Bug 101859 - All SalX11 based backends crash on popup menu disposal (gen, TDE, KDE4)
Summary: All SalX11 based backends crash on popup menu disposal (gen, TDE, KDE4)
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: graphics stack (show other bugs)
Version:
(earliest affected)
5.3.0.0.alpha0+
Hardware: All Linux (All)
: medium major
Assignee: Caolán McNamara
URL:
Whiteboard: target:5.3.0
Keywords: haveBacktrace
Depends on:
Blocks:
 
Reported: 2016-09-02 12:13 UTC by Jan-Marek Glogowski
Modified: 2017-02-24 10:51 UTC (History)
1 user (show)

See Also:
Crash report or crash signature:

Attachments
Sections navigator crash (7.83 KB, application/vnd.oasis.opendocument.text)
2016-09-02 12:13 UTC, Jan-Marek Glogowski 		Details
Backtrace from a debug build (8.42 KB, text/plain)
2016-09-02 12:14 UTC, Jan-Marek Glogowski 		Details
bzip'd "soffice --strace" log (1.21 MB, application/x-bzip)
2016-09-02 15:23 UTC, Thomas Hackert 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jan-Marek Glogowski 2016-09-02 12:13:57 UTC 
Created attachment 127121 [details]
Sections navigator crash

Reproduce:

1. Open odt document (or create one with a section)
2. Open navigator (F5)
3. Right click on the "Section1" in "Sections"

From a debug build:

include/vcl/vclreferencebase.hxx:38: 
void VclReferenceBase::acquire() const: Assertion `mnRefCnt>0' failed.

See attached backtrace.
Guess commit aa0d0536a444fb26d9e570bd6bf6c1bdc3596cf3 is related.
Comment 1 Jan-Marek Glogowski 2016-09-02 12:14:51 UTC 
Created attachment 127122 [details]
Backtrace from a debug build
Comment 2 Thomas Hackert 2016-09-02 15:15:57 UTC 
Hello Jan-Marek, *,
thank you for reporting this bug :) I can confirm it with
OS: Debian Testing AMD64 with XFCE 4.12
LO: Version: 5.3.0.0.alpha0+
Build-ID: a8a7b7114d96b2013b00e9bc0ced81aad5495457
CPU-Threads: 4; BS-Version: Linux 4.5; UI-Render: Standard; 
TinderBox: Linux-rpm_deb-x86_64@70-TDF, Branch:master, Time: 2016-09-02_05:11:44
Gebietsschema: de-DE (de_DE.UTF-8); Calc: group
(parallel installed, following the instructions from https://wiki.documentfoundation.org/Installing_in_parallel/Linux),

so setting the status to "New".
HTH
Thomas.
Comment 3 Thomas Hackert 2016-09-02 15:23:56 UTC 
Created attachment 127125 [details]
bzip'd "soffice --strace" log
Comment 4 Julien Nabet 2016-09-09 20:23:19 UTC 
On pc Debian x86-64 with master sources updated today + dbgutil, I could reproduce this only with SAL_USE_VCLPLUGIN=kde4 or gen, not with gtk3 or gtk.
Comment 5 Julien Nabet 2016-09-09 20:42:23 UTC 
(In reply to Julien Nabet from comment #4)
> On pc Debian x86-64 with master sources updated today + dbgutil, I could
> reproduce this only with SAL_USE_VCLPLUGIN=kde4 or gen, not with gtk3 or gtk.

Sorry, should have read the whole title...
Comment 6 Commit Notification 2016-09-14 09:29:20 UTC 
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=fc6744603ab8bb5a00c4f97435b5e509bdeaeb94

Resolves: tdf#101859 dispose unused popupmenu before dtor

It will be available in 5.3.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 7 Caolán McNamara 2016-09-14 09:30:41 UTC 
That resolves this case anyway