Bug 118827

Summary: CRASH when adding comment to a tracked change (no gtk3)
Product: LibreOffice Reporter: Gabor Kelemen (allotropia) <kelemeng>
Component: UIAssignee: Caolán McNamara <caolan.mcnamara>
Status: VERIFIED FIXED    
Severity: major CC: caolan.mcnamara, xiscofauli
Priority: medium Keywords: bibisected, bisected, haveBacktrace, regression
Version: 6.2.0.0.alpha0+   
Hardware: All   
OS: All   
See Also: https://crashreport.libreoffice.org/stats/signature/vcl::Window::ImplGetWindowExtentsRelative(vcl::Window%20*,bool)
Whiteboard: target:6.2.0 target:6.1.0.2
Crash report or crash signature: ["vcl::Window::ImplGetWindowExtentsRelative(vcl::Window *,bool)"] Regression By:
Attachments: Example file made with a current master Writer
gdb backtrace

Description Gabor Kelemen (allotropia) 2018-07-18 15:39:27 UTC 
Created attachment 143620 [details]
Example file made with a current master Writer

If we insert a track change comment LibreOffice crashes. This used to work in 6.0.x

Steps to reproduce:

    1. Create a new document in Writer
    2. Enable track changes with Edit->Track Changes->Record
    3. Type text
    4. Click in the changed text
    5. Click Edit->Track Changes->Comment and type text in dialogue and OK
    6. Click anywhere in the document
    7. With the attached document: open Edit – Track Changes – Manage. LibreOffice crashes on opening the window.


LibreOffice details:
Version: 6.2.0.0.alpha0+
Build Id: e7d3976cb80f7e7401be071905a764dd6cb4d6e
CPU threads: 4; OS: Windows 6.1; UI render: default;
TinderBox: Win-x86@42, Branc:master, Time: 2018-06-29_04:46:32
Locale: hu-HU (hu_HU); Calc: group threaded

Bibisected with /bibisect-win32-6.1 to the commit: 
https://cgit.freedesktop.org/libreoffice/core/commit/?id=77a59cabf33d5d6ccc80ea62ee07162abc1b4e52

# bad: [7ee9f0665bc96bcfa34506bef9b1569e6b368708] source 22c451df33b733440f24c1feb6380d31240d55e6
# good: [29d08f54c2f71ffee4fe12dbb24c5f5cbedecfd2] source 6eeac3539ea4cac32d126c5e24141f262eb5a4d9
git bisect start 'origin/master' 'oldest'
# good: [c0dc3e12b2b5f3047c02ed9cfe2f54e3fd663273] source fa2a43c29051b1bdcd0aef2e9cebfd206a4448ce
git bisect good c0dc3e12b2b5f3047c02ed9cfe2f54e3fd663273
# good: [aa9ee79da17464e0558d7b73ef63e1e14c5ba342] source cc7ff0c141e27090ab521073b961b5eeeb4d693e
git bisect good aa9ee79da17464e0558d7b73ef63e1e14c5ba342
# bad: [3a91a0eac74a6f94ea2ec5b69edf16658be818f2] source c4380ced324877a91a6df5db938c70ab53a257a1
git bisect bad 3a91a0eac74a6f94ea2ec5b69edf16658be818f2
# bad: [c329ce0207b27fca59767250b821a986269aadc4] source e87ea03a0d595ed478f281a723a6889228babeb2
git bisect bad c329ce0207b27fca59767250b821a986269aadc4
# bad: [e167d258e60bd93f679c9bee530a71026e84b873] source 73584b2342b4e527b5329b4bf779171c4fc2d4ce
git bisect bad e167d258e60bd93f679c9bee530a71026e84b873
# bad: [59b56d152bf84e20e4920156235efd07c29f279f] source 3564b46992fc30e212011c19043a2553178ccbca
git bisect bad 59b56d152bf84e20e4920156235efd07c29f279f
# good: [39e64c1e1f2e5e32607d04c7e2b5ee4993199178] source 2653baa095f9699731e54e8cc854482670f9f418
git bisect good 39e64c1e1f2e5e32607d04c7e2b5ee4993199178
# bad: [60be3a0fa66341a7f1d237c43cd12744c13cf159] source 998f1c23a0a0b54bfb1182d2da0306e18aaae68c
git bisect bad 60be3a0fa66341a7f1d237c43cd12744c13cf159
# good: [8e6334c6d39dbe130f4bb6b1118a5fe27c4cd72c] source c4c8865f98a884936c07e16a75e576b91eb2b4f1
git bisect good 8e6334c6d39dbe130f4bb6b1118a5fe27c4cd72c
# good: [c7031d911607d37f66341ccadd9a60da4fa6cfdf] source 8885ffd9702f72047d9fc94c82ee57221e4e927c
git bisect good c7031d911607d37f66341ccadd9a60da4fa6cfdf
# bad: [d0db93320bc06db53e8113b647706d13fbe0626a] source f942587a654cd916e6d30ec532de3f2f320c4977
git bisect bad d0db93320bc06db53e8113b647706d13fbe0626a
# bad: [dbf1057b95917dc0e5c766bed3e20a7a2b126165] source 77a59cabf33d5d6ccc80ea62ee07162abc1b4e52
git bisect bad dbf1057b95917dc0e5c766bed3e20a7a2b126165
# good: [6cd6daaf4e30ab99fe353c0750700c96e8905387] source a9a94b744e9d61a3ff56c0b1830a56145607758f
git bisect good 6cd6daaf4e30ab99fe353c0750700c96e8905387
# first bad commit: [dbf1057b95917dc0e5c766bed3e20a7a2b126165] source 77a59cabf33d5d6ccc80ea62ee07162abc1b4e52

We also got this output on the cygwin console:

0x0FADAAD5 (0x0118EE48 0x145CA9D8 0x00000000 0x0118EE58), ?ImplGetWindowExtentsRelative@Window@vcl@@ABE?AVRectangle@tools@@PAV12@_N@Z() + 0x15 bytes(s)
0x0FAD9F50 (0x0118EE48 0x145CA9D8 0x0FF701B4 0x0FF701B4), ?GetWindowExtentsRelative@Window@vcl@@QBE?AVRectangle@tools@@PAV12@@Z() + 0x10 bytes(s)
0x0FD4E541 (0x1E37D874 0x0118EEAC 0x0118EEA8 0x0118EEA4), ?get_expanded@VclExpander@@QBE_NXZ() + 0x61 bytes(s)
0x1C8E4E50 (0x0118EF30 0x0000FFFF 0x0000FFFF 0x150BA1D8), ?Scroll@SwView@@QAEXABVRectangle@tools@@GG@Z() + 0xF0 bytes(s)
0x1C81C9D3 (0x150BA1D8 0x150BA290 0x0000FFFF 0x0000FFFF), ?GetTableMode@SwModuleOptions@@QBE?AW4TableChgMode@@XZ() + 0x233 bytes(s)
0x1C672CC5 (0x14FDCDF8 0x150BA1D8 0x150BA1D8 0x00000000), ?MakeVisible@SwViewShell@@QAEXABVSwRect@@@Z() + 0xA5 bytes(s)
0x1C132660 (0x14FC5228 0x0118F050 0x1C136214 0x150BA290), ?MakeSelVisible@SwCursorShell@@UAEXXZ() + 0xD0 bytes(s)
0x1C35A43A (0x479BFBBE 0x00000004 0x150BA1D8 0x00000000), ?MakeSelVisible@SwFEShell@@UAEXXZ() + 0x5A bytes(s)
0x1C13649A (0x00000006 0x00000000 0x479BFB2A 0x15091C20), ?UpdateCursor@SwCursorShell@@AAEXG_N@Z() + 0x103A bytes(s)
0x1C12EF27 (0x00000000 0x00000001 0x150BA1D8 0x0118F0F4), ?EndAction@SwCursorShell@@QAEX_N0@Z() + 0x117 bytes(s)
0x1C12F040 (0x00000000 0x479BFB1A 0x0118F118 0x1C9C7410), ?EndCursorMove@SwCursorShell@@QAEX_N@Z() + 0x10 bytes(s)
0x1C31CD8B (0x479BFACA 0x150BA1D8 0x714B6090 0x15091C20), ??1SwEditShell@@UAE@XZ() + 0x4B bytes(s)
0x1C8185FD (0x150BA1D8 0x0118F214 0x14FD1700 0x15091C00), ?IsNbspRunNext@SwEditShell@@QBE_NXZ() + 0x744D bytes(s)
0x1C81583E (0x01000000 0xF806C79D 0x00000003 0x0118F424), ?IsNbspRunNext@SwEditShell@@QBE_NXZ() + 0x468E bytes(s)
0x0FAE7BDF (0x0118F35C 0x00000001 0x00000000 0x000000AF), ?ImplAsyncFocusHdl@Window@vcl@@QAEXPAX@Z() + 0x26BF bytes(s)
0x0FAE86A6 (0x0A63ABA0 0x0118F424 0xF806C751 0x00000003), ?ImplAsyncFocusHdl@Window@vcl@@QAEXPAX@Z() + 0x3186 bytes(s)
0x0FAE9236 (0x0A63ABA0 0x00000003 0x0118F424 0xF806C0DD), ?ImplSetMouseDown@FloatingWindow@@QAEXXZ() + 0x156 bytes(s)
0x0FE58DE2 (0x001B0AA0 0x00000201 0x00000001 0x00E700AF), ?GetPassThroughToOS@CommandMediaData@@QBE_NXZ() + 0x2B22 bytes(s)
0x0FE5C753 (0x001B0AA0 0x00000201 0x00000001 0x00E700AF), ?IsFullScreenMode@WorkWindow@@QBE_NXZ() + 0x9B3 bytes(s)
0x0FE5CCAD (0x001B0AA0 0x00000201 0x00000001 0x00E700AF), ?IsFullScreenMode@WorkWindow@@QBE_NXZ() + 0xF0D bytes(s)
0x7704D313 (0x0FE5CC50 0x001B0AA0 0x00000201 0x00000001), SetManipulationInputTarget() + 0x53 bytes(s)
0x7702E8DA (0x0FE5CC50 0x00000000 0x00000201 0x00000001), DispatchMessageW() + 0x90A bytes(s)
0x7702DF67 (0x0FE5CC50 0x001B0AA0 0x00000201 0x00000001), CallWindowProcW() + 0x97 bytes(s)
0x682ECE43 (0x001B0AA0 0x00000201 0x00000001 0x00E700AF), glDebugEntry() + 0xEB3 bytes(s)
0x7704D313 (0x682ECC10 0x001B0AA0 0x00000201 0x00000001), SetManipulationInputTarget() + 0x53 bytes(s)
0x7702E8DA (0x682ECC10 0x00000000 0x00000201 0x00000001), DispatchMessageW() + 0x90A bytes(s)
0x7702E234 (0xF806C361 0x0118F800 0x0FE2AC00 0x0118F818), DispatchMessageW() + 0x264 bytes(s)
0x7702DFE0 (0x0118F818 0x100E0001 0x770391A0 0x0A619C80), DispatchMessageW() + 0x10 bytes(s)
0x0FE2AC00 (0x0118F818 0x05BADE08 0x00000001 0x100EA498), ?parse@WinBlocklistParser@@QAEXXZ() + 0x8FD0 bytes(s)
0x0FE2AD79 (0x00717001 0x00000000 0xF806CCE1 0x100EA498), ?parse@WinBlocklistParser@@QAEXXZ() + 0x9149 bytes(s)
0x0FE2A7DF (0x00717001 0x00000000 0xF806CC39 0x0FD65700), ?parse@WinBlocklistParser@@QAEXXZ() + 0x8BAF bytes(s)
0x0FD63947 (0xCDC893EF 0x100EA498 0x00000003 0x00000001), ?Execute@Application@@SAXXZ() + 0x157 bytes(s)
0x7139D0F6 (0xF806CD6D 0x00000000 0x00000003 0x00714000)
0x0FD6B6DA (0x05BAE790 0x0118FA80 0x713CB309 0xCDC890BB), ?DeInitVCL@@YAXXZ() + 0xB1A bytes(s)
0x0FD6BB89 (0xCDC890BB 0x00000003 0x714431F0 0x00000000), ?SVMain@@YAHXZ() + 0x29 bytes(s)
0x713CB309 (0x002F438C 0x002F1236 0x002F0000 0x00000000), soffice_main() + 0x79 bytes(s)
0x002F1021 (0x00714000 0x745862A0 0x2C438814 0x0118FB30)
0x745862C4 (0x00714000 0x16656986 0x00000000 0x00000000), BaseThreadInitThunk() + 0x24 bytes(s)
0x775E1EB9 (0xFFFFFFFF 0x77603576 0x00000000 0x00000000), RtlSubscribeWnfStateChangeNotification() + 0x439 bytes(s)
0x775E1E84 (0x002F12DA 0x00714000 0x00000000 0x00000000), RtlSubscribeWnfStateChangeNotification() + 0x404 bytes(s)
Comment 1 Gabor Kelemen (allotropia) 2018-07-18 15:59:04 UTC 
I checked with a fresh version from the bibisect-win32-6.2 repo, still happens on:

Version: 6.2.0.0.alpha0+
Build ID: e72577d1ebd58a4d79bfd7c51086e3542170f1d2
CPU threads: 4; OS: Windows 6.3; UI render: default; 
Locale: hu-HU (hu_HU); Calc: group threaded

But only on adding a new track changes comment, not on opening the Manage Changes dialog, so point 7 above is incorrect.
Comment 2 Xisco Faulí 2018-07-18 16:19:28 UTC 
Reproduced in

Version: 6.2.0.0.alpha0+
Build ID: 95b00f1bfa341003af23e150d316d943d47909cf
CPU threads: 4; OS: Linux 4.13; UI render: default; VCL: gtk2; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group threaded

not reproduced in gtk3

Commit: https://cgit.freedesktop.org/libreoffice/core/commit/?id=77a59cabf33d5d6ccc80ea62ee07162abc1b4e52

Adding Cc: to Caolán McNamara
Comment 3 Xisco Faulí 2018-07-18 16:29:02 UTC 
Created attachment 143624 [details]
gdb backtrace
Comment 4 Commit Notification 2018-07-19 14:50:24 UTC 
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=9c4d1503ba0ff97cdb113653b8dfe3ce66798ad5

Resolves: tdf#118827 SetCareWin should be SetCareDialog

It will be available in 6.2.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 5 Caolán McNamara 2018-07-19 14:51:06 UTC 
backport to 6-1 in gerrit
Comment 6 Commit Notification 2018-07-19 20:06:17 UTC 
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-6-1":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=80e083c17422c464981d959b87589a5efc987dd8&h=libreoffice-6-1

Resolves: tdf#118827 SetCareWin should be SetCareDialog

It will be available in 6.1.0.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 7 Xisco Faulí 2018-07-24 10:16:46 UTC 
Verified in

Version: 6.2.0.0.alpha0+
Build ID: dcbb65f2a4a3ee70ccd4896d7a5e975dbd9e6509
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: x11; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group threaded

@Caolán, Thanks for fixing this!!!