Steps to reproduce: 1. Open attachment 132442 [details] from bug 107062 2. Double-click on the chart 3. Once the chart is selected, click on the inner graph 4. Drag and drop the graph upon a button -> dropdown menu is displayed. 5. Click again on the button LibreOffice crashes Reproduced in Version: 5.4.0.0.alpha0+ Build ID: 7635e0c1c7f821a1081f8e3868f641ae74a172d6 CPU threads: 4; OS: Linux 4.8; UI render: default; VCL: gtk3; Locale: ca-ES (ca_ES.UTF-8); Calc: group
Same behaviour observed when the legend is dragged and dropped upon a button as well
Can't reproduce in: Version: 5.4.0.0.alpha0+ (x64) Build ID: 66c97812ef6d7e31a999a7a976c90a94257e4dee CPU threads: 4; OS: Windows 6.1; UI render: default; TinderBox: Win-x86_64@42, Branch:master, Time: 2017-04-12_02:54:36 Locale: fr-FR (fr_FR); Calc: group
reproducible with Version: 5.4.0.0.alpha0+ Build ID: 6f12914ddfb4d69c0267b206be654c875da17426 CPU threads: 4; OS: Linux 4.4; UI render: default; VCL: gtk2; TinderBox: Linux-rpm_deb-x86_64@70-TDF, Branch:master, Time: 2017-04-14_01:07:28 Locale: en-GB (cs_CZ.UTF-8); Calc: group Crash report: crashreport.libreoffice.org/stats/crash_details/a6f36582-3dba-4784-8e98-67bb0311df13
Created attachment 132608 [details] bt with debug symbols On pc Debian x86-64 with master sources updated today, I could reproduce the crash. I only reproduce this with gtk3 and gtk renderings (not with kde4 or gen ones)
Caolán: thought you might be interested in this one since it concerns vcl/gtk(3) part.
For gtk2: #0 0x00007fffca11f93a in ScCheckListMenuWindow::CreateAccessible (this=0x55555bfaaea0) at /home/julien/lo/libreoffice/sc/source/ui/cctrl/checklistmenu.cxx:1409 #1 0x00007fffec5a5d1e in vcl::Window::GetAccessible (this=0x55555bfaaea0, bCreate=true) at /home/julien/lo/libreoffice/vcl/source/window/accessibility.cxx:133 #2 0x00007fffd84dff65 in handle_get_focus (pEvent=0x7fffffff1010) at /home/julien/lo/libreoffice/vcl/unx/gtk/a11y/atkutil.cxx:535 #3 0x00007fffd84e04d5 in WindowEventHandler (rEvent=...) at /home/julien/lo/libreoffice/vcl/unx/gtk/a11y/atkutil.cxx:620 #4 0x00007fffecbf17f3 in Link<VclSimpleEvent&, void>::Call (this=0x55555b4df7c0, data=...) at /home/julien/lo/libreoffice/include/tools/link.hxx:84
I wonder if a variable bInDispose should be created for ScCheckListMenuWindow. It could be initialized to false and when calling dispose function, put at true. Then in ScCheckListMenuWindow::CreateAccessible(), we could use: if (!mxAccessible.is() && !bInDispose) instead of just: if (!mxAccessible.is()) (see http://opengrok.libreoffice.org/xref/core/sc/source/ui/cctrl/checklistmenu.cxx#1399) Any thoughts?
probably checking for if (!mxAccessible.is() && maEdSearch) instead of just if (!mxAccessible.is()) would be sufficient to detect the "is-in-dispose" case if you want to see if that works.
Julien Nabet committed a patch related to this issue. It has been pushed to "master": http://cgit.freedesktop.org/libreoffice/core/commit/?id=64cce59975d540f384880034ed3297a120d3d408 tdf#107102: fix crash in ScCheckListMenuWindow::CreateAccessible It will be available in 5.4.0. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Verified in Version: 6.0.0.0.alpha0+ Build ID: 3f16306964d5bb81dda3c681bcabbacadf424e7b CPU threads: 4; OS: Linux 4.8; UI render: default; VCL: gtk3; Locale: ca-ES (ca_ES.UTF-8); Calc: group