Bug 103809

Summary:	Crash selecting Navigator Next/Previous page buttons (vcllo.dll -- vclreferencebase.hxx) -- generic crash reporter mergedlo.dll
Product:	LibreOffice	Reporter:	V Stuart Foote <vsfoote>
Component:	Writer	Assignee:	Caolán McNamara <caolan.mcnamara>
Status:	VERIFIED FIXED
Severity:	critical	CC:	serval2412, vsfoote, xiscofauli, zolnaitamas2000
Priority:	high	Keywords:	bibisectRequest, regression
Version:	5.3.0.0.alpha1+
Hardware:	All
OS:	All
Whiteboard:	target:5.3.0 target:5.2.4
Crash report or crash signature:	["mergedlo.dll"]	Regression By:
Attachments:	sample multipage document with bookmarks set WinDbg 32 with symbols (TB39) Stack Trace equivalent bt with symbols but on Linux with gtk3

Description V Stuart Foote 2016-11-09 13:57:01 UTC

Created attachment 128616 [details]
sample multipage document with bookmarks set

This bug was filed from the crash reporting server and is br-578b613b-bc02-42dd-b049-b6122fce90ce.
=========================================

With multi-page ODT document open in Writer crash with the Next/Previous Page movement buttons. Occurs in either Navigator deck instance--F5 detached or the Sidebar instance.

1. Open document to page 1
2. enable Navigator (F5 detached, or Sidebar deck)
3. select Next Page button

crash...

or
1. Open document, move to page 3
2. enable Navigator (F5 or Sidebar)
3. select Previous Page button

crash...

Comment 1 V Stuart Foote 2016-11-09 14:52:29 UTC

Created attachment 128617 [details]
WinDbg 32 with symbols (TB39) Stack Trace

a WinDbg w/Symbols (TB39) Stack Trace attached...

looks to hang following button the button selection with:
00d8e1b4 63b607df vcllo!VclReferenceBase::acquire(void)+0xa [c:\cygwin\home\tinderbox\master\include\vcl\vclreferencebase.hxx @ 38]
00d8e1c0 63b58c04 vcllo!rtl::Reference<vcl::Window>::set(class vcl::Window * pBody = 0x0b91d2e8)+0x1f [c:\cygwin\home\tinderbox\master\include\rtl\ref.hxx @ 101]
00d8e1d4 63febecd vcllo!VclPtr<vcl::Window>::operator=(class vcl::Window * pBody = 0x0b91d2e8)+0x14 [c:\cygwin\home\tinderbox\master\include\vcl\vclptr.hxx @ 178]

Comment 2 V Stuart Foote 2016-11-09 14:55:20 UTC

crashreport.libreoffice.org submission with
On Windows 10 Pro 64-bit (1607) en-US with
Version: 5.3.0.0.alpha1+
Build ID: 05d2a66955f8a6552a79696474386ca9f45f9ef2
CPU Threads: 8; OS Version: Windows 6.2; UI Render: default; Layout Engine: old; 
TinderBox: Win-x86@62-merge-TDF, Branch:MASTER, Time: 2016-11-07_23:34:48
Locale: en-US (en_US); Calc: CL

WinDbg stack trace on same system with
Version: 5.3.0.0.alpha1+
Build ID: cea3b8762bfb7f0da19bab8a3d468bcbf987eb0f
CPU Threads: 8; OS Version: Windows 6.19; UI Render: GL; Layout Engine: new; 
TinderBox: Win-x86@39, Branch:master, Time: 2016-11-06_19:55:54
Locale: en-US (en_US); Calc: CL

Comment 3 V Stuart Foote 2016-11-09 15:03:11 UTC

Notihing to do with new layout engine nor OpenGL rendering, same issue and ST when both are disabled

Version: 5.3.0.0.alpha1+
Build ID: cea3b8762bfb7f0da19bab8a3d468bcbf987eb0f
CPU Threads: 8; OS Version: Windows 6.19; UI Render: default; Layout Engine: old; 
TinderBox: Win-x86@39, Branch:master, Time: 2016-11-06_19:55:54
Locale: en-US (en_US); Calc: CL

Comment 4 Xisco Faulí 2016-11-09 19:00:10 UTC

Confirmed in

Version: 5.3.0.0.alpha1+
Build ID: 8a2a3f1032b4e60f7607e3ecb1ff99a6bb9af7f9
CPU Threads: 4; OS Version: Linux 4.2; UI Render: GL; VCL: gtk2; Layout Engine: new; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group

but not in

Version: 5.3.0.0.alpha1+
Build ID: 8dc495c93239739629683bb29e4110f5c57c94f0
CPU Threads: 4; OS Version: Linux 4.2; UI Render: default; VCL: gtk2; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group

Comment 5 Julien Nabet 2016-11-09 22:37:54 UTC

Created attachment 128628 [details]
equivalent bt with symbols but on Linux with gtk3

On pc Debian x86-64 with master sources updated today (24063ec94bd3f8407827f03ccde8bd99790f85e2), I could reproduce this.

Comment 6 Commit Notification 2016-11-10 16:17:42 UTC

Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=8445764681bfe7bd6cd31194878e1314a8fafa3b

Resolves: tdf#103809 the argument is a bool* not a VclPtr

It will be available in 5.3.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.

Comment 7 V Stuart Foote 2016-11-10 20:27:10 UTC

*** Bug 103844 has been marked as a duplicate of this bug. ***

Comment 8 V Stuart Foote 2016-11-10 20:27:24 UTC

*** Bug 103845 has been marked as a duplicate of this bug. ***

Comment 9 Commit Notification 2016-11-11 00:40:30 UTC

Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-5-2":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=327dd016a401c96c21a0b87acf92fb6510c5d4b5&h=libreoffice-5-2

Resolves: tdf#103809 the argument is a bool* not a VclPtr

It will be available in 5.2.4.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.

Comment 10 V Stuart Foote 2016-11-11 03:47:13 UTC

Thanks Caolán!

Comment 11 V Stuart Foote 2016-11-11 03:48:30 UTC

Verified fixed...

Version: 5.3.0.0.alpha1+
Build ID: 93187848937377993bdc093ddc05fdae63286040
CPU Threads: 8; OS Version: Windows 6.2; UI Render: GL; Layout Engine: new; 
TinderBox: Win-x86@62-merge-TDF, Branch:MASTER, Time: 2016-11-11_00:04:40
Locale: en-US (en_US); Calc: CL