Bug 108976 - Crash in: OutputDevice::GetOutputSizePixel()
Summary: Crash in: OutputDevice::GetOutputSizePixel()
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
4.2.8.2 release
Hardware: All All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: Crash
  Show dependency treegraph
 
Reported: 2017-07-05 17:59 UTC by Telesto
Modified: 2024-08-13 08:47 UTC (History)
4 users (show)

See Also:
Crash report or crash signature: ["OutputDevice::GetOutputSizePixel()"]


Attachments
Example file (147.46 KB, application/zip)
2017-07-05 17:59 UTC, Telesto
Details
Backtrace (7.56 KB, text/plain)
2021-12-26 13:27 UTC, Dhiraj Holden
Details
bt with debug symbols (23.05 KB, text/plain)
2023-09-04 09:20 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Telesto 2017-07-05 17:59:57 UTC
Created attachment 134501 [details]
Example file

This bug was filed from the crash reporting server and is br-81e4820d-8e70-44d5-9677-760191d76ff0.
=========================================
1. Extract the attached file
2. Open the demo file
3. Stress LibreOffice by entering and exiting the Ole-object
3a. Double click the ole object
3b. Deselect the ole object
3c. Enter the object again (double click)
3d. Repeat step 3a-3c

It will crash at some point
Comment 1 raal 2017-07-09 21:00:00 UTC
I can confirm with Version: 6.0.0.0.alpha0+ (x64)
Build ID: 7b4f4f15971047664fa278fff96b959d53b272b3
CPU threads: 1; OS: Windows 6.1; UI render: default; 
TinderBox: Win-x86_64@42, Branch:master, Time: 2017-07-08_01:39:24
and  4.2.8
Comment 2 Xisco Faulí 2018-06-18 16:08:09 UTC
I can't reproduce it in

Version: 6.2.0.0.alpha0+
Build ID: d60d695fcc5064e1f16842387fdce23456a64694
CPU threads: 4; OS: Linux 4.13; UI render: default; VCL: x11; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group threaded

nor in

Versión: 6.0.4.2
Id. de compilación: 9b0d9b32d5dcda91d2f1a96dc04c645c450872bf
Subprocs. CPU: 1; SO: Windows 6.1; Repres. IU: predet.; 
Configuración regional: es-ES (es_ES); Calc: group

@Telesto, @raal, How many times do you have to repeat steps 3a-3c?
Comment 3 Telesto 2018-06-18 16:21:58 UTC
Repro with
Version: 6.2.0.0.alpha0+
Build ID: 51aa57cd8ed46d28262e0d315328231f0fa814f4
CPU threads: 4; OS: Windows 6.3; UI render: default; 
TinderBox: Win-x86@42, Branch:master, Time: 2018-06-12_05:54:56
Locale: nl-NL (nl_NL); Calc: CL

1. Extract the attached file
2. Open the demo file
3. Double Click the blue OLE object
4. Click outside the OLE object (while it's still opening)
5. Macro dialog appears (press OK)
6. Double click the OLE object again -> crash
Comment 4 raal 2018-06-18 16:23:04 UTC
Still repro :

3a. Double click the ole object
3b. Deselect the ole object
3c. Enter the object again (double click)
  confirm macro warning
  Deselect the ole object
  Double click the ole object
   Crash

Version: 6.2.0.0.alpha0+ (x64)
Build ID: c3e552ac25be001a623469c549ee8d0719b98133
CPU threads: 1; OS: Windows 6.1; UI render: default; 
TinderBox: Win-x86_64@42, Branch:master, Time: 2018-06-14_00:15:12
Comment 5 QA Administrators 2019-06-19 02:47:22 UTC Comment hidden (obsolete)
Comment 6 Xisco Faulí 2019-06-20 10:20:34 UTC
Still reproducible in

Version: 6.4.0.0.alpha0+
Build ID: af37bb23f63b209af1193e20177c3aacbd777543
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US
Calc: threaded
Comment 7 Xisco Faulí 2019-06-20 10:41:56 UTC
Just for the record, I reproduce it one time out of 10, maybe be a race condition
Comment 8 Dhiraj Holden 2021-12-26 13:27:36 UTC
Created attachment 177141 [details]
Backtrace
Comment 9 Julien Nabet 2023-09-04 09:20:48 UTC
Created attachment 189332 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today, I got an assertion.
Comment 10 Commit Notification 2023-09-04 12:21:51 UTC
Julien Nabet committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/4a501a7270a0dd476ff71f72fae2c9fb9b40520a

Related tdf#108976: Crash in: OutputDevice::GetOutputSizePixel()

It will be available in 24.2.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 11 Julien Nabet 2023-09-04 12:24:50 UTC
The patch I submitted is just related and concerned an assertion not a crash.

Could someone give a new try with a recent LO version? (eg: 7.5.5)
Comment 12 Matt K 2024-02-14 22:28:22 UTC
No repro with:

Version: 7.6.5.0.0+ (X86_64) / LibreOffice Community
Build ID: 13c748e7998b6df02e23815f337e9ab4d04172f3
CPU threads: 16; OS: Windows 10.0 Build 22631; UI render: Skia/Vulkan; VCL: win
Locale: en-US (en_US); UI: en-US
Calc: CL threaded

I did not even get a macro pop-up warning.
Comment 13 QA Administrators 2024-08-13 03:13:46 UTC Comment hidden (obsolete)
Comment 14 Telesto 2024-08-13 03:35:47 UTC
No crash with macOS
Version: 25.2.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 9c1a48f844eaefc505a5914338b6f444011bf315
CPU threads: 8; OS: macOS 14.5; UI render: Skia/Raster; VCL: osx
Locale: nl-NL (nl_NL.UTF-8); UI: en-US
Calc: threaded
Comment 15 Julien Nabet 2024-08-13 08:47:50 UTC
Thank you Telesto for your feedback, let's put this one to FIXED then.