Bug 105376 - Crash in: SalFrame::SetCallback(vcl::Window *,bool (*)(vcl::Window *,SalEvent,void const *))
Summary: Crash in: SalFrame::SetCallback(vcl::Window *,bool (*)(vcl::Window *,SalEvent...
Status: RESOLVED DUPLICATE of bug 102688
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
(earliest affected) rc
Hardware: x86-64 (AMD64) Windows (All)
: medium normal
Assignee: Not Assigned
Depends on:
Blocks: GDI-Limit
  Show dependency treegraph
Reported: 2017-01-16 21:21 UTC by Stefan_Lange_KA@T-Online.de
Modified: 2017-02-15 14:46 UTC (History)
1 user (show)

See Also:
Crash report or crash signature: ["SalFrame::SetCallback(vcl::Window *,bool (*)(vcl::Window *,SalEvent,void const *))","vcl::Window::dispose()"]

Spreadsheet to reproduce the crash (1.11 MB, application/vnd.oasis.opendocument.spreadsheet)
2017-01-16 21:21 UTC, Stefan_Lange_KA@T-Online.de

Note You need to log in before you can comment on or make changes to this bug.
Description Stefan_Lange_KA@T-Online.de 2017-01-16 21:21:42 UTC
Created attachment 130483 [details]
Spreadsheet to reproduce the crash

This bug was filed from the crash reporting server and is br-6eee24f3-99b4-4886-8253-20daa290cfa3.

Other crash reports to this bug:

crash not after save, when comment is changed, but while save after the first comments were inserted:

The crashes do not occur allways exactly in the same maner, but all they are simlilar. 

I can reproduce the crashes as follows with the attached spreadsheet document "Test_Comment_Crash.ods". It is a big file - sorry! I have tried to reproduce the crashes with reduced smaller documents, but it has not succeeded.

- open the spreadsheet document "Test_Comment_Crash.ods"
- go to sheet "Altix I bis III"
- insert a comment to cell C6, contents e.g. "Kommentar zu lfd. Nr. 1311" (1311 is the content of cell B6 - maybe the contents of the comment doesn't influence the behavior)
- copy complete cell C6 and paste it to cell C7
- in cell C7: Show comment -> change the number 1311 in the comment to 2201 (= content of cell B7) -> Hide comment
- repeat copy + paste + show comment + change + hide with cells C7/C8 and C8/C9
- save the document, keep it open
- repeat copy + paste + show comment + change + hide with cells C9/C10 etc.
- at the 2nd, 3rd or 4th repeat LO crashes, when comment is shown and shall be changed

I have reproduced the crashes with

Version: (x64)
Build-ID: 3b800451b1d0c48045de03b5b3c7bbbac87f20d9
CPU-Threads: 4; BS-Version: Windows 6.19; UI-Render: Standard; Layout-Engine: neu; 
Gebietsschema: de-DE (de_DE); Calc: group

and also with

Build ID: fef38c79e46feaf72e31253d80a82f26b4c2bcc7
CPU Threads: 1; OS Version: Windows 6.19; UI Render: default; 
TinderBox: Win-x86@42, Branch:master, Time: 2017-01-15_23:20:08
Locale: de-DE (de_DE); Calc: group
Comment 1 Stefan_Lange_KA@T-Online.de 2017-01-16 22:17:04 UTC
Also reproduced with
Build-ID: e033311c1a4fcfe594bc773d58da6cc06d4dd624
CPU-Threads: 2; BS-Version: Windows 6.2; UI-Render: Standard; 
TinderBox: Win-x86@62-merge-TDF, Branch:MASTER, Time: 2017-01-15_22:39:48
Gebietsschema: de-DE (de_DE); Calc: group

related crash report:

Crash could not reproduced with the test document with
Version: (x64)
Build-ID: 3d5603e1122f0f102b62521720ab13a38a4e0eb0
CPU-Threads: 4; BS-Version: Windows 6.19; UI-Render: Standard; 
Gebietsschema: de-DE (de_DE); Calc: group
Comment 2 Timur 2017-01-17 12:32:50 UTC
Same crash in Bug 87204 and Bug 105118. 
I'll mark as a duplicate of Bug 87204 but if you disagree feel free to change. 
Please track Bug 87204 for a solution and test for this issue.

*** This bug has been marked as a duplicate of bug 87204 ***
Comment 3 V Stuart Foote 2017-01-28 18:08:19 UTC
ended up related to the vcl::Window::dispose() signature, and related leakage from multiple GDI virtual devices, as in bug 103927. Fully fixed for bug 102688 -- adjusting this as dupe of the 102688 issue.


tdf#103927: Share single standard VirtualDevice instance

tdf#102688: prevent leaking of VirtualDevice instances

tdf#102688: let's purge it here just in case...

*** This bug has been marked as a duplicate of bug 102688 ***