| Summary: | vba crashes after fireChangeEvent is called | ||
|---|---|---|---|
| Product: | LibreOffice | Reporter: | Justin L <jluth> |
| Component: | BASIC | Assignee: | Caolán McNamara <caolan.mcnamara> |
| Status: | VERIFIED FIXED | ||
| Severity: | normal | CC: | fdbugs, jluth |
| Priority: | medium | Keywords: | bibisected, haveBacktrace |
| Version: | 4.0.0.3 release | ||
| Hardware: | Other | ||
| OS: | All | ||
| Whiteboard: | target:4.5.0 target:4.4.0.0.beta3 target:4.3.6 | ||
| Crash report or crash signature: | Regression By: | ||
| Bug Depends on: | |||
| Bug Blocks: | 86667 | ||
| Attachments: |
xls macro that demonstrates crashes when combobox, radiobutton, textbox values are modified using VBA code
Linux 4.5 master backtrace gdbtrace bt with debug symbols |
||
|
Description
Justin L
2014-11-29 10:46:07 UTC
Confirmed on Linux / 4.3.4.1 and master -> NEW Created attachment 110218 [details]
Linux 4.5 master backtrace
Created attachment 110219 [details]
gdbtrace
running from 4.1 development code at the time when the bug surfaced.
I think the fix might come from this area:
if( mpPar.Is() )
173 {
174 // Register this as element 0, but don't change over the parent!
175 mpPar->GetRef( 0 ) = this;
176 }
Similar code can be found in basic/source/class/sbxmod.cxx
if( mpPar.Is() )
2153 {
2154 // Enregister this as element 0, but don't reset the parent!
2155 switch( GetType() ) {
2156 case SbxEMPTY:
2157 case SbxVOID:
2158 break;
2159 default:
2160 mpPar->PutDirect( pThisCopy, 0 );
2161 break;
2162 }
2163 SetParameters( NULL );
2164 }
crashes still happen when mpPar->GetRef(0) = this is commented out. Keep looking elsewhere... Created attachment 110240 [details]
bt with debug symbols
On pc Debian x86-64 with master sources updated yesterday I could reproduce this.
I attached bt with symbols.
Caolán McNamara committed a patch related to this issue. It has been pushed to "master": http://cgit.freedesktop.org/libreoffice/core/commit/?id=19d0950451f909086c3732ce29812c4cda513908 Resolves: fdo#86843 avoid getting deleted before finishing Broadcast It will be available in 4.5.0. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback. Caolán McNamara committed a patch related to this issue. It has been pushed to "libreoffice-4-4": http://cgit.freedesktop.org/libreoffice/core/commit/?id=ca1d5ef57dc1ae7a0ebafc5ed9a11150ca6eb4eb&h=libreoffice-4-4 Resolves: fdo#86843 avoid getting deleted before finishing Broadcast It will be available in 4.4.0.0.beta3. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback. That seems to work fine for me now with this fix Tested the fix and no crashing seen. Can the fix be cherrypicked to the 4.3.5 branch too? Thanks for the help. Caolán McNamara committed a patch related to this issue. It has been pushed to "libreoffice-4-3": http://cgit.freedesktop.org/libreoffice/core/commit/?id=c3d625af537dcb5ca380b7fb30345d0cbd90e4b1&h=libreoffice-4-3 Resolves: fdo#86843 avoid getting deleted before finishing Broadcast It will be available in 4.3.6. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback. Tested OK on 4.3.6 dev branch. (need to comment out an old assert in order to run the example test .xls under 4.3.6 debug mode). Migrating Whiteboard tags to Keywords: (bibisected) [NinjaEdit] |