Bug 114812 - CRASH: Crash when scrolling through specific document
Summary: CRASH: Crash when scrolling through specific document
Status: RESOLVED WORKSFORME
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
5.4.3.2 release
Hardware: x86-64 (AMD64) Windows (All)
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-01-02 20:41 UTC by Matthias Basler
Modified: 2018-02-01 18:21 UTC (History)
4 users (show)

See Also:
Crash report or crash signature: ["BitmapReadAccess::SetPixelForN24BitTcBgr(unsigned char *,long,BitmapColor const &,ColorMask const &)"]


Attachments
Document (exported by Gramps) producing crash on scrolling down. (3.80 MB, application/vnd.oasis.opendocument.text)
2018-01-02 20:50 UTC, Matthias Basler
Details
Re-created document, produces different crash (3.80 MB, application/vnd.oasis.opendocument.text)
2018-01-02 22:31 UTC, Matthias Basler
Details
Stripped-down version with just 1 image (crashes LO on loading already) (1.30 MB, application/vnd.oasis.opendocument.text)
2018-01-02 22:35 UTC, Matthias Basler
Details
Screenshot of APPCRASH (82.36 KB, image/jpeg)
2018-01-03 09:09 UTC, Matthias Basler
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Matthias Basler 2018-01-02 20:41:59 UTC
Description:
The attached test document can be opened in LO 6.0.0 RC1, but if I scroll down to the second page, Libreoffice crashes after few seconds of waiting.

Steps to Reproduce:
1. Open attached file. This is OK, you can type and even scroll down a bit.
2. Scroll down below the first row of images in the gallery.


Actual Results:  
LO crashes with the Windows default application crash dialog (APPCRASH).

Expected Results:
Show the next page, of course. ;-)


Reproducible: Always


User Profile Reset: No


OpenGL enabled: Yes

Additional Info:
When starting the next time, I can choose to create a crash report, but this seems to fail as LO will not tell me an issue number afterwards.

---
Version: 6.0.0.1 (x64)
Build-ID: d2bec56d7865f05a1003dc88449f2b0fdd85309a
CPU-Threads: 4; BS: Windows 6.1; UI-Render: Standard; 
Gebietsschema: de-DE (de_DE); Calc: group
---
This installation was updated from 5.2.1.2 (32 bit) today. With version 5.2 I could open the very same document without crash.



User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Comment 1 Matthias Basler 2018-01-02 20:46:52 UTC
This might be related to Bug 114536 (similar symptoms), but I cannot tell without a crash report.
Comment 2 Matthias Basler 2018-01-02 20:50:02 UTC
Created attachment 138823 [details]
Document (exported by Gramps) producing crash on scrolling down.
Comment 3 Matthias Basler 2018-01-02 20:56:42 UTC
Note 1:
The attached test document was originally created to check another bug (with multiple image references in one document). That bug seems to be fixed in 6.0.0.1 (as tested on another document with multiple image), but maybe this problem was introduced by the fix?

Note 2:
The attached document claims to have 2 pages, but acutally it should only have one. (A PDF generated earlier by LO 5.2 from it shows this.)
Comment 4 Matthias Basler 2018-01-02 21:09:40 UTC
More info:
- The windows crash dialog show the crash is in "mergedlo.dll".
- LO 5.4.3.2 is already affected.
- With this version sending a crash report works. I get following link:
crashreport.libreoffice.org/stats/crash_details/61988ffc-17df-4290-890b-06a6d742cfa5
-> Signature in vcl/source/gdi/bmpacc2.cxx:141:
BitmapReadAccess::SetPixelForN24BitTcBgr(unsigned char *,long,BitmapColor const &,ColorMask const &)
Comment 5 Xisco Faulí 2018-01-02 21:59:12 UTC
I can't reproduce it in

Version: 6.1.0.0.alpha0+
Build ID: 864ab0502a4d3506413451e8c545144c6c15d777
CPU threads: 1; OS: Windows 6.1; UI render: default; 
TinderBox: Win-x86@42, Branch:master, Time: 2017-12-28_00:54:35
Locale: es-ES (es_ES); Calc: group threaded

nor in

Versión: 5.4.3.2
Id. de compilación: 92a7159f7e4af62137622921e809f8546db437e5
Subprocs. CPU: 1; SO: Windows 6.1; Repres. IU: predet.; 
Configuración regional: es-ES (es_ES); Calc: group

is it reproducible if OpenGL is disabled?
Comment 6 Telesto 2018-01-02 22:23:09 UTC
No crash with:
Version: 6.1.0.0.alpha0+
Build ID: a9b202a6b7000e7af34f2a639ca207122a3968bf
CPU threads: 4; OS: Windows 6.3; UI render: GL; 
TinderBox: Win-x86@42, Branch:master, Time: 2017-12-26_23:10:23
Locale: nl-NL (nl_NL); Calc: CL

E12599 - Testbild on the second page shows up black with OpenGL and transparent without OpenGL
Comment 7 Matthias Basler 2018-01-02 22:26:54 UTC
@Xisco Faulí:
This is strange. I re-downloaded my file from here, tested again -> crash.

Same with OpenGL disabled in the options.

---
I did further tests to check for the cause of the issue.
The document in question was generated from Gramps (OS genealogy software). I removed all (but one) images from the test person, then re-added them one by one. There were no issues adding an image multiple times, nor with the initial crop, nor with the page break.

Then I remembered that the original images showed different crops of the image. I tried to re-create different image crops and finally got a version which did not crash LO the way the first report did but instead produced a "Bad allocation" error window, after which LO would quit as well, but without a crash report offer at re-start.

Even more strange, just now the very same* document causes a classical APPCRASH, this time in ucrtbase.DLL. I'll attach this version too. No crash report offered.

Long story short: I am pretty sure the cause is related to the problem mentioned by me in 114808, which is a wrong crop box for images after ODF export from Gramps, due to wrong assumptions about image DPI. Likely LO chokes on a strange image distortion.
Comment 8 Matthias Basler 2018-01-02 22:31:56 UTC
Created attachment 138827 [details]
Re-created document, produces different crash
Comment 9 Matthias Basler 2018-01-02 22:35:22 UTC
Created attachment 138828 [details]
Stripped-down version with just 1 image (crashes LO on loading already)
Comment 10 Matthias Basler 2018-01-02 22:37:21 UTC
Signature of version for my last tests:
Version: 5.4.3.2 (x64)
Build-ID: 92a7159f7e4af62137622921e809f8546db437e5
CPU-Threads: 4; Betriebssystem:Windows 6.1; UI-Render: Standard; 
Gebietsschema: de-DE (de_DE); Calc: group
Comment 11 Xisco Faulí 2018-01-02 22:40:35 UTC
No crash here with the new documents...

Version: 6.1.0.0.alpha0+
Build ID: 2bf1cc7372088ec31ac5f0fb60de57feda59d3b7
CPU threads: 4; OS: Linux 4.10; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group threaded

To be certain the reported issue is not
related to corruption in the user profile, could you please reset your
Libreoffice profile ( https://wiki.documentfoundation.org/UserProfile ) and
re-test?
Comment 12 Matthias Basler 2018-01-03 09:09:43 UTC
Created attachment 138841 [details]
Screenshot of APPCRASH

Re-tested with first document in Safe mode with User Profile reset. -> Crash when reaching the second page, as usual. Screenshot attached.
No idea what's different for me.
Comment 13 Julien Nabet 2018-01-07 16:22:53 UTC
On pc Debian x86-64 with master sources updated some days ago, I don't reproduce the crash but:
with gtk3 rendering, it's quite slow to scroll the second doc attached.
with gen rendering, my laptop froze when just trying to open the doc.
Comment 14 Buovjaga 2018-01-30 17:26:50 UTC
(In reply to Matthias Basler from comment #1)
> This might be related to Bug 114536 (similar symptoms), but I cannot tell
> without a crash report.

That one is now fixed and the fix is also in 6.0.0. Would you like to re-test your own document against 6.0.0 final (announcement tomorrow, RC release available already)?
Comment 15 Xisco Faulí 2018-01-30 18:27:27 UTC
(In reply to Buovjaga from comment #14)
> (In reply to Matthias Basler from comment #1)
> > This might be related to Bug 114536 (similar symptoms), but I cannot tell
> > without a crash report.
> 
> That one is now fixed and the fix is also in 6.0.0. Would you like to
> re-test your own document against 6.0.0 final (announcement tomorrow, RC
> release available already)?

Putting to NEEDINFO for the time being...
Comment 16 Matthias Basler 2018-02-01 18:21:34 UTC
Cannot reproduce the crashes on LO 6.0.0.3 (x64, final). However I should note I am doing this test on a different PC now.

I hope WORKSFORME is the correct status for this situation.