Bug Hunting Session
Bug 121323 - Crash dragging button after un-grouping compound group
Summary: Crash dragging button after un-grouping compound group
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
(earliest affected)
4.1 all versions
Hardware: All All
: high major
Assignee: Not Assigned
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Reported: 2018-11-10 00:15 UTC by Jim Avera
Modified: 2018-11-29 14:45 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:

crash.ods See "STEPS TO REPRODUCE" (40.18 KB, application/vnd.oasis.opendocument.spreadsheet)
2018-11-10 00:16 UTC, Jim Avera
console logs + bt (85.64 KB, text/plain)
2018-11-10 17:20 UTC, Julien Nabet

Note You need to log in before you can comment on or make changes to this bug.
Description Jim Avera 2018-11-10 00:15:09 UTC
A crash occurs while dragging a button over a "frozen" spreadsheet row under certain circumstances.

This happens every time with the attached spreadsheet ("crash.ods"), if a (unrelated) group of buttons is first un-grouped.  Somehow the act of un-grouping the group makes a later button-drag crash.   FWIW, the group is a compound group created by grouping a row of buttons, then selecting that group and another button and grouping the combination.

The demo was derived from a production spreadsheet developed using earlier LO versions, so the crash might be due to backwards-compatibility issues (just guessing).

Steps to Reproduce:
1. Open attached spreadsheet "crash.ods" (Disable macros if prompted)
2. View->Toolbars->Form Design: Checked
3. In the floating Form Design toolbar, 
     click the icon to enter Design Mode 
4. Click in the YELLOW button, to select the large group
5. Rightclick->Group->Ungroup
6. Click somewhere else (de-selects the buttons)
7. Drag the GREEN button down towards the large group
(crash occurs when it passes the frozen row)

Actual Results:

Expected Results:
No crash

Reproducible: Always

User Profile Reset: No

Additional Info:
Build ID: ff46ad24d1d3cbcea45895520483ed1fd4ff488b
CPU threads: 12; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: en-US (en_US.UTF-8); Calc: threaded
Comment 1 Jim Avera 2018-11-10 00:16:26 UTC
Created attachment 146515 [details]
crash.ods    See "STEPS TO REPRODUCE"
Comment 2 Xisco Faulí 2018-11-10 13:10:45 UTC
I can reproduce it in

Build ID: 0f68e45e2ec6b9fa8c562044e88355d95af0347d
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US
Calc: threaded

1. Open attached document
2. Click on the yellow button -> Form Design toolbar appears
3- Right click on the yellow button - ungroup
4. Scroll the spreadsheet horizontally.
-> Crash!
Comment 3 Xisco Faulí 2018-11-10 13:30:42 UTC
Regression introduced by:


author	Luke Deller <luke@deller.id.au>	2013-04-27 21:06:11 (GMT)
committer	David Tardon <dtardon@redhat.com>	2013-04-28 11:52:12 (GMT)
commit	57082b1243e86694b72c5e4fad013bf207bfe81a (patch)
tree	2e461c166beecb5b569c966a2aeceb90995a4b85
parent	2094610175140023cf8f904f8506c189e36dec06 (diff)
fdo#60910: discard UNO shape object in SdrObject::SetPage
The creation of the UNO shape in SdrObject::getUnoShape is influenced
by pPage, so when the page changes we need to discard the cached UNO
shape so that a new one will be created with the new page.

This replaces my first shot at a fix for fdo#60910 which reinstated a
line to discard the custom shape engine (and consequently the UNO shape) in
SdrObjCustomShape::InvalidateRenderGeometry.  That worked but did more
discarding than was necessary.

Bisected with: bibisect-41max and reverted locally as well.

Adding Cc: to Luke Deller
Comment 4 Julien Nabet 2018-11-10 17:20:09 UTC
Created attachment 146523 [details]
console logs + bt

On pc Debian x86-64 with master sources updated today, I could reproduce this.
Comment 5 Oliver Brinzing 2018-11-10 17:50:06 UTC
no repro with

Version: (x64)
Build ID: 86daf60bf00efa86ad547e59e09d6bb77c699acb
CPU threads: 4; OS: Windows 10.0; UI render: default; 
Locale: de-DE (de_DE); Calc: 

Linux only?
Comment 6 Jim Avera 2018-11-17 02:48:22 UTC
Crash still happens on Linux with master just downloaded.

Build ID: 72e6269b88a32a672e00d2c25f0d0400038d1360
CPU threads: 12; OS: Linux 4.15; UI render: default; VCL: gtk3; 
TinderBox: Linux-rpm_deb-x86_64@86-TDF, Branch:master, Time: 2018-11-14_19:34:46
Locale: en-US (en_US.UTF-8); UI-Language: en-US
Calc: threaded
Comment 7 Xisco Faulí 2018-11-29 14:45:20 UTC
Still reproduced in

Build ID: 00df4a5ae395607eab1f83aacfc1fb05eb93ecc9
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US
Calc: threaded

@Caolán, since you fixed bug 112696, I thought you might be interested in this