Bug Hunting Session
Bug 115950 - EDITING: Crash while selecting cell format with double-click
Summary: EDITING: Crash while selecting cell format with double-click
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
6.1.0.0.alpha0+
Hardware: All All
: highest critical
Assignee: Not Assigned
URL:
Whiteboard: target:6.2.0 target:6.1.0.2
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks: Cell-Format-Dialog
  Show dependency treegraph
 
Reported: 2018-02-23 01:30 UTC by Terrence Enger
Modified: 2018-07-13 15:30 UTC (History)
5 users (show)

See Also:
Crash report or crash signature: ["SvImpLBox::MouseButtonDown(MouseEvent const &)"]


Attachments
log file from gdb (23.58 KB, text/plain)
2018-02-23 01:32 UTC, Terrence Enger
Details
tail of bibisect output (2.10 KB, text/plain)
2018-02-23 01:33 UTC, Terrence Enger
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Terrence Enger 2018-02-23 01:30:21 UTC
STR
---
(1) Run Calc.  Program presents Calc window "Untitled 1".

(2) Take menu options Format > Cell.  Program presents dialog Format
    Cells.

(3) Click on tab Numbers.  Program displays tab numbers with catagory
    Number and format General selected.

(4) Double-click format General.  Program segfaults.

I first saw this in daily Linux dbgutil bibisect repository version
2018-02-21 runningo on debian-buster.
Comment 1 Terrence Enger 2018-02-23 01:32:15 UTC
Created attachment 140076 [details]
log file from gdb

Possible points of interest:

    line  what
    ----  --------------------------
       1  info threads
       8  backtrace full
      94  thread apply all backtrace

The attachment is from local build of commit 1d7f96a3 (2018-02-22
11:52 UTC) built and running on debian-buster.
Comment 2 Terrence Enger 2018-02-23 01:33:41 UTC
Created attachment 140077 [details]
tail of bibisect output

Working on debian-buster in daily Linux dbgutil bibisect repository, I
see that the segfault entered LibreOffice somewhere in the 86 or so
source commits:


          commit    date        s-h
          --------  ----------  --------
    good  fad94b74  2018-01-15  7a6df88f
    bad   9c7e1cf4  2018-01-16  3b773d5b
Comment 3 Aron Budea 2018-02-23 13:58:03 UTC
Bibisected to the following commit using repo bibisect-linux-64-6.1 based on the daily bibisect repo results. (thanks for that, Terrence!)
Adding Cc: to Jan Holesovsky, please take a look.

https://cgit.freedesktop.org/libreoffice/core/commit/?id=c40dfabd56ade10fe35690dc9810955c2e99e2c0
author		Jan Holesovsky <kendy@collabora.com>	2018-01-12 11:57:22 +0000
committer	Jan Holesovsky <kendy@collabora.com>	2018-01-15 17:44:42 +0100

lokdialog: Allow closing the Format Cell dialogs in any order.
Comment 4 Commit Notification 2018-03-01 14:42:34 UTC
Jan Holesovsky committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=7651e57573952758032ceb88f16e2dbbb6cc4e18

tdf#115950: Indicate that the dialog was already destroyed.

It will be available in 6.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 5 Jan Holesovsky 2018-03-01 14:56:14 UTC
Turned out to be an old bug that was only uncovered by my work :-)
Comment 6 Jan Holesovsky 2018-03-01 14:59:52 UTC
Oh - and thanks for finding & bibisecting, helped a lot a always :-)
Comment 7 Xisco Faulí 2018-03-02 10:16:40 UTC
Verified in

Version: 6.1.0.0.alpha0+
Build ID: 1126fcfdedc7047a8e8e4a5925c7dd2fde7a0436
CPU threads: 4; OS: Linux 4.13; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group
Comment 8 Aron Budea 2018-05-03 17:53:56 UTC
Reopening, as this bug resurfaced because of bug 117063's fix, for details see bug 117063 comment 12.
Comment 9 Xavier Van Wijmeersch 2018-05-04 08:44:09 UTC
crashreport.libreoffice.org/stats/crash_details/0aadf680-4139-4f08-ab6b-e0eeadf37768

Version: 6.1.0.0.alpha1+
Build ID: 4ed3137022efa6128ad146e4b4dfae13548431dc
CPU threads: 8; OS: Linux 4.14; UI render: default; VCL: kde4; 
TinderBox: Linux-rpm_deb-x86_64@70-TDF, Branch:master, Time: 2018-05-04_01:13:51
Locale: nl-BE (en_US.UTF-8); Calc: group
Comment 10 Xisco Faulí 2018-06-07 10:54:56 UTC
This issue is still reproducible in

Version: 6.1.0.0.beta1+
Build ID: 8b96445766efe237eb47608ade6c147673466e2e
CPU threads: 4; OS: Linux 4.13; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group threaded
Comment 11 Aron Budea 2018-06-11 00:35:13 UTC
Fresh crash report with symbols:
https://crashreport.libreoffice.org/stats/crash_details/6807f116-3d9e-420d-875b-8b6733f03600
Comment 12 Xavier Van Wijmeersch 2018-06-14 13:36:07 UTC
also repro with

Version: 6.2.0.0.alpha0+
Build ID: 807d4382cb021d2ac3ea99d6757a7b368a32941d
CPU threads: 8; OS: Linux 4.14; UI render: default; VCL: kde4; 
Locale: nl-BE (en_US.UTF-8); Calc: group threaded

Version: 6.2.0.0.alpha0+
Build ID: 90e4c55d01637178418c33ffe818263114a53374
CPU threads: 8; OS: Linux 4.14; UI render: default; VCL: kde4; 
TinderBox: Linux-rpm_deb-x86_64@70-TDF, Branch:master, Time: 2018-06-12_00:10:12
Locale: nl-BE (en_US.UTF-8); Calc: group threaded
Comment 13 Eike Rathke 2018-07-09 23:05:25 UTC
So the root cause seems to be the unconditional return true in SvTreeListBox::DoubleClickHdl() introduced with http://cgit.freedesktop.org/libreoffice/core/commit/?id=b649ce123dea372359ec571135a68eb3de844e5b that should instead be the previous 

    return !aDoubleClickHdl.IsSet() || aDoubleClickHdl.Call(this);

which fixes *this* crash that occurs after the pView->DoubleClickHdl() returned true. But with false we crash at the end of SvImpLBox::MouseButtonDown() in aSelEng.SelMouseButtonDown( rMEvt ) because the SvImplBox is already destroyed (together with the dialog and tabpage) (and aSelEng.GetSelectionMode() returned a random value not SelectionMode::NONE).

Good night.
Comment 14 Eike Rathke 2018-07-10 09:16:31 UTC
https://gerrit.libreoffice.org/57225 will fix that.
Comment 15 Commit Notification 2018-07-12 10:44:26 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=c9d1655d455ad783694e6d7f0d2e6cf3d0d0acae

Resolves: tdf#115950 proper double click return and bail out, tdf#117063

It will be available in 6.2.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 16 Commit Notification 2018-07-12 11:45:44 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "libreoffice-6-1":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=172817aa670ff923780d0159c4416871179fa94c&h=libreoffice-6-1

Resolves: tdf#115950 proper double click return and bail out, tdf#117063

It will be available in 6.1.0.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 17 Commit Notification 2018-07-12 12:32:38 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=60c2f6d7f167cc313b33d29531f8c7320903e78d

SvTreeListBox::DoubleClickHdl: SwContentTree more, tdf#115950 related

It will be available in 6.2.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 18 Commit Notification 2018-07-12 12:52:49 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=3d73f76a91260becf171ea77589190714577b267

SvTreeListBox::DoubleClickHdl: SwCondCollPage more, tdf#115950 related

It will be available in 6.2.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 19 Commit Notification 2018-07-12 14:38:22 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=446f9cf176038881af166e46489bb1880b22174d

SvTreeListBox::DoubleClickHdl: SwContentTree more, tdf#115950 related

It will be available in 6.2.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 20 Commit Notification 2018-07-12 16:35:03 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "libreoffice-6-1":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=32003187445f62fa6f390a09a85949b6d42b55f7&h=libreoffice-6-1

SvTreeListBox::DoubleClickHdl: SwCondCollPage more, tdf#115950 related

It will be available in 6.1.0.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 21 Commit Notification 2018-07-12 16:38:40 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=1a5ef55b7de60131efa7a831309186b29cb6214e

SvTreeListBox::DoubleClickHdl: DbRegistrationOptionsPage more, tdf#115950 rel.

It will be available in 6.2.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 22 Commit Notification 2018-07-13 08:30:14 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "libreoffice-6-1":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=48c6375458d09378b404e2ab5153f2ef2cc0630e&h=libreoffice-6-1

SvTreeListBox::DoubleClickHdl: DbRegistrationOptionsPage more, tdf#115950 rel.

It will be available in 6.1.0.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 23 Commit Notification 2018-07-13 08:30:22 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "libreoffice-6-1":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=ff0e7e5427c2851341d01e8917a1b5df0c08e557&h=libreoffice-6-1

SvTreeListBox::DoubleClickHdl: SwContentTree more, tdf#115950 related

It will be available in 6.1.0.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 24 Terrence Enger 2018-07-13 15:29:46 UTC
Working on debian-buster in daily Linux dbgutil bibisect repository
version 2018-07-13 I see no crash.  I am setting status VERIFIED
FIXED.