Bug Hunting Session
Bug 109282 - CRASH: When editing Visio OLE and leaving the edit mode
Summary: CRASH: When editing Visio OLE and leaving the edit mode
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: LibreOffice (show other bugs)
Version:
(earliest affected)
5.4.0.1 rc
Hardware: x86-64 (AMD64) Linux (All)
: medium critical
Assignee: Caolán McNamara
URL:
Whiteboard: target:6.0.0 target:5.4.4
Keywords:
Depends on:
Blocks:
 
Reported: 2017-07-23 07:30 UTC by Ahmad Harthi
Modified: 2017-10-19 12:29 UTC (History)
2 users (show)

See Also:
Crash report or crash signature:


Attachments
Example Visio Document (15.19 KB, application/zip)
2017-07-23 11:13 UTC, Ahmad Harthi
Details
Video Shows The Crash (5.98 MB, video/mp4)
2017-07-23 14:26 UTC, Ahmad Harthi
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Ahmad Harthi 2017-07-23 07:30:02 UTC
LibreOffice crashes every time when leaving the edit mode of a Visio document as an OLE object.

To reproduce:
1. Start a new LO document (any except Base)
2. Insert a Visio document from the menu or by drag-n-drop
3. Enter the Edit mode of the Visio document, and select a shape
4. While any shape is selected (will not crash if nothing is selected while leaving the edit mode) click outside the area of the Visio OLE

Result:
LO will crash.

The debugger output is as follows:
---------------------------------------------
Program received signal SIGSEGV, Segmentation fault.
0x00002aaab1207158 in accessibility::AccessibleShape::getAccessibleStateSet (this=0x6322b90)
    at /home/aalharthi/Documents/workspace/libreoffice/svx/source/accessibility/AccessibleShape.cxx:462
462	    if (mpParent && mpParent->IsDocumentSelAll())

-----------------------------------------------

OS: RHEL 7.3
LO Version: 5.4.0.2
Comment 1 Xisco Faulí 2017-07-23 09:39:41 UTC Comment hidden (obsolete)
Comment 2 Ahmad Harthi 2017-07-23 11:13:37 UTC
Created attachment 134797 [details]
Example Visio Document

Open draw and insert the attached Visio document in it then follow the procedure in Comment 1.
Comment 3 Xisco Faulí 2017-07-23 11:35:12 UTC
I can't reproduce it in

Version: 6.0.0.0.alpha0+
Build ID: a9588baca8137f51e2ca72e40b1f448b0e1885d1
CPU threads: 1; OS: Windows 6.1; UI render: default; 
TinderBox: Win-x86@39, Branch:master, Time: 2017-07-21_03:03:23
Locale: es-ES (es_ES); Calc: group

nor in

Version: 6.0.0.0.alpha0+
Build ID: bde72cdae1e7e001d5089c5284672c976b8e43df
CPU Threads: 4; OS Version: Linux 4.8; UI Render: default; VCL: gtk2; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group
Comment 4 Ahmad Harthi 2017-07-23 14:26:07 UTC
Created attachment 134799 [details]
Video Shows The Crash

----------------------------------
Version: 5.4.0.3.0+
Build ID: 4bf7f18669983517cdd5f31d786f5b3d2b3f34c4
CPU threads: 4; OS: Linux 3.10; UI render: default; VCL: gtk3; 
Locale: en-US (en_US.utf8); Calc: group
----------------------------------

Maybe because you use gtk2 it doesn't crash, please try it with any Linux using gtk3.

I've attached a video.
Comment 5 Xisco Faulí 2017-07-23 16:47:23 UTC
Hi,
Thanks for the video. I can't reproduce it in gtk3 neither

Version: 6.0.0.0.alpha0+
Build ID: bde72cdae1e7e001d5089c5284672c976b8e43df
CPU Threads: 4; OS Version: Linux 4.8; UI Render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group

To be certain the reported issue is not related to corruption in the user profile, could you please reset your Libreoffice profile ( https://wiki.documentfoundation.org/UserProfile ) and re-test?
Comment 6 Ahmad Harthi 2017-07-24 09:09:08 UTC
(In reply to Xisco Faulí from comment #5)
> Hi,
> Thanks for the video. I can't reproduce it in gtk3 neither
> 
> Version: 6.0.0.0.alpha0+
> Build ID: bde72cdae1e7e001d5089c5284672c976b8e43df
> CPU Threads: 4; OS Version: Linux 4.8; UI Render: default; VCL: gtk3; 
> Locale: ca-ES (ca_ES.UTF-8); Calc: group
> 
> To be certain the reported issue is not related to corruption in the user
> profile, could you please reset your Libreoffice profile (
> https://wiki.documentfoundation.org/UserProfile ) and re-test?

I tried it now with profile reset, still same issue. I've tried it with the following version of LO with no issues:
Version: 5.0.6.2
Build ID: 5.0.6.2-5.el7_3.1
Locale: en-US (en_US.utf8)

Build Settings:
--enable-debug
--with-parallelism

System details:
Intel i7 (Skylake)
8 GB Memory
RHEL 7.3
gcc (GCC) 4.8.5 20150623 (Red Hat 4.8.5-11)
GNOME Shell 3.14.4
GTK 3.14.13
Comment 7 Xisco Faulí 2017-07-24 10:20:48 UTC
Maybe is only in debug mode?

Could you please try to reproduce it with a master build from http://dev-builds.libreoffice.org/daily/master/ ?
You can install it alongside the standard version.
Comment 8 Ahmad Harthi 2017-07-24 13:39:57 UTC
(In reply to Xisco Faulí from comment #7)
> Maybe is only in debug mode?

    I tried it in normal mode without debug flags and it still crashes!


> Could you please try to reproduce it with a master build from
> http://dev-builds.libreoffice.org/daily/master/ ?
> You can install it alongside the standard version.

    Works well! no crashes using:
    ----------------------------------------
    Version: 6.0.0.0.alpha0+
    Build ID: e0bafa78e3ad0df397d78cd65ad19bd5b07dc5f2
    CPU threads: 4; OS: Linux 3.10; UI render: default; VCL: gtk2; 
    TinderBox: Linux-rpm_deb-x86_64@70-TDF, Branch:master, Time: 2017-07-20_22:42:49
    Locale: en-US (en_US.utf8); Calc: group
    ----------------------------------------

    I don't think gtk2 versus 3 has anything to do with this, it might be something else.
Comment 9 Buovjaga 2017-08-11 13:04:10 UTC
Yep, I could not repro, tried also with gtk3.

As you build with --enable-debug you could try getting a backtrace of the crash: https://wiki.documentfoundation.org/QA/BugReport/Debug_Information
Also, it is enough to only build with --enable-symbols to get a backtrace.
Debug builds behave differently regarding performance.

Arch Linux 64-bit, KDE Plasma 5
Version: 5.4.0.3
Build ID: 5.4.0-1
CPU threads: 8; OS: Linux 4.12; UI render: default; VCL: kde4; 
Locale: fi-FI (fi_FI.UTF-8); Calc: group
Comment 10 Xisco Faulí 2017-08-11 14:19:46 UTC
Do you use Wayland?
Comment 11 Ahmad Harthi 2017-08-13 07:46:20 UTC
(In reply to Xisco Faulí from comment #10)
> Do you use Wayland?

No, but once I've upgraded to RHEL 7.4 this didn't happen again! I don't think it was a LO bug any more.
Comment 12 Caolán McNamara 2017-10-18 10:58:58 UTC
I can reproduce what I believe is this problem with a chart shape in calc on tab 3. With accessibility enabled, select it and switch to tab 1 and it crashes accessing the deleted mpParent after the shape has been disposed
Comment 13 Caolán McNamara 2017-10-18 10:59:12 UTC
https://gerrit.libreoffice.org/#/c/43487/
Comment 14 Commit Notification 2017-10-18 13:01:51 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=aa3c054fe5d7b082532f1108f30a54bc4cdeb64c

Resolves: tdf#109282: a11y crash in use after dispose

It will be available in 6.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 15 Caolán McNamara 2017-10-18 13:12:51 UTC
backports to 5-4 in gerrit
Comment 16 Commit Notification 2017-10-19 12:29:32 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-5-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=a2cd7c7a1015abe17b46cd40ae4bf5b3296d62e7&h=libreoffice-5-4

Resolves: tdf#109282: a11y crash in use after dispose

It will be available in 5.4.4.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.