Bug 101859

Summary: All SalX11 based backends crash on popup menu disposal (gen, TDE, KDE4)
Product: LibreOffice Reporter: Jan-Marek Glogowski <glogow>
Component: graphics stackAssignee: Caolán McNamara <caolan.mcnamara>
Status: RESOLVED FIXED    
Severity: major CC: serval2412
Priority: medium Keywords: haveBacktrace
Version: 5.3.0.0.alpha0+   
Hardware: All   
OS: Linux (All)   
See Also: https://bugs.documentfoundation.org/show_bug.cgi?id=106159
Whiteboard: target:5.3.0
Crash report or crash signature: Regression By:
Attachments: Sections navigator crash
Backtrace from a debug build
bzip'd "soffice --strace" log

Description Jan-Marek Glogowski 2016-09-02 12:13:57 UTC 
Created attachment 127121 [details]
Sections navigator crash

Reproduce:

1. Open odt document (or create one with a section)
2. Open navigator (F5)
3. Right click on the "Section1" in "Sections"

From a debug build:

include/vcl/vclreferencebase.hxx:38: 
void VclReferenceBase::acquire() const: Assertion `mnRefCnt>0' failed.

See attached backtrace.
Guess commit aa0d0536a444fb26d9e570bd6bf6c1bdc3596cf3 is related.
Comment 1 Jan-Marek Glogowski 2016-09-02 12:14:51 UTC 
Created attachment 127122 [details]
Backtrace from a debug build
Comment 2 Thomas Hackert 2016-09-02 15:15:57 UTC 
Hello Jan-Marek, *,
thank you for reporting this bug :) I can confirm it with
OS: Debian Testing AMD64 with XFCE 4.12
LO: Version: 5.3.0.0.alpha0+
Build-ID: a8a7b7114d96b2013b00e9bc0ced81aad5495457
CPU-Threads: 4; BS-Version: Linux 4.5; UI-Render: Standard; 
TinderBox: Linux-rpm_deb-x86_64@70-TDF, Branch:master, Time: 2016-09-02_05:11:44
Gebietsschema: de-DE (de_DE.UTF-8); Calc: group
(parallel installed, following the instructions from https://wiki.documentfoundation.org/Installing_in_parallel/Linux),

so setting the status to "New".
HTH
Thomas.
Comment 3 Thomas Hackert 2016-09-02 15:23:56 UTC 
Created attachment 127125 [details]
bzip'd "soffice --strace" log
Comment 4 Julien Nabet 2016-09-09 20:23:19 UTC 
On pc Debian x86-64 with master sources updated today + dbgutil, I could reproduce this only with SAL_USE_VCLPLUGIN=kde4 or gen, not with gtk3 or gtk.
Comment 5 Julien Nabet 2016-09-09 20:42:23 UTC 
(In reply to Julien Nabet from comment #4)
> On pc Debian x86-64 with master sources updated today + dbgutil, I could
> reproduce this only with SAL_USE_VCLPLUGIN=kde4 or gen, not with gtk3 or gtk.

Sorry, should have read the whole title...
Comment 6 Commit Notification 2016-09-14 09:29:20 UTC 
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=fc6744603ab8bb5a00c4f97435b5e509bdeaeb94

Resolves: tdf#101859 dispose unused popupmenu before dtor

It will be available in 5.3.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 7 Caolán McNamara 2016-09-14 09:30:41 UTC 
That resolves this case anyway