Bug 121323 - Crash dragging button after un-grouping compound group
Summary: Crash dragging button after un-grouping compound group
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
4.1 all versions
Hardware: All All
: high major
Assignee: Caolán McNamara
URL:
Whiteboard: target:7.1.0 target:7.0.3
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks: Form-Controls Crash
  Show dependency treegraph
 
Reported: 2018-11-10 00:15 UTC by Jim Avera
Modified: 2021-01-15 11:50 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:
Regression By:


Attachments
crash.ods See "STEPS TO REPRODUCE" (40.18 KB, application/vnd.oasis.opendocument.spreadsheet)
2018-11-10 00:16 UTC, Jim Avera
Details
console logs + bt (85.64 KB, text/plain)
2018-11-10 17:20 UTC, Julien Nabet
Details
gdbtrace.log -- see Comment #9 (14.42 KB, text/x-log)
2020-07-17 02:39 UTC, Jim Avera
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Jim Avera 2018-11-10 00:15:09 UTC
Description:
A crash occurs while dragging a button over a "frozen" spreadsheet row under certain circumstances.

This happens every time with the attached spreadsheet ("crash.ods"), if a (unrelated) group of buttons is first un-grouped.  Somehow the act of un-grouping the group makes a later button-drag crash.   FWIW, the group is a compound group created by grouping a row of buttons, then selecting that group and another button and grouping the combination.

The demo was derived from a production spreadsheet developed using earlier LO versions, so the crash might be due to backwards-compatibility issues (just guessing).

Steps to Reproduce:
1. Open attached spreadsheet "crash.ods" (Disable macros if prompted)
2. View->Toolbars->Form Design: Checked
3. In the floating Form Design toolbar, 
     click the icon to enter Design Mode 
4. Click in the YELLOW button, to select the large group
5. Rightclick->Group->Ungroup
6. Click somewhere else (de-selects the buttons)
7. Drag the GREEN button down towards the large group
(crash occurs when it passes the frozen row)


Actual Results:
Crash

Expected Results:
No crash


Reproducible: Always


User Profile Reset: No



Additional Info:
Version: 6.2.0.0.alpha1
Build ID: ff46ad24d1d3cbcea45895520483ed1fd4ff488b
CPU threads: 12; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: en-US (en_US.UTF-8); Calc: threaded
Comment 1 Jim Avera 2018-11-10 00:16:26 UTC
Created attachment 146515 [details]
crash.ods    See "STEPS TO REPRODUCE"
Comment 2 Xisco Faulí 2018-11-10 13:10:45 UTC
I can reproduce it in

Version: 6.2.0.0.alpha1+
Build ID: 0f68e45e2ec6b9fa8c562044e88355d95af0347d
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US
Calc: threaded

STR:
1. Open attached document
2. Click on the yellow button -> Form Design toolbar appears
3- Right click on the yellow button - ungroup
4. Scroll the spreadsheet horizontally.
-> Crash!
Comment 3 Xisco Faulí 2018-11-10 13:30:42 UTC
Regression introduced by:

https://cgit.freedesktop.org/libreoffice/core/commit/?id=57082b1243e86694b72c5e4fad013bf207bfe81a

author	Luke Deller <luke@deller.id.au>	2013-04-27 21:06:11 (GMT)
committer	David Tardon <dtardon@redhat.com>	2013-04-28 11:52:12 (GMT)
commit 57082b1243e86694b72c5e4fad013bf207bfe81a (patch)
tree 2e461c166beecb5b569c966a2aeceb90995a4b85
parent 2094610175140023cf8f904f8506c189e36dec06 (diff)
fdo#60910: discard UNO shape object in SdrObject::SetPage
The creation of the UNO shape in SdrObject::getUnoShape is influenced
by pPage, so when the page changes we need to discard the cached UNO
shape so that a new one will be created with the new page.

This replaces my first shot at a fix for fdo#60910 which reinstated a
line to discard the custom shape engine (and consequently the UNO shape) in
SdrObjCustomShape::InvalidateRenderGeometry.  That worked but did more
discarding than was necessary.

Bisected with: bibisect-41max and reverted locally as well.

Adding Cc: to Luke Deller
Comment 4 Julien Nabet 2018-11-10 17:20:09 UTC
Created attachment 146523 [details]
console logs + bt

On pc Debian x86-64 with master sources updated today, I could reproduce this.
Comment 5 Oliver Brinzing 2018-11-10 17:50:06 UTC
no repro with

Version: 6.1.3.2 (x64)
Build ID: 86daf60bf00efa86ad547e59e09d6bb77c699acb
CPU threads: 4; OS: Windows 10.0; UI render: default; 
Locale: de-DE (de_DE); Calc: 

Linux only?
Comment 6 Jim Avera 2018-11-17 02:48:22 UTC
Crash still happens on Linux with master just downloaded.

Version: 6.2.0.0.alpha1+
Build ID: 72e6269b88a32a672e00d2c25f0d0400038d1360
CPU threads: 12; OS: Linux 4.15; UI render: default; VCL: gtk3; 
TinderBox: Linux-rpm_deb-x86_64@86-TDF, Branch:master, Time: 2018-11-14_19:34:46
Locale: en-US (en_US.UTF-8); UI-Language: en-US
Calc: threaded
Comment 7 Xisco Faulí 2018-11-29 14:45:20 UTC
Still reproduced in

Version: 6.3.0.0.alpha0+
Build ID: 00df4a5ae395607eab1f83aacfc1fb05eb93ecc9
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); UI-Language: en-US
Calc: threaded

@Caolán, since you fixed bug 112696, I thought you might be interested in this
issue...
Comment 8 QA Administrators 2019-11-30 03:39:51 UTC Comment hidden (obsolete)
Comment 9 Jim Avera 2020-07-17 02:38:22 UTC
Still crashes in master.  Actually, it seems like a new crash which happens sooner -- the moment the group is "ungrouped".

Thread 1 gets "SIGABRT" in __GI_raise (uncaught exception??).
I will attach a gdb trace (sorry, no symbols).

Revised STEPS TO REPRODUCE:

1. Open the attached "crash.ods" file (Disable macros if prompted)

2. View->Toolbars->Form Design (checked)

3. Click the 'Designe Mode' icon (green drafting square and pencil in icon)

4. Click on the yellow button
    Rightclick->ungroup
    (crashes)

Version: 7.1.0.0.alpha0+
Build ID: 656fd1ec9123de5dbeecb8db4de5254b05c21e76
CPU threads: 12; OS: Linux 5.4; UI render: default; VCL: gtk3
Locale: en-US (en_US.UTF-8); UI: en-US
TinderBox: Linux-rpm_deb-x86_64@86-TDF, Branch:master, Time: 2020-07-07_00:08:54
Calc: threaded
Comment 10 Jim Avera 2020-07-17 02:39:47 UTC
Created attachment 163145 [details]
gdbtrace.log -- see Comment #9
Comment 11 Caolán McNamara 2020-09-22 14:06:57 UTC
What I see is an uncaught exception from the accessibility stack. Which would fit with the reported platforms being gtk3 where a11y is basically always on.
Comment 12 Commit Notification 2020-09-22 15:27:03 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/c5ff4cbd0192773c6503d54325de01abda7e9fa5

tdf#121323 avoid fatal exception with a11y enabled

It will be available in 7.1.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 13 Commit Notification 2020-09-22 15:27:14 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/4e4de8935f38b781374ca34408bd3c57c3cdb69f

tdf#121323 avoid assert about duplicate listeners

It will be available in 7.1.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 14 Commit Notification 2020-09-23 09:15:11 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-7-0":

https://git.libreoffice.org/core/commit/6a842d1c079ff88e5616d05ec151b647acc25b6e

tdf#121323 avoid fatal exception with a11y enabled

It will be available in 7.0.3.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 15 Jim Avera 2020-09-24 16:31:19 UTC
Confirming fixed in Master.  Thanks for tracking this down!

Version: 7.1.0.0.alpha0+
Build ID: 8ea4feee03542c767e0b26beb888b63bc653878d
CPU threads: 12; OS: Linux 5.4; UI render: default; VCL: gtk3
Locale: en-US (en_US.UTF-8); UI: en-US
TinderBox: Linux-rpm_deb-x86_64@86-TDF, Branch:master, Time: 2020-09-22_18:13:30
Calc: threaded
Comment 16 Justin L 2021-01-15 11:50:09 UTC
Assuming this should be marked as fixed since all backports are done, and OP confirmed the fix.  (I have also confirmed both the crash in 6.4.7 and the fix in 7.2+.)