Bug 115023 - Libreoffice crash on exit when sidebar is enabled and attached (steps in comment 4)
Summary: Libreoffice crash on exit when sidebar is enabled and attached (steps in com...
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: LibreOffice (show other bugs)
Version:
(earliest affected)
5.4.4.2 release
Hardware: All All
: highest critical
Assignee: Maxim Monastirsky
URL:
Whiteboard: target:6.1.0 target:6.0.1 target:5.4....
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2018-01-15 12:45 UTC by Brandon Watkins
Modified: 2018-01-24 15:41 UTC (History)
2 users (show)

See Also:
Crash report or crash signature: ["Control::ImplClearLayoutData()"]


Attachments
gdb backtrace (36.92 KB, text/plain)
2018-01-15 14:52 UTC, Xisco Faulí
Details
how to reproduce the issue (4.26 MB, video/ogg)
2018-01-19 12:08 UTC, Xisco Faulí
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Brandon Watkins 2018-01-15 12:45:08 UTC
Description:
Libreoffice crashes when using the 'sidebar' toolbar layout if you click the font dropdown menu before exiting the program

Steps to Reproduce:
1. Open libreoffice writer
2. Go to view | toolbar layout | sidebar
3. On the sidebar, under the character heading, click the arrow for the font dropdown menu (don't select a font, just click the dropdown icon)
4. Click the dropdown icon again to close the dropdown
5. Click File | Exit

Actual Results:  
When you click exit, instead of closing cleanly you get a document recovery window that says the program crashed

Expected Results:
Program should exit cleanly


Reproducible: Always


User Profile Reset: No



Additional Info:
I was also able to reproduce this with the same steps in calc

If I don't use the sidebar I don't seem to get the crash with the same steps


Version: 5.4.4.2
Build ID: 40m0(Build:2)
CPU threads: 4; OS: Linux 4.14; UI render: default; VCL: gtk3; 
Locale: en-US (en_US.utf8); Calc: group


User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.71 Safari/537.36
Comment 1 Xisco Faulí 2018-01-15 12:53:16 UTC Comment hidden (obsolete)
Comment 2 Brandon Watkins 2018-01-15 13:01:19 UTC
I followed the steps to reset my profile to default, but I was still able to re-create the issue using the same steps of steps.

I don't believe I've installed any fonts outside of the defaults that come with my distro. I noticed libreoffice defaulted to liberation as the default font but I didn't have the liberation fonts installed, but after installing the liberation fonts I still see the issue.

I'm not sure a font is the issue in any case, because if I do the same set of steps (just without the sidebar enabled, instead clicking the font dropdown from the default horizontal toolbar) I don't get a crash.
Comment 3 Xisco Faulí 2018-01-15 13:05:27 UTC
Could you please create and attach a screencast showing the steps. There are various free screencast software available for use, including Camstudio (Windows), Jing (Mac), Simple Screen Recorder (Linux) or screencast-o-matic.com (Web).
Comment 4 Telesto 2018-01-15 13:38:23 UTC
I'm able to repro this (or a quite similar bug)
Version: 6.1.0.0.alpha0+
Build ID: ef22c4a0a99be5d2903fb9e9d09fc852cd791173
CPU threads: 4; OS: Windows 6.3; UI render: default; 
TinderBox: Win-x86@42, Branch:master, Time: 2018-01-12_09:16:04
Locale: nl-NL (nl_NL); Calc: CL

1. Writer
2. Go to view | toolbar layout | sidebar
3. On the sidebar, under the character heading, click the arrow for the font dropdown menu 
4. Press CTRL+Q
Comment 5 Xisco Faulí 2018-01-15 14:29:13 UTC
Reproduced in

Version: 6.1.0.0.alpha0+
Build ID: 0ef0740298b45379bbf8d00d50beffee7a2f812a
CPU threads: 4; OS: Linux 4.10; UI render: default; VCL: x11; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group threaded

but not in

Version: 6.1.0.0.alpha0+
Build ID: 0ef0740298b45379bbf8d00d50beffee7a2f812a
CPU threads: 4; OS: Linux 4.10; UI render: default; VCL: gtk2; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group threaded

as Ctrl + Q does nothing with the dropdown list displayed
Comment 6 Xisco Faulí 2018-01-15 14:39:40 UTC
Regression introduced by:

author	Noel Grandin <noel.grandin@collabora.co.uk>	2017-01-11 09:48:18 +0200
committer	Noel Grandin <noel.grandin@collabora.co.uk>	2017-01-13 06:49:23 +0000
commit	e8b49f09074fe184374bee5062715357427ae044 (patch)
tree	b9cf1f5e3d7ab8b98345a512b6ddb0da42fe2919
parent	5e0e27e758e6f7fa325f36e6e51540e10bab0fdc (diff)
new loplugin: useuniqueptr: vcl

Bisected with: bibisect-linux-64-5.4

Adding Cc: to Noel Grandin
Comment 7 Xisco Faulí 2018-01-15 14:52:42 UTC
Created attachment 139111 [details]
gdb backtrace
Comment 8 Michael Meeks 2018-01-16 11:14:11 UTC
I guess:

#7  0x00007fffef31cb59 in SvxFontNameBox_Impl::EventNotify(NotifyEvent&) (this=0x1cf1970, rNEvt=...) at /tinderbox/buildslave/source/libo-master/svx/source/tbxctrls/tbcontrl.cxx:1092
...
#23 0x00007fffee1dd6c2 in FontNameBox::dispose() (this=0x1cf1970) at /tinderbox/buildslave/source/libo-master/svtools/source/control/ctrlbox.cxx:701
#24 0x00007fffef31c481 in SvxFontNameBox_Impl::dispose() (this=0x1cf1970) at /tinderbox/buildslave/source/libo-master/svx/source/tbxctrls/tbcontrl.cxx:989
...

is related; Noel - I expect:

void Edit::ImplSetText( const OUString& rText, const Selection* pNewSelection )
{
    if (isDisposed())
        return;

but of course - the mass event propagation on disposed widgets is also a bit weird / annoying - I'd love to calm that down more widely really; and document what we should be calling and/or relying on during a dispose =)
Comment 9 Noel Grandin 2018-01-18 09:08:11 UTC
This is weird.

Window::ImplGrabFocus is already checking if the losing focus window is disposed, which should be true at that point.

I thought this was master, now building 5-4-4-2 to see if I can repro.
Comment 10 Xisco Faulí 2018-01-18 09:12:23 UTC
In my case, I can also reproduce it in

Versió: 5.4.4.2
ID de la construcció: 1:5.4.4~rc2-0ubuntu0.17.04.1~lo1
Fils de CPU: 4; SO: Linux 4.10; Renderitzador de la IU: per defecte; VCL: x11; 
Configuració local: ca-ES-valencia (ca_ES.UTF-8); Calc: group

it's important to use SAL_USE_VCLPLUGIN=gen on Linux, otherwise Ctrl+Q doesn't work
Comment 11 Xisco Faulí 2018-01-19 12:08:01 UTC
Created attachment 139214 [details]
how to reproduce the issue
Comment 12 Xisco Faulí 2018-01-19 12:34:17 UTC
It doesn't crash if the sidebar is detached
Comment 13 Maxim Monastirsky 2018-01-19 14:00:40 UTC
(In reply to Xisco Faulí from comment #10)
> it's important to use SAL_USE_VCLPLUGIN=gen on Linux, otherwise Ctrl+Q
> doesn't work
In fact it's possible to reproduce with any vclplug, if only clicking inside the font name field (so that it has the focus), and closing the document by clicking the "Close Document" button on the right side of the menu bar.

(In reply to Noel Grandin from comment #9)
> This is weird.
> 
> Window::ImplGrabFocus is already checking if the losing focus window is
> disposed, which should be true at that point.
No. It checks the upper-case Window::IsDisposed(), which checks mpWindowImpl that dies last. I think we should replace it with the lower-case VclReferenceBase::isDisposed().
Comment 14 Xisco Faulí 2018-01-19 17:45:59 UTC
> In fact it's possible to reproduce with any vclplug, if only clicking inside
> the font name field (so that it has the focus), and closing the document by
> clicking the "Close Document" button on the right side of the menu bar.

You're right.
Reproduced in

Version: 6.0.0.0.alpha1+
Build ID: 6eeac3539ea4cac32d126c5e24141f262eb5a4d9
CPU threads: 4; OS: Linux 4.10; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group threaded

1. Show sidebar menu
2. Put cursor inside the fonts texbox
3. Click on the X button to close the window
Comment 15 Maxim Monastirsky 2018-01-20 18:17:29 UTC
Found the problem, patch is in gerrit:

https://gerrit.libreoffice.org/48246/
Comment 16 Commit Notification 2018-01-20 20:34:19 UTC
Maxim Monastirsky committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=2a2b37202a735b34da914c03b2f6e1495f833b51

tdf#115023 Check mpControlData for nullptr

It will be available in 6.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 17 Maxim Monastirsky 2018-01-20 20:37:22 UTC
Fixed on master, backport to 6-0 and 5-4 in gerrit.
Comment 18 Xisco Faulí 2018-01-22 11:50:27 UTC
Verified in

Version: 6.1.0.0.alpha0+
Build ID: de1bb0878fc7d7eb6071ec94d770712648013075
CPU threads: 4; OS: Linux 4.10; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group threaded

Thanks Maxim for the fix!!
Comment 19 Commit Notification 2018-01-23 20:27:37 UTC
Maxim Monastirsky committed a patch related to this issue.
It has been pushed to "libreoffice-6-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=4e00b175e2c222bc320ec16caa90aa1bd2c1b7a7&h=libreoffice-6-0

tdf#115023 Check mpControlData for nullptr

It will be available in 6.0.1.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 20 Commit Notification 2018-01-23 20:28:57 UTC
Maxim Monastirsky committed a patch related to this issue.
It has been pushed to "libreoffice-5-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=034bd06589fc667307b15124da791f0fedc7619d&h=libreoffice-5-4

tdf#115023 Check mpControlData for nullptr

It will be available in 5.4.5.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 21 Commit Notification 2018-01-24 15:41:28 UTC
Maxim Monastirsky committed a patch related to this issue.
It has been pushed to "libreoffice-6-0-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=af274d8b6e819dc089239553811a6bd19a48df49&h=libreoffice-6-0-0

tdf#115023 Check mpControlData for nullptr

It will be available in 6.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.