Bug 91672

Version: 5.1.0.0.alpha1+
Build ID: b9630867d17c01ec41f6461b1e96288f3932248c
TinderBox: Linux-rpm_deb-x86_64@46-TDF, Branch:master, Time: 2015-05-25_00:46:48

Backtrace:

http://paste.openstack.org/show/242354/

Comparing the deletion to LO 4.1.6.2, it looks like erroneously the repost section is deleted and not header and footer.

Unfortunately whatever caused this is masked by a long (separate) VclPtr related breakage

It's somewhere in aef1826d9ca318a1359a2116e7f146e993413234^1..7a7a908263fc5761e963606d063bf1154112b87f (1084 commits)

Created attachment 116108 [details]
Linux backtrace

Copied backtrace into attachment

Just verified, that this commit still works: [1].

[1] 352c40dd5ce715f6ae654b8dedf2fc2145275a1d

Interesting the '!' I get is a fatal UNO error thrown to here:

#6  0x00007f142559263c in Application::ShowNativeErrorBox (sTitle="LibreOfficeDev 5.0 - Fatal Error", sMessage="") at /data/opt/libreoffice/master/vcl/source/app/svapp.cxx:1537
#7  0x00007f142c0539da in desktop::(anonymous namespace)::FatalError (sMessage="") at /data/opt/libreoffice/master/desktop/source/app/app.cxx:437
#8  0x00007f142c0582a9 in desktop::Desktop::Main (this=0x7fffb6d8b5c0) at /data/opt/libreoffice/master/desktop/source/app/app.cxx:1621
#9  0x00007f1425597a09 in ImplSVMain () at /data/opt/libreoffice/master/vcl/source/app/svmain.cxx:162

(gdb) p exUNO
$1 = (const com::sun::star::uno::Exception &) @0x33873d0: {Message = "", Context = empty uno::Reference}

Will poke in a bit.

the last __cxx_throw before this had a trace of:

Breakpoint 1, 0x00007ffff6b519c0 in __cxa_throw () from /usr/lib64/libstdc++.so.6
#0  0x00007ffff6b519c0 in __cxa_throw () from /usr/lib64/libstdc++.so.6
#1  0x00007fffba5bf2c7 in SvxDrawPage::getCount (this=0x1aa8ad0) at /data/opt/libreoffice/master/svx/source/unodraw/unopage.cxx:334
#2  0x00007fffa1bf63c8 in reportdesign::OSection::getCount (this=0x183a8a0) at /data/opt/libreoffice/master/reportdesign/source/core/api/Section.cxx:468
#3  0x00007fffa173c997 in rptui::OReportController::GetState (this=0x1b108e0, _nId=12615) at /data/opt/libreoffice/master/reportdesign/source/ui/report/ReportController.cxx:517
#4  0x00007fffb71b16cc in dbaui::OGenericUnoController::isCommandChecked (this=0x1b108e0, _nCommandId=12615) at /data/opt/libreoffice/master/dbaccess/source/ui/browser/genericcontroller.cxx:1430
#5  0x00007fffa176fc84 in rptui::lcl_insertMenuItemImages (rContextMenu=..., rController=..., _xReportDefinition=uno::Reference to (reportdesign::OReportDefinition *) 0x19fec40, _rFrame=uno::Reference to ((anonymous namespace)::Frame *) 0x1b68798) at /data/opt/libreoffice/master/reportdesign/source/ui/report/ReportSection.cxx:469
#6  0x00007fffa176fac0 in rptui::lcl_insertMenuItemImages (rContextMenu=..., rController=..., _xReportDefinition=uno::Reference to (reportdesign::OReportDefinition *) 0x19fec40, _rFrame=uno::Reference to ((anonymous namespace)::Frame *) 0x1b68798) at /data/opt/libreoffice/master/reportdesign/source/ui/report/ReportSection.cxx:452
#7  0x00007fffa176fe94 in rptui::OReportSection::Command (this=0x1a1ebe0, _rCEvt=...) at /data/opt/libreoffice/master/reportdesign/source/ui/report/ReportSection.cxx:485
#8  0x00007ffff096a4ca in ImplCallCommand (pChild=0x1a1ebe0, nEvt=ContextMenu, pData=0x0, bMouse=true, pPos=0x7fffffffc5a0) at /data/opt/libreoffice/master/vcl/source/window/winproc.cxx:226
#9  0x00007ffff096c45e in ImplHandleMouseEvent (pWindow=0x1b8f010, nSVEvent=MOUSEBUTTONDOWN, bMouseLeave=false, nX=386, nY=193, nMsgTime=1998538276, nCode=4, nMode=NONE) at /data/opt/libreoffice/master/vcl/source/window/winproc.cxx:821
#10 0x00007ffff0972c77 in ImplHandleSalMouseButtonDown (pWindow=0x1b8f010, pEvent=0x7fffffffcb10) at /data/opt/libreoffice/master/vcl/source/window/winproc.cxx:2085
#11 0x00007ffff097141d in ImplWindowFrameProc (_pWindow=0x1b8f010, nEvent=3, pEvent=0x7fffffffcb10) at /data/opt/libreoffice/master/vcl/source/window/winproc.cxx:2411
#12 0x00007fffe3053d50 in SalFrame::CallCallback (this=0x17feb80, nEvent=3, pEvent=0x7fffffffcb10) at /data/opt/libreoffice/master/vcl/inc/salframe.hxx:244
#13 0x00007fffe304fc5c in GtkSalFrame::signalButton (pEvent=0x1a00480, frame=0x17feb80) at /data/opt/libreoffice/master/vcl/unx/gtk/window/gtksalframe.cxx:3293
#14 0x00007fffe2a829f5 in ?? () from /usr/lib64/libgtk-x11-2.0.so.0

which I can only assume is un-caught.

Interestingly; the OReportSection that the Command is called on shows no sign of being disposed:

Breakpoint 2, rptui::OReportSection::Command (this=0x18e1e80, _rCEvt=...) at /data/opt/libreoffice/master/reportdesign/source/ui/report/ReportSection.cxx:477
477	    Window::Command(_rCEvt);
(gdb) p *this
$7 = (rptui::OReportSection) {<vcl::Window> = {<OutputDevice> = {_vptr.OutputDevice = 0x7fffa2a14c50 <vtable for rptui::OReportSection+16>, mnRefCnt = 22, mpGraphics = 0x218f5a0, mpPrevGraphics = {m_rInnerRef = empty rtl::Reference}, mpNextGraphics = {m_rInnerRef = rtl::Reference to 0x2109e80}, mpMetaFile = 0x0, mpFontEntry = 0x0, mpFontCache = 0x12d08a0, mpFontCollection = 0x12d3600, mpGetDevFontList = 0x0, mpGetDevSizeList = 0x0, mpOutDevStateStack = 0x18e2150, mpOutDevData = 0x18e21d0, mpUnoGraphicsList = 0x0, mpPDFWriter = 0x0, mpExtOutDevData = 0x0, mpAlphaVDev = {m_rInnerRef = empty rtl::Reference}, mnOutOffOrigX = 0, mnOutOffLogicX = 0, mnOutOffOrigY = 0, mnOutOffLogicY = 0, mnOutOffX = 125, mnOutOffY = 138, mnOutWidth = 816, mnOutHeight = 113, mnDPIX = 96, mnDPIY = 96, mnDPIScaleFactor = 1, mnTextOffX = 0, mnTextOffY = 0, mnEmphasisAscent = 0, mnEmphasisDescent = 0, mnDrawMode = Default, mnTextLayoutMode = TEXT_LAYOUT_DEFAULT, maMapRes = {mnMapOfsX = 0, mnMapOfsY = 0, mnMapScNumX = 1, mnMapScNumY = 1, mnMapScDenomX = 2540, mnMapScDenomY = 2540, mfOffsetX = 0, mfOffsetY = 0, mfScaleX = 0.0003937007874015748, mfScaleY = 0.0003937007874015748}, maThresRes = {mnThresLogToPixX = 48038396025285284, mnThresLogToPixY = 48038396025285284, mnThresPixToLogX = 1815624416703696, mnThresPixToLogY = 1815624416703696}, meOutDevType = OUTDEV_WINDOW, meOutDevViewType = OUTDEV_VIEWTYPE_DONTKNOW, maRegion = {mpB2DPolyPolygon = std::shared_ptr (empty) 0x0, mpPolyPolygon = std::shared_ptr (empty) 0x0, mpRegionBand = std::shared_ptr (empty) 0x0, mbIsNull = true}, maLineColor = rgb(0, 0, 0), maFillColor = rgb(255, 255, 255), maFont = {mpImplFont = 0x18e3bd0}, maTextColor = rgb(49, 55, 57), maTextLineColor = rgba(255, 255, 255, 255), maOverlineColor = rgba(255, 255, 255, 255), meTextAlign = ALIGN_TOP, meRasterOp = ROP_OVERPAINT, maBackground = {mpImplWallpaper = 0x18e3cd0}, mxSettings = std::unique_ptr<AllSettings> containing 0x18e08e0, maMapMode = {mpImplMapMode = 0x7ffff172b140 <MapMode::ImplMapMode::ImplGetStaticMapMode(MapUnit)::aStaticImplMapModeAry>}, maRefPoint = Point = {x = 0, y = 0}, mnAntialiasing = NONE, meTextLanguage = 0, mbMap = true, mbMapIsDefault = true, mbClipRegion = false, mbBackground = true, mbOutput = true, mbDevOutput = true, mbOutputClipped = false, mbLineColor = true, mbFillColor = true, mbInitLineColor = true, mbInitFillColor = true, mbInitFont = true, mbInitTextColor = true, mbInitClipRegion = true, mbClipRegionSet = true, mbKerning = false, mbNewFont = true, mbTextLines = false, mbTextBackground = false, mbTextSpecial = false, mbRefPoint = false, mbEnableRTL = false, mbDisposed = false}, <Resource> = {m_pResMgr = 0x0}, mpWindowImpl = 0x18e3780}, 

So - presumably some other badness ensures that the related

sal_Int32 SAL_CALL SvxDrawPage::getCount()
    throw( uno::RuntimeException, std::exception )
{
    SolarMutexGuard aGuard;

    if( (mpModel == 0) || (mpPage == 0) )
        throw lang::DisposedException();

exception gets thrown ...

Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=43cc6fa1fa704ff53e56e8fe34e673c6733c9b4e

Resolves: tdf#91672 Crash in base report - right click in page header section

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.

Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-5-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=2bd7e85de0fefe83d1891592dd0b1647a817307e&h=libreoffice-5-0

Resolves: tdf#91672 Crash in base report - right click in page header section

It will be available in 5.0.0.0.beta2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.