9 SwXTextSection::attach(...)
#10 SwXText::insertTextContent(...)
--
You are receiving this mail because:
You are the assignee for the bug.
