Bug 107474 - CRASH: Libreoffice crashes while inserting a textbox in the header
Summary: CRASH: Libreoffice crashes while inserting a textbox in the header
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
4.2 all versions
Hardware: All All
: highest critical
Assignee: Michael Stahl
QA Contact:
URL:
Whiteboard: target:5.4.0 target:5.3.4 target:5.3.3
Keywords: bibisected, haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2017-04-27 08:50 UTC by Xisco Faulí
Modified: 2017-08-03 10:26 UTC (History)
2 users (show)

See Also:
Crash report or crash signature: ["osl_acquireMutex"]


Attachments
backtrace (24.72 KB, text/plain)
2017-04-27 09:55 UTC, Xisco Faulí
Details
screencast (625.08 KB, video/ogg)
2017-04-27 10:18 UTC, Xisco Faulí
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Xisco Faulí 2017-04-27 08:50:54 UTC
Steps to reproduce:
1. Open a new Writer document
2. Insert a header
3. Insert a textbox in the header
4. Delete the header
5. Insert another textbox where the previous textbox was inserted

CRASH!

Reproduced in 

Version: 5.4.0.0.alpha0+
Build ID: 7c11fe076005ed4e28f04f14990b7011a03a4517
CPU threads: 4; OS: Linux 4.8; UI render: default; VCL: gtk2; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group
Comment 1 Xisco Faulí 2017-04-27 09:50:31 UTC
I couldn't bisect it so I bibisected with lo-linux-dbgutil-daily-till42

Regression introduced in range https://cgit.freedesktop.org/libreoffice/core/log/?qt=range&q=61fffd72ac9f09b95faf266f29e643c7bff802bd..60790b3f0ccc1779bcff2ddcc278a9027aedabee
Comment 2 Xisco Faulí 2017-04-27 09:55:00 UTC
Created attachment 132886 [details]
backtrace
Comment 3 Jacques Guilleron 2017-04-27 10:05:36 UTC
Hi Xisco,

I didn't reproduced with
LO 5.4.0.0.alpha0+ Build ID: 100e00fd3273536ebff130cfddc5da2b1fe609b1
CPU threads: 2; OS: Windows 6.1; UI render: default; 
TinderBox: Win-x86@42, Branch:master, Time: 2017-04-20_05:12:24
Locale: en-US (fr_FR); Calc: CL
nor with
LO 5.3.2.2 Build ID: 6cd4f1ef626f15116896b1d8e1398b56da0d0ee1
Threads CPU : 2; Version de l'OS :Windows 6.1; UI Render : par défaut; Moteur de mise en page : nouveau; 
Locale : fr-FR (fr_FR); Calc: CL

Linux only?
Comment 4 Xisco Faulí 2017-04-27 10:08:25 UTC
(In reply to Jacques Guilleron from comment #3)
> Hi Xisco,
> 
> I didn't reproduced with
> LO 5.4.0.0.alpha0+ Build ID: 100e00fd3273536ebff130cfddc5da2b1fe609b1
> CPU threads: 2; OS: Windows 6.1; UI render: default; 
> TinderBox: Win-x86@42, Branch:master, Time: 2017-04-20_05:12:24
> Locale: en-US (fr_FR); Calc: CL
> nor with
> LO 5.3.2.2 Build ID: 6cd4f1ef626f15116896b1d8e1398b56da0d0ee1
> Threads CPU : 2; Version de l'OS :Windows 6.1; UI Render : par défaut;
> Moteur de mise en page : nouveau; 
> Locale : fr-FR (fr_FR); Calc: CL
> 
> Linux only?

No, I can also reproduce it in

Versión: 5.3.2.2
Id. de compilación: 6cd4f1ef626f15116896b1d8e1398b56da0d0ee1
Subproc. CPU: 1; SO: Windows 6.1; Repr. de IU: predet.; Motor de trazado: HarfBuzz; 
Configuración regional: es-ES (es_ES); Calc: group
Comment 5 Xisco Faulí 2017-04-27 10:18:16 UTC
Created attachment 132887 [details]
screencast
Comment 6 Telesto 2017-04-27 12:29:27 UTC
Confirming (a) crash:
Version: 5.4.0.0.alpha0+
Build ID: a917902c48f21d04039da86048c5c36555137d7e
CPU threads: 4; OS: Windows 6.2; UI render: default; 
TinderBox: Win-x86@62-TDF, Branch:MASTER, Time: 2017-04-24_23:35:22
Locale: nl-NL (nl_NL); Calc: CL

Not quite sure if it's the same bug. I actually don't need a textbox to get LibO to crash:
1. Open a new Writer document
2. Insert a header
3. Delete the header
4. Try to insert a header again -> crash

crashreport.libreoffice.org/stats/crash_details/1e531107-2bc0-422f-bb4a-1e9ef5b41b4d

No repro with:
Versie: 5.3.0.3 
Build ID: 7074905676c47b82bbcfbea1aeefc84afe1c50e1
CPU Threads: 4; Versie besturingssysteem:Windows 6.2; UI Render: standaard; Layout-Engine: nieuw; 
Locale: nl-NL (nl_NL); Calc: CL
Comment 7 Xisco Faulí 2017-04-27 12:32:28 UTC
No, it's not, but it was fixed yersterday by Michael Stahl: 8cd1ae22eb2d464516717d767bd3e5f6c2f4bd34
Comment 8 Telesto 2017-04-27 13:45:25 UTC
Tested it again. I can reproduce the crash when follow the steps in the screencast
Version: 5.4.0.0.alpha0+
Build ID: 597a2f5d5bd37443262b0775b8439bc3502aef1b
CPU threads: 4; OS: Windows 6.2; UI render: default; 
TinderBox: Win-x86@62-TDF, Branch:MASTER, Time: 2017-04-26_22:29:37
Locale: nl-NL (nl_NL); Calc: CL

-> crashreport.libreoffice.org/stats/crash_details/a10bdb0b-78e9-44f8-8644-7b654151aee0
Comment 9 Xisco Faulí 2017-04-27 17:12:54 UTC
Another way to generate the crash:

1. Create a new header
2. Insert a Rectangle Drawing above the header
3. add some text to the Rectangle by double-clicking on it
4. Delete the header
5. Insert a new header
6. Insert a Rectangle Drawing above the header
7. Double-click on the rectangle

CRASH!
Comment 10 Commit Notification 2017-04-28 12:01:57 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=7f207fca577ef820be2aec0a442df7e8ab6e14a6

tdf#107474 sw: fix crash when deleting header with active SdrObject

It will be available in 5.4.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 11 Michael Stahl 2017-04-28 20:21:39 UTC
fixed on master
Comment 12 Commit Notification 2017-05-02 13:00:11 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-5-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=e07c2c3861f47946ed72fc9b67aafeaa8598468d&h=libreoffice-5-3

tdf#107474 sw: fix crash when deleting header with active SdrObject

It will be available in 5.3.4.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 13 Commit Notification 2017-05-02 16:58:46 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-5-3-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=6d5b1ba501771cfa693b46d82ec88333302f02bb&h=libreoffice-5-3-3

tdf#107474 sw: fix crash when deleting header with active SdrObject

It will be available in 5.3.3.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 14 Xisco Faulí 2017-08-03 10:26:52 UTC
Verified in

Version: 6.0.0.0.alpha0+
Build ID: 3f16306964d5bb81dda3c681bcabbacadf424e7b
CPU threads: 4; OS: Linux 4.8; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group