Bug 116879 - Crash when showing Comment
Summary: Crash when showing Comment
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
6.1.0.0.alpha0+
Hardware: All Linux (All)
: highest critical
Assignee: Armin Le Grand
URL:
Whiteboard: target:6.1.0
Keywords: bibisected, bisected, haveBacktrace, regression
: 116991 117200 (view as bug list)
Depends on:
Blocks: AW080-Regressions
  Show dependency treegraph
 
Reported: 2018-04-08 10:22 UTC by Laurent BP
Modified: 2018-05-30 05:45 UTC (History)
7 users (show)

See Also:
Crash report or crash signature:


Attachments
backtrace log (19.18 KB, text/x-log)
2018-04-08 10:22 UTC, Laurent BP
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Laurent BP 2018-04-08 10:22:26 UTC
Created attachment 141207 [details]
backtrace log

Description: crash when moving mouse over a cell containing a comment

Steps to reproduce:
1. Create a new Spreadsheet
2. Right click > Insert Comment
3. Type a comment
4. Click outside Comment to close it
5. Move mouse over cells: Comment is shown
6. Move mouse to hide Comment

Actual result:
crash

Expected result:
no crash

Version: 6.1.0.0.alpha0+
Build ID: 2c63fcb0cf10c7ce580545576f2bd40dbcdb61d0
CPU threads: 8; OS: Linux 4.13; UI render: default; VCL: gtk3; 
Locale: fr-FR (fr_FR.UTF-8); Calc: group

Attached backtrace
Comment 1 Xisco Faulí 2018-04-08 11:54:59 UTC
Regression introduced by:

author	Armin Le Grand <Armin.Le.Grand@cib.de (CIB)>	2018-03-01 15:54:32 +0100
committer	Armin Le Grand <Armin.Le.Grand@cib.de>	2018-04-07 00:28:30 +0200
commit	dfefe448c41921f2f1e54d3f69b8b9e89031d055 (patch)
tree	1aace31054b5740e2faffcbc5de66a791be27f7d
parent	eba4d5b2b76cefde90cb3d6638c736f435023a45 (diff)
SOSAW080: Added first bunch of basic changes to helpers

Bisected with: bibisect-linux64-6.1

Adding Cc: to Armin Le Grand
Comment 2 Xavier Van Wijmeersch 2018-04-08 13:11:20 UTC
confirm

Version: 6.1.0.0.alpha0+
Build ID: 2c63fcb0cf10c7ce580545576f2bd40dbcdb61d0
CPU threads: 8; OS: Linux 4.14; UI render: default; VCL: gtk3; 
Locale: nl-BE (en_US.UTF-8); Calc: group
Comment 3 Jean-Baptiste Faure 2018-04-15 14:52:23 UTC
Ran into this crash when trying to confirm bug 116998 in current master.

Best regards. JBF
Comment 4 Xisco Faulí 2018-04-18 21:30:48 UTC
*** Bug 116991 has been marked as a duplicate of this bug. ***
Comment 5 Elmar 2018-04-22 15:09:05 UTC Comment hidden (no-value)
Comment 6 Jean-Baptiste Faure 2018-04-22 16:15:41 UTC Comment hidden (obsolete)
Comment 7 Julien Nabet 2018-04-24 07:44:39 UTC
*** Bug 117200 has been marked as a duplicate of this bug. ***
Comment 8 Armin Le Grand 2018-05-03 11:13:03 UTC
Tried to reproduce, but did not happen on Win. Checked the log, too - nothing obvious. Maybe Linux only...? FGix for tdf#117145 already included in test version, thuogh.
Comment 9 Armin Le Grand 2018-05-03 11:17:14 UTC
Could repro on Linux, non-current version. Updating to have fix for tdf#117145 included...
Comment 10 Xisco Faulí 2018-05-03 12:00:59 UTC
(In reply to Armin Le Grand (CIB) from comment #9)
> Could repro on Linux, non-current version. Updating to have fix for
> tdf#117145 included...

Still reproducible in

Version: 6.1.0.0.alpha1+
Build ID: f1579d3d6c5f5f3a651825e035b93bee7a4f43c6
CPU threads: 4; OS: Linux 4.13; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group

with the fix for bug 117145 included...
Comment 11 Armin Le Grand 2018-05-03 14:42:27 UTC
Happens on updated Linux, but not on updated Win -> strange, Win-only crash? Will again update win version and get Linux-version with debug...
Comment 12 Armin Le Grand 2018-05-03 15:46:29 UTC
Re-checked, no crash on Windows (Is there a setting like 'not_on_windows' instead 'on_linux' ?)
Comment 13 Xisco Faulí 2018-05-03 15:50:50 UTC
yep, it doesn't crash with gen, only gtk3 and gtk...

Adding Caolán to the loop as well
Comment 14 Caolán McNamara 2018-05-03 16:08:48 UTC
gtk2/gtk3 have working accessibilty so its possible that this sort of thing is an a11y related crash which might appear on turning on windows a11y (however that's done)
Comment 15 Armin Le Grand 2018-05-03 18:09:25 UTC
Linux debug version ready, taking a look...
Comment 16 Armin Le Grand 2018-05-03 18:50:17 UTC
Start is in ScNoteMarker::~ScNoteMarker. It destructs a SdrModel which uses ::ClearModel() which uses ::DeletePage() to destruct the SdrPage(s).
SdrPage is derived from SdrObjList (was already in lo-6-0) which gets deleted first. That again uses SdrObjList::Clear() which removes and deletes the SdrObjects from the SdrObjList.

What has changed is that there is no longer a pModel SdrModel* in SdrObjList that was set to nullptr in SdrObjList::~SdrObjList() in lo-6-0 with the comment:

    // To avoid that the Clear() method will broadcast changes when in destruction
    // which would call virtual method (not allowed in destructor), the model is set
    // to NULL here.

This did change and there is broadcasting now. Not directly a virtual functoin call, but the broadcasts goes to ScDrawModelBroadcaster::Notify and there SdrPage::GetUnoPage() is called exactly at the SdrPage that gets destructed.

Thus: Need to find a way not to broadcast in SdrObjList::Clear() when coming from SdrObjList::~SdrObjList()...
Comment 17 Armin Le Grand 2018-05-04 08:53:19 UTC
@Caolan: Just curious - why is with Linux and gtk3/gtk ScNoteMarker on the stack? Is there some 'auto-clipboard' stuff going on...? This *does* use massive ressources (con/de/structing a SdrModel, cloning SdrObjects, ...). Is that needed/intended..?
Comment 18 Armin Le Grand 2018-05-04 09:28:09 UTC
Solution with splitetd ::ClearSdrObjList on gerrit (https://gerrit.libreoffice.org/#/c/53839/)
Comment 19 Commit Notification 2018-05-04 12:49:33 UTC
Armin Le Grand committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=0fe7bda233da3c1f95a82c0050c8f917dc39c22e

tdf#116879 Separate SdrObjList::Clear() as needed

It will be available in 6.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 20 Caolán McNamara 2018-05-04 14:17:11 UTC
looking at the bt of the crash for me I don't see any clipboard stuff in this case, which is unlike the other crash on exit bug which is different. All there is here is a mouse move event which triggers some help balloon code paths, so the gtk/gtk3 path here doesn't look particularly odd, and not c-n-p related as far as I can see.
Comment 21 surbun 2018-05-07 05:35:21 UTC
Hello,
       It seems to be OK now.
Tha
Comment 22 surbun 2018-05-07 05:37:34 UTC
Thanks a lot for your work
Comment 23 Jean-Baptiste Faure 2018-05-07 06:41:42 UTC
No crash anymore for me with 
Version: 6.1.0.0.alpha1+
Build ID: 3988bd9dc8339aa32f1721df6b256def5e94f786
Threads CPU : 4; OS : Linux 4.4; UI Render : par défaut; VCL: gtk3; 
Ubuntu_16.04_x86-64
Locale : fr-FR (fr_FR.UTF-8); Calc: threaded

Best regards. JBF
Comment 24 Xavier Van Wijmeersch 2018-05-07 08:26:04 UTC
no crash anymore for me with

Version: 6.1.0.0.alpha1+
Build ID: 8e794c95c48d7c7fbfffebb9cd99f8d49dcf4735
CPU threads: 8; OS: Linux 4.14; UI render: default; VCL: gtk3; 
Locale: nl-BE (en_US.UTF-8); Calc: group
Comment 25 Xisco Faulí 2018-05-07 10:03:23 UTC
Verified in

Version: 6.1.0.0.alpha1+
Build ID: 1e2afc9bd3062cfba6b65b45c17a08f298014239
CPU threads: 4; OS: Linux 4.13; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group
Comment 26 Elmar 2018-05-07 13:40:18 UTC
Thank you. checked it
Comment 27 Daniel 2018-05-23 04:07:28 UTC
Bug still present in version 6.1.0.0.alpha1+. Technical data on the crash report is in the following link:

http://crashreport.libreoffice.org/stats/crash_details/cf9ba2ab-daab-4a6b-a016-1e2e4b881c14
Comment 28 Daniel 2018-05-23 04:11:25 UTC
More data...

Versión: 6.1.0.0.alpha1
Id. de compilación: cb47f0d320994e001bc38dc2ee9b7d957b15e6ab
CPU threads: 2; OS: Linux 4.13; UI render: default; VCL: gtk2; 
Locale: es-CO (es_CO.UTF-8); Calc: group
Comment 29 Daniel 2018-05-23 04:12:29 UTC
More data...

Versión: 6.1.0.0.alpha1
Build ID: cb47f0d320994e001bc38dc2ee9b7d957b15e6ab
CPU threads: 2; OS: Linux 4.13; UI render: default; VCL: gtk2; 
Locale: es-CO (es_CO.UTF-8); Calc: group
Comment 30 Jean-Baptiste Faure 2018-05-23 05:26:17 UTC
(In reply to Daniel from comment #27)
> Bug still present in version 6.1.0.0.alpha1+. Technical data on the crash
> report is in the following link:
> 
> http://crashreport.libreoffice.org/stats/crash_details/cf9ba2ab-daab-4a6b-
> a016-1e2e4b881c14

It is because the commit that fixes the bug is more recent than your version:
https://gerrit.libreoffice.org/gitweb?p=core.git;a=commit;h=cb47f0d320994e001bc38dc2ee9b7d957b15e6ab

You can try a daily build.

Best regards. JBF
Comment 31 Elmar 2018-05-30 05:45:14 UTC
I think this is resolved in 6.1 alpha