sw: better fix for DOCX table import crash

libreport version: 2.0.8
abrt_version: 2.0.7
backtrace_rating: 4
cmdline: /usr/lib/libreoffice/program/soffice.bin --writer file:///media/D69AC9A59AC9828B/Documents%20and%20Settings/Ingrida/Downloads/CVTemplate-EDITED-KAROLIS.docx --splash-pipe=7
crash_function: GetPos
executable: /usr/lib/libreoffice/program/soffice.bin
kernel: 3.3.2-6.fc16.i686
pid: 8371
pwd: /home/karolis
reason: Process /usr/lib/libreoffice/program/soffice.bin was killed by signal 11 (SIGSEGV)
time: Wed 09 May 2012 02:31:30 PM IST
uid: 1000
username: karolis
xsession_errors:

backtrace: Text file, 40328 bytes
dso_list: Text file, 19156 bytes
maps: Text file, 47704 bytes

comment:
:Tried to add a column to a table when it crashed.
:It was a .docx document

environ:
:XDG_VTNR=1
:XDG_SESSION_ID=2
:HOSTNAME=mothership
:IMSETTINGS_INTEGRATE_DESKTOP=yes
:GIO_LAUNCHED_DESKTOP_FILE_PID=8359
:GPG_AGENT_INFO=/tmp/keyring-7H0h2E/gpg:0:1
:SHELL=/bin/bash
:TERM=dumb
:DESKTOP_STARTUP_ID=nautilus-8032-mothership-libreoffice-6_TIME14911677
:HISTSIZE=1000
:XDG_SESSION_COOKIE=6e2bf614b7910041d770f50d0000000f-1336555375.546154-155461563
:GJS_DEBUG_OUTPUT=stderr
:OLDPWD=/usr/lib/libreoffice/program
:GNOME_KEYRING_CONTROL=/tmp/keyring-7H0h2E
:'GJS_DEBUG_TOPICS=JS ERROR;JS LOG'
:IMSETTINGS_MODULE=none
:USER=karolis
:SSH_AUTH_SOCK=/tmp/keyring-7H0h2E/ssh
:USERNAME=karolis
:SESSION_MANAGER=local/unix:@/tmp/.ICE-unix/1576,unix/unix:/tmp/.ICE-unix/1576
:GIO_LAUNCHED_DESKTOP_FILE=/usr/share/applications/libreoffice-writer.desktop
:MAIL=/var/spool/mail/karolis
:PATH=/usr/lib/ccache:/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin:/sbin:/usr/local/go/bin:/home/karolis/.local/bin:/home/karolis/bin
:DESKTOP_SESSION=gnome
:QT_IM_MODULE=xim
:PWD=/home/karolis
:XMODIFIERS=@im=none
:GNOME_KEYRING_PID=1568
:LANG=en_US.UTF-8
:GDMSESSION=gnome
:HISTCONTROL=ignoredups
:HOME=/home/karolis
:XDG_SEAT=seat0
:SHLVL=1
:GNOME_DESKTOP_SESSION_ID=this-is-deprecated
:SAL_ENABLE_FILE_LOCKING=1
:LOGNAME=karolis
:CVS_RSH=ssh
:DBUS_SESSION_BUS_ADDRESS=unix:abstract=/tmp/dbus-wmU1MWVEZc,guid=55f7a6bfacf75b6ab48fe18e000000a0
:'LESSOPEN=||/usr/bin/lesspipe.sh %s'
:WINDOWPATH=1
:XDG_RUNTIME_DIR=/run/user/karolis
:DISPLAY=:0.0
:CCACHE_HASHDIR=
:XAUTHORITY=/var/run/gdm/auth-for-karolis-ztVzMc/database
:LD_LIBRARY_PATH=/usr/java/jre1.6.0_31/lib/i386/client:/usr/java/jre1.6.0_31/lib/i386/server:/usr/java/jre1.6.0_31/lib/i386/native_threads:/usr/java/jre1.6.0_31/lib/i386

smolt_data:
:
:
:General
:=================================
:UUID: 8bef7ae9-3c6f-46da-8f11-494ba7855420
:OS: Fedora release 16 (Verne)
:Default run level: Unknown
:Language: en_US.UTF-8
:Platform: i686
:BogoMIPS: 4748.52
:CPU Vendor: GenuineIntel
:CPU Model: Intel(R) Core(TM) i5 CPU M 430 @ 2.27GHz
:CPU Stepping: 2
:CPU Family: 6
:CPU Model Num: 37
:Number of CPUs: 4
:CPU Speed: 2267
:System Memory: 2695
:System Swap: 7602
:Vendor: ASUSTeK Computer Inc.
:System: K52Jc 1.0
:Form factor: Notebook
:Kernel: 3.3.2-6.fc16.i686
:SELinux Enabled: 1
:SELinux Policy: targeted
:SELinux Enforce: Enforcing
:MythTV Remote: Unknown
:MythTV Role: Unknown
:MythTV Theme: ...

Created attachment 583305
File: dso_list

Created attachment 583306
File: maps

Created attachment 583307
File: backtrace

yuck, tables are hard. Are you able to provide the .docx which triggered the crash when you tried to insert a table. And if so can you indicate which table and into where you tried to add the column.

Created attachment 583479
File to reproduce the bug

Since the file isn't mine, I cleared most of the file, however you can still reproduce the bug by clicking on the column with the word `Writing`, Table -> Insert -> Columns and OK.
Also, this file originally looked like this: http://europass.cedefop.europa.eu/en/documents/curriculum-vitae/templates-instructions/templates/doc.doc
And became the unholy mess in the attachment after a save as docx

reproducible

meinsmeinsmeins!

grbml, it's mine i said...

crash is because the area above the "Wrting" cell in the table is not
covered by a cell.

the DOCX import filter creates tables with an irregular structure,
with different number of cells in each row; the SwDoc::TextToTable
should not allow that.

fixed upstream master:

http://cgit.freedesktop.org/libreoffice/core/commit/?id=6d2e09db4a677068095b0bebd08fbbb96620d60c

fix for this should be in next F17 upload 3.5.6.2-7

Table formatting messed in recent master.

* Open attachment 64325
* Compare it with attachment 64326

Since Sep 24 daily build on Windows XP, and in my master build Sep 29 on Linux.
Details will come later.

Created attachment 67913
screenshot: buggy formatting

Created attachment 67914
screenshot: buggy formatting

screenshot again ...

Created attachment 67917
screenshot: buggy formatting

Created attachment 67918
screenshot: buggy formatting

Bah, Bugzilla cut off first 4 bytes from .png image, and first 3 bytes from .jpg image. Trying again ...

Hello Michael,
I've done git bisect and, unfortunately, your commit introduced this bug.
http://cgit.freedesktop.org/libreoffice/core/commit/?id=6d2e09db4a677068095b0bebd08fbbb96620d60c

Could you please have a look here? Thanks :-)

This problem does not occur when imported as .doc, just when importing as .docx.

thanks Korrawit for finding that!

i realize now that my fix is totally wrong, because i
misunderstood how covered cells are represented in writer tables:

there is only a dummy TableBox with negative span for
vertically merged cells, but not for horizontally merged cells,
so it is valid for a table to have different number
of TableBoxes in eaach row.

need to think of a different solution for the original
problem that some part of the table was apparently not
covered by a cell...

Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=4113d9664c60d004474dfc1cffbcd7dc50fa6dc4

rhbz#820283, fdo#55462: sw: better fix for DOCX table import crash:

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.

grbml... that fix was actually bogus,
but now i've got one that doesn't break table import,
should be in 3.5.7.2-2.

http://cgit.freedesktop.org/libreoffice/core/commit/?id=4113d9664c60d004474dfc1cffbcd7dc50fa6dc4

libreoffice-3.5.7.2-2.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/libreoffice-3.5.7.2-2.fc17

Just tested with LO-master version 3.7.0.0.alpha0+ (Build ID: b29ecc9)

The merged horizontal cells problem seems to be solved. Thanks, Michael!

Testing with attachment 64325 shows that not all formatting problems are solved, however. In the second table not all cell boundary lines are drawn, content of some of the lower cells is lost and the light blue background object is placed on top, hiding some of the table content.

Importing the same document as DOC works much better.

I'll leave it up to Korrawit to decide whether he agrees about this bug being fixed.

Package libreoffice-3.5.7.2-2.fc17:
* should fix your issue,
* was pushed to the Fedora 17 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing libreoffice-3.5.7.2-2.fc17'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-15506/libreoffice-3.5.7.2-2.fc17
then log in and leave karma (feedback).

Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-3-6":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=314f92b0da54085499ea06e7ee53bef4b27181db&g=libreoffice-3-6

rhbz#820283, fdo#55462: sw: better fix for DOCX table import crash:

It will be available in LibreOffice 3.6.3.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.

Sorry for the late reply.

@Michael, Thanks for fixing.

@Stephan, Thanks for testing and noticing another bug with detailed description. Anyway, it is reported at bug 54660. So, this bug is, IMHO, fixed.

Thanks again for both of you!

libreoffice-3.5.7.2-2.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.