Bug Hunting Session
Bug 121022 - Contour editor crashes
Summary: Contour editor crashes
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
6.2.0.0.alpha1+
Hardware: All All
: high major
Assignee: Armin Le Grand
URL:
Whiteboard: target:6.3.0 target:6.2.0.1
Keywords: bibisected, bisected, haveBacktrace, regression
: 121025 (view as bug list)
Depends on:
Blocks: Contour-Editor
  Show dependency treegraph
 
Reported: 2018-10-29 13:39 UTC by Regina Henschel
Modified: 2018-12-07 09:20 UTC (History)
5 users (show)

See Also:
Crash report or crash signature:


Attachments
Document with image to test contour editor (42.21 KB, application/vnd.oasis.opendocument.text)
2018-10-29 13:39 UTC, Regina Henschel
Details
bt with debug symbols (125.01 KB, text/plain)
2018-10-30 18:51 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Regina Henschel 2018-10-29 13:39:58 UTC
Created attachment 146135 [details]
Document with image to test contour editor

Open attached document. Right-click image. Choose "Edit contour" from submenu "Wrap".

In the contour editor select the rectangle tool and draw a rectangle over the image.
Expected behavior: The "Apply" button top-left is enabled.
Seen behavior: Crash.

The crash happens wether OpenGL is enabled or not.

It is OK in
Version: 6.2.0.0.alpha0+ (x64)
Build ID: de6b0c6edce0b9237fa43d12e258bf5fa568f6a7
CPU threads: 8; OS: Windows 10.0; UI render: GL; 
TinderBox: Win-x86_64@42, Branch:master, Time: 2018-07-16_05:06:14
Locale: en-US (en_US); Calc: CL

It crashes in actual master, but it crashed too already in
Version: 6.2.0.0.alpha0+ (x64)
Build ID: 215780a7eca23c1bfcde74958e10ae84ea12d506
CPU threads: 8; OS: Windows 10.0; UI render: default; 
TinderBox: Win-x86_64@42, Branch:master, Time: 2018-08-15_22:56:00
Locale: de-DE (en_US); Calc: CL
Comment 1 Xisco Faulí 2018-10-29 15:25:24 UTC
Regression introduced by:

https://cgit.freedesktop.org/libreoffice/core/commit/?id=cbc992e7370ab006ea7c0f8520896845f79f7749

author	Armin Le Grand <Armin.Le.Grand@cib.de>	2018-07-19 19:26:14 +0200
committer	Armin Le Grand <Armin.Le.Grand@cib.de>	2018-07-20 20:29:11 +0200
commit	cbc992e7370ab006ea7c0f8520896845f79f7749 (patch)
tree	71000129a35f40d680279134efae7fac1c4e6a52
parent	133da6ed83b278b9e6059c5c1a3d49f9f402792e (diff)
tdf#118662 Cleanup old hack with cloned SdrCaptionObj

Bisected with: bibisect-linux64-6.2

Adding Cc: to Armin Le Grand
Comment 2 Xisco Faulí 2018-10-29 15:25:50 UTC
*** Bug 121025 has been marked as a duplicate of this bug. ***
Comment 3 Julien Nabet 2018-10-30 18:51:36 UTC
Created attachment 146173 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today, I could reproduce this.

It's due to an infinite recursion with this pattern:
#119 0x00007ffff360b65f in SdrEditView::ImpConvertTo(bool, bool) (this=0x55555b12c0e0, bPath=true, bLineToArea=false)
    at /home/julien/lo/libreoffice/svx/source/svdraw/svdedtv2.cxx:1978
#120 0x00007ffff360b80e in SdrEditView::ConvertMarkedToPathObj(bool) (this=0x55555b12c0e0, bLineToArea=false)
    at /home/julien/lo/libreoffice/svx/source/svdraw/svdedtv2.cxx:1993
#121 0x00007ffff3608072 in SdrEditView::CombineMarkedObjects(bool) (this=0x55555b12c0e0, bNoPolyPoly=false) at /home/julien/lo/libreoffice/svx/source/svdraw/svdedtv2.cxx:1263
#122 0x00007ffff46d2b1b in ContourWindow::SdrObjCreated(SdrObject const&) (this=0x55555b6c5b10) at /home/julien/lo/libreoffice/svx/source/dialog/contwnd.cxx:127
#123 0x00007ffff475c389 in GraphCtrlUserCall::Changed(SdrObject const&, SdrUserCallType, tools::Rectangle const&) (this=0x55555c6bb940, rObj=..., eType=SdrUserCallType::Inserted) at /home/julien/lo/libreoffice/svx/source/dialog/graphctl.cxx:47
#124 0x00007ffff36d53b7 in SdrObject::SendUserCall(SdrUserCallType, tools::Rectangle const&) const (this=0x55555bf64f30, eUserCall=SdrUserCallType::Inserted, rBoundRect=...)
    at /home/julien/lo/libreoffice/svx/source/svdraw/svdobj.cxx:2678
#125 0x00007ffff36d4c39 in SdrObject::InsertedStateChange() (this=0x55555bf64f30) at /home/julien/lo/libreoffice/svx/source/svdraw/svdobj.cxx:2561
#126 0x00007ffff3799c0c in SdrObjList::ReplaceObject(SdrObject*, unsigned long) (this=0x55555b727b60, pNewObj=0x55555e910330, nObjNum=0)
    at /home/julien/lo/libreoffice/svx/source/svdraw/svdpage.cxx:478
#127 0x00007ffff360b296 in SdrEditView::ImpConvertOneObj(SdrObject*, bool, bool) (this=0x55555b12c0e0, pObj=0x55555bf64f30, bPath=true, bLineToArea=false)
    at /home/julien/lo/libreoffice/svx/source/svdraw/svdedtv2.cxx:1929
#128 0x00007ffff360b65f in SdrEditView::ImpConvertTo(bool, bool) (this=0x55555b12c0e0, bPath=true, bLineToArea=false)
    at /home/julien/lo/libreoffice/svx/source/svdraw/svdedtv2.cxx:1978
Comment 4 Armin Le Grand 2018-12-05 08:43:24 UTC
Looks like a endless loop - 1st entry same as last one. Need to debug - there is no reason that SdrObject::InsertedStateChange() triggers ContourWindow::SdrObjCreated all the time - and that tries to convert to SdrPathObj (why at all?) in SdrEditView::ConvertMarkedToPathObj...
Comment 5 Commit Notification 2018-12-05 12:59:15 UTC
Armin Le Grand committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/+/b38f856f234f364199d306226875471ed589b764%5E%21

tdf#121022 Do change parent of SdrObj early

It will be available in 6.3.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 6 Armin Le Grand 2018-12-05 13:43:35 UTC
Checked in fresh pulled master
Comment 7 Xisco Faulí 2018-12-06 12:38:45 UTC
Verified in

Version: 6.3.0.0.alpha0+
Build ID: fcc76610649a9830859f9e2efe2a06dbc6db74da
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US
Calc: threaded

@Armin, thanks for fixing this!!!

Cherry-picked to 6-2: https://gerrit.libreoffice.org/#/c/64706/
Comment 8 Commit Notification 2018-12-07 09:20:44 UTC
Armin Le Grand committed a patch related to this issue.
It has been pushed to "libreoffice-6-2":

https://git.libreoffice.org/core/+/be3b9945edc1ef767400fc143494a96c76712041%5E%21

tdf#121022 Do change parent of SdrObj early

It will be available in 6.2.0.1.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.