Crash when changing orientation of page in layout

[Nswany]

What is the bug or the crash?

the project in QGIS 3.22.1 crashes when in layout changing orientation of the page of map (first page) and length of attribute table (by filter) on the second page report_136.zip

Steps to reproduce the issue

1.Open the project tables_placement from geopackage.
• The project tables_placement has one layout: test with two pages:
• first page – map,
• Second page – table.
• The table has resize mode: repeat until finished
• The content of table changes depending on the orientation of the map by filter expression.
• The orientation of the map is determined by the variable @b.

2.Open the layout test: the map has ‘landscape’ orientation and the table is placed properly and is continued to the next pages (repeated until finished)
3.Change variable @b from ‘landscape’ to’ portrait’ and refresh layout:
CRASH!

Versions

QGIS 3.22.1

Supported QGIS version

• I'm running a supported QGIS version according to the roadmap.

New profile

• I tried with a new QGIS profile

Additional context

No response

[jgrocha]

Confirmed. I was able to reproduce it following the steps provided.

My console log:

src/app/layout/qgslayoutdesignerdialog.cpp:4051 : (restoreWindowState) [22029ms] restore of layout UI geometry failed
Warning: QList::removeAt(): Index out of range.
Stacktrace (piped through c++filt):
qgis(+0xfb88)[0x55d499b3db88]
qgis(+0x10342)[0x55d499b3e342]
/lib/x86_64-linux-gnu/libQt5Core.so.5(+0xc4330)[0x7feb0ed5d330]
/lib/x86_64-linux-gnu/libQt5Core.so.5(+0xc4449)[0x7feb0ed5d449]
/lib/x86_64-linux-gnu/libQt5Core.so.5(QMessageLogger::warning(char const*, ...) const+0xba)[0x7feb0ed2941c]
/usr/local/lib/libqgis_core.so.3.23.0(+0x14fd9ee)[0x7feb0ceff9ee]
/usr/local/lib/libqgis_core.so.3.23.0(QgsLayoutMultiFrame::removeFrame(int, bool)+0x17a)[0x7feb0cefd570]
/usr/local/lib/libqgis_core.so.3.23.0(QgsLayoutMultiFrame::recalculateFrameSizes()+0x1ca)[0x7feb0cefbc00]
/usr/local/lib/libqgis_core.so.3.23.0(QgsLayoutTable::recalculateFrameSizes()+0x7e)[0x7feb0cf23100]
/usr/local/lib/libqgis_core.so.3.23.0(+0x14fe9c9)[0x7feb0cf009c9]
/usr/local/lib/libqgis_core.so.3.23.0(+0x14fe7ac)[0x7feb0cf007ac]
/usr/local/lib/libqgis_core.so.3.23.0(+0x14fe43b)[0x7feb0cf0043b]
/lib/x86_64-linux-gnu/libQt5Core.so.5(+0x2f0a53)[0x7feb0ef89a53]
/usr/local/lib/libqgis_core.so.3.23.0(QgsLayoutItem::sizePositionChanged()+0x2d)[0x7feb0c1c8479]
/usr/local/lib/libqgis_core.so.3.23.0(QgsLayoutItem::attemptMove(QgsLayoutPoint const&, bool, bool, int)+0x4af)[0x7feb0ce23b55]
/usr/local/lib/libqgis_core.so.3.23.0(QgsLayoutPageCollection::endPageSizeChange()+0xf2)[0x7feb0cf0bc52]
/usr/local/lib/libqgis_core.so.3.23.0(QgsLayoutPageCollection::deletePage(int)+0x215)[0x7feb0cf0f609]
/usr/local/lib/libqgis_core.so.3.23.0(QgsLayoutMultiFrame::removeFrame(int, bool)+0x138)[0x7feb0cefd52e]
/usr/local/lib/libqgis_core.so.3.23.0(QgsLayoutMultiFrame::recalculateFrameSizes()+0x1ca)[0x7feb0cefbc00]
/usr/local/lib/libqgis_core.so.3.23.0(QgsLayoutTable::recalculateFrameSizes()+0x7e)[0x7feb0cf23100]
Warning: QList::removeAt(): Index out of range.
Stacktrace (piped through c++filt):
qgis(+0xfb88)[0x55d499b3db88]
qgis(+0x10342)[0x55d499b3e342]
/lib/x86_64-linux-gnu/libQt5Core.so.5(+0xc4330)[0x7feb0ed5d330]
/lib/x86_64-linux-gnu/libQt5Core.so.5(+0xc4449)[0x7feb0ed5d449]
/lib/x86_64-linux-gnu/libQt5Core.so.5(QMessageLogger::warning(char const*, ...) const+0xba)[0x7feb0ed2941c]
/usr/local/lib/libqgis_core.so.3.23.0(+0x14fd9ee)[0x7feb0ceff9ee]
/usr/local/lib/libqgis_core.so.3.23.0(QgsLayoutMultiFrame::removeFrame(int, bool)+0x17a)[0x7feb0cefd570]
/usr/local/lib/libqgis_core.so.3.23.0(QgsLayoutMultiFrame::recalculateFrameSizes()+0x1ca)[0x7feb0cefbc00]
/usr/local/lib/libqgis_core.so.3.23.0(QgsLayoutTable::recalculateFrameSizes()+0x7e)[0x7feb0cf23100]
/usr/local/lib/libqgis_core.so.3.23.0(+0x14fe9c9)[0x7feb0cf009c9]
/usr/local/lib/libqgis_core.so.3.23.0(+0x14fe7ac)[0x7feb0cf007ac]
/usr/local/lib/libqgis_core.so.3.23.0(+0x14fe43b)[0x7feb0cf0043b]
/lib/x86_64-linux-gnu/libQt5Core.so.5(+0x2f0a53)[0x7feb0ef89a53]
/usr/local/lib/libqgis_core.so.3.23.0(QgsLayoutItem::sizePositionChanged()+0x2d)[0x7feb0c1c8479]
/usr/local/lib/libqgis_core.so.3.23.0(QgsLayoutItem::attemptMove(QgsLayoutPoint const&, bool, bool, int)+0x4af)[0x7feb0ce23b55]
/usr/local/lib/libqgis_core.so.3.23.0(QgsLayoutPageCollection::endPageSizeChange()+0xf2)[0x7feb0cf0bc52]
/usr/local/lib/libqgis_core.so.3.23.0(QgsLayoutPageCollection::deletePage(int)+0x215)[0x7feb0cf0f609]
/usr/local/lib/libqgis_core.so.3.23.0(QgsLayoutMultiFrame::removeFrame(int, bool)+0x138)[0x7feb0cefd52e]
/usr/local/lib/libqgis_core.so.3.23.0(QgsLayoutMultiFrame::recalculateFrameSizes()+0x1ca)[0x7feb0cefbc00]
/usr/local/lib/libqgis_core.so.3.23.0(QgsLayoutTable::recalculateFrameSizes()+0x7e)[0x7feb0cf23100]
Fatal: ASSERT failure in QgsLayoutItemUndoCommand::saveState: "could not retrieve item for saving state", file /home/jgr/dev/cpp/QGIS/src/core/layout/qgslayoutitemundocommand.cpp, line 58
QGIS died on signal -1Could not attach to process.  If your uid matches the uid of the target
process, check the setting of /proc/sys/kernel/yama/ptrace_scope, or try
again as the root user.  For more details, see /etc/sysctl.d/10-ptrace.conf
ptrace: Operation not permitted.
No thread selected
No stack.
gdb returned 256
Aborted (core dumped)

[roya0045]

@jgrocha That's weird because there is a sefaty in the function to prevent removing out of range index. See https://github.com/qgis/QGIS/blob/master/src/core/layout/qgslayoutmultiframe.cpp#L421

Could it be possible that the elements stored in mFrameItems are removed between the test and the removal? Or if the elements being pointed get removed (is that possible?) Otherwise I'm not sure what's happenning.