Bug 123459 - Writer crashed when quickly close the creating window (with wollmux)
Summary: Writer crashed when quickly close the creating window (with wollmux)
Status: RESOLVED NOTOURBUG
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
6.3.0.0.alpha0+
Hardware: All Windows (All)
: medium normal
Assignee: Juergen Funk (CIB)
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-02-14 06:37 UTC by Juergen Funk (CIB)
Modified: 2019-02-21 21:23 UTC (History)
1 user (show)

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Juergen Funk (CIB) 2019-02-14 06:37:17 UTC
The crash can be only testing with wollmux (with local wollmux-config)

Steps:
 - Start writer
 - make the windows in x smaller
 - click the wollmux button in the sidebar
 - in the open-sidebar at the button click the buttons
 - then quickly close the creating windows

not always but often crash LO
Comment 1 Juergen Funk (CIB) 2019-02-14 07:02:48 UTC
Stack-Traces with distro/lhm/libreoffice-5-2+all 8c5b5941228bb9a9a0107b1aa8cf9928e2054505
Have testing with master b8e450a54936560cdac00ab4c70ef80c20cfaf99,   
wollmux 18.04 with and without LDAP 


This crash i have get sometimes (Jan)

Break through pure-virtual function

 	ucrtbase.dll!00007ffeed7df08e()	
 	vcruntime140.dll!_purecall() C++

  pSchedulerData         = 0x000002b0db1cb590 
  pSchedulerData->mpTask = 0x000002b0d637b398 
  nReadyPeriod = pSchedulerData->mpTask->UpdateMinPeriod( nMinPeriod=0, nTime=355322288 );
>	vcllo.dll!Scheduler::ProcessTaskScheduling() Zeile 337	C++
vcl\source\app\scheduler.cxx (337)
 	vcllo.dll!Scheduler::CallbackTaskScheduling() Zeile 202	C++
vcl\source\app\scheduler.cxx (202)
 	vcllo.dll!SalTimer::CallCallback() Zeile 56	C++
vcl\inc\saltimer.hxx (56)
 	vcllo.dll!WinSalTimer::ImplHandleElapsedTimer() Zeile 175 C++
vcl\win\app\saltimer.cxx (175)
 	vcllo.dll!ImplSalYield(bool bWait=true, bool bHandleAllCurrentEvents=false) Zeile 621 C++
vcl\win\app\salinst.cxx (621)
 	vcllo.dll!WinSalInstance::DoYield(bool bWait=true, bool bHandleAllCurrentEvents=false, unsigned __int64 nReleased=0) Zeile 682 C++
vcl\win\app\salinst.cxx (682)
 	vcllo.dll!ImplYield(bool i_bWait=true, bool i_bAllEvents=false, const unsigned __int64 nReleased=0) Zeile 494 C++
vcl\win\app\salinst.cxx (494)
 	vcllo.dll!Application::Yield() Zeile 568 C++
vcl\source\app\svapp.cxx (568)
 	vcllo.dll!Application::Execute() Zeile 473 C++
vcl\source\app\svapp.cxx (473)
 	sofficeapp.dll!desktop::Desktop::DoExecute() Zeile 1331 C++
desktop\source\app\app.cxx (1331)
 	sofficeapp.dll!desktop::Desktop::Main() Zeile 1662 C++
desktop\source\app\app.cxx (1662)
 	vcllo.dll!ImplSVMain() Zeile 189 C++
desktop\source\app\app.cxx (189)
 	vcllo.dll!SVMain() Zeile 228 C++
vcl\source\app\svmain.cxx (228)
 	sofficeapp.dll!soffice_main() Zeile 170 C++
desktop\source\app\sofficemain.cxx (170)
 	soffice.bin!sal_main() Zeile 48 C
desktop\source\app\main.c (48)
 	soffice.bin!main(int argc=1, char * * argv=0x000002b0d00cbf30) Zeile 47 C
desktop\source\app\main.c (47)
 	soffice.bin!WinMain(void * _hinst=0x00007ff761120000, void * _dummy=0x0000000000000000, char * _cmdline=0x000002b0d0073dc2, int _nshow=10) Zeile 47 C
desktop\source\app\main.c (47)
 	[Inlineframe] soffice.bin!invoke_main() Zeile 94	C++
 	soffice.bin!__scrt_common_main_seh() Zeile 253	C++
 	kernel32.dll!BaseThreadInitThunk()	Unbekannt
 	ntdll.dll!RtlUserThreadStart()	Unbekannt
Comment 2 Juergen Funk (CIB) 2019-02-14 07:14:23 UTC
Stack-Traces with distro/lhm/libreoffice-5-2+all 8c5b5941228bb9a9a0107b1aa8cf9928e2054505
wollmux 18.04 with LDAP 

Have testing with master b8e450a54936560cdac00ab4c70ef80c20cfaf99,   


Break through unhandle exception
---------------------------------

This thread delete

	ntdll.dll!NtWaitForAlertByThreadId()
	ntdll.dll!RtlpWaitOnAddressWithTimeout()
	ntdll.dll!RtlpWaitOnAddress()
	ntdll.dll!RtlpWaitOnCriticalSection()
	ntdll.dll!RtlpEnterCriticalSectionContended()
	ntdll.dll!RtlEnterCriticalSection()
	sal3.dll!osl_acquireMutex(_oslMutexImpl * Mutex=0x000001662ce750b0) Zeile 72
sal\osl\w32\mutex.c (72)
	vcllo.dll!osl::Mutex::acquire() Zeile 56
include\osl\mutex.hxx (56)
	vcllo.dll!SalYieldMutex::acquire() Zeile 143
vcl\win\app\salinst.cxx (143)
	vcllo.dll!SolarMutexGuard::SolarMutexGuard() Zeile 1475
include\vcl\svapp.hxx (1475)
	swlo.dll!sw::UnoImplPtrDeleter<SwXTextRange::Impl>::operator()(SwXTextRange::Impl * pUnoImpl=0x000001663742cc20) Zeile 98
sw\inc\unobaseclass.hxx (98)
	swlo.dll!std::unique_ptr<SwXTextRange::Impl,sw::UnoImplPtrDeleter<SwXTextRange::Impl> >::~unique_ptr<SwXTextRange::Impl,sw::UnoImplPtrDeleter<SwXTextRange::Impl> >() Zeile 1397
c:\program files (x86)\microsoft visual studio 14.0\vc\include\memory (1397)
	swlo.dll!SwXTextRange::~SwXTextRange() Zeile 775
sw\source\core\unocore\unoobj2.cxx (775)
	swlo.dll!SwXTextRange::`vector deleting destructor'(unsigned int)
	cppuhelper3MSC.dll!cppu::OWeakObject::release() Zeile 231
cppuhelper\source\weak.cxx (231)
	swlo.dll!cppu::WeakImplHelper<com::sun::star::lang::XUnoTunnel,com::sun::star::lang::XServiceInfo,com::sun::star::beans::XPropertySet,com::sun::star::beans::XPropertyState,com::sun::star::container::XEnumerationAccess,com::sun::star::container::XContentEnumerationAccess,com::sun::star::text::XTextRange,com::sun::star::text::XRedline>::release() Zeile 113
include\cppuhelper\implbase.hxx (113)
	mscx_uno.dll!bridges::cpp_uno::shared::freeUnoInterfaceProxy(_uno_ExtEnvironment * pEnv=0x0000016632026a30, void * pProxy=0x0000016638e5a590) Zeile 43
bridges\source\cpp_uno\shared\unointerfaceproxy.cxx (43)
	cppu3.dll!s_stub_defenv_revokeInterface(char * * pParam=0x00000007afe1f260) Zeile 374
cppu\source\uno\lbenv.cxx (374)
	cppu3.dll!s_environment_invoke_v(_uno_Environment * pCurrEnv=0x0000000000000000, _uno_Environment * pTargetEnv=0x0000016632026a30, void(*)(char * *) pCallee=0x00007ff90fe38290, char * * pParam=0x00000007afe1f260) Zeile 294
cppu\source\uno\envstack.cxx (294)
	cppu3.dll!uno_Environment_invoke_v(_uno_Environment * pTargetEnv=0x0000016632026a30, void(*)(char * *) pCallee=0x00007ff90fe38290, char * * pParam=0x00000007afe1f260) Zeile 313
cppu\source\uno\envstack.cxx (313)
	cppu3.dll!uno_Environment_invoke(_uno_Environment * pEnv=0x0000016632026a30, void(*)(char * *) pCallee=0x00007ff90fe38290, ...) Zeile 322
cppu\source\uno\envstack.cxx (322)
	cppu3.dll!defenv_revokeInterface(_uno_ExtEnvironment * pEnv=0x0000016632026a30, void * pInterface=0x0000016638e5a590) Zeile 427
cppu\source\uno\lbenv.cxx (427)
	mscx_uno.dll!bridges::cpp_uno::shared::releaseProxy(_uno_Interface * pUnoI=0x0000016638e5a590) Zeile 85
bridges\source\cpp_uno\shared\unointerfaceproxy.cxx (85)
	binaryurplo.dll!com::sun::star::uno::UnoInterfaceReference::~UnoInterfaceReference() Zeile 92
include\uno\dispatcher.hxx (92)
	binaryurplo.dll!binaryurp::Bridge::releaseStub(const rtl::OUString & oid={...}, const com::sun::star::uno::TypeDescription & type={...}) Zeile 512
binaryurp\source\bridge.cxx (512)
	binaryurplo.dll!binaryurp::IncomingRequest::execute_throw(binaryurp::BinaryAny * returnValue=0x00000007afe1f848, std::vector<binaryurp::BinaryAny,std::allocator<binaryurp::BinaryAny> > * outArguments=0x00000007afe1f938) Zeile 137
binaryurp\source\incomingrequest.cxx (137)
	binaryurplo.dll!binaryurp::IncomingRequest::execute() Zeile 73
binaryurp\source\incomingrequest.cxx (73)
	binaryurplo.dll!request(void * pThreadSpecificData=0x0000016639036f80) Zeile 83
binaryurp\source\reader.cxx (83)
	cppu3.dll!cppu_threadpool::JobQueue::enter(__int64 nDisposeId=1538527446432, bool bReturnWhenNoJob=true) Zeile 108
cppu\source\threadpool\jobqueue.cxx (108)
	cppu3.dll!cppu_threadpool::ORequestThread::run() Zeile 170
cppu\source\threadpool\thread.cxx (170)
	cppu3.dll!threadFunc(void * param=0x000001663761c5b0) Zeile 186
include\osl\thread.hxx (186)
	sal3.dll!oslWorkerWrapperFunction(void * pData=0x0000016637579860) Zeile 59
sal\osl\w32\thread.c (59)
	ucrtbase.dll!00007ff940d203ba()
	kernel32.dll!BaseThreadInitThunk()
	ntdll.dll!RtlUserThreadStart()

	
 ------------------------------------------------------------------------------

Other thread read


	swlo.dll!BigPtrArray::operator[](unsigned __int64 idx=0) Zeile 89
sw\source\core\bastyp\bparr.cxx (89)
	swlo.dll!SwNodes::operator[](unsigned __int64 n=0) Zeile 747
sw\inc\node.hxx (747)
	swlo.dll!SwNodeIndex::SwNodeIndex(SwNodes & rNds={...}, unsigned __int64 nIdx=0) Zeile 59
sw\inc\ndindex.hxx (59)
	swlo.dll!SwPaM::SwPaM(const SwNodeIndex & rNodeIdx={...}, long nContent=0, SwPaM * pRing=0x0000000000000000) Zeile 429
sw\source\core\crsr\pam.cxx (429)
	swlo.dll!SwUnoInternalPaM::SwUnoInternalPaM(SwDoc & rDoc={...}) Zeile 113
sw\source\core\unocore\unoobj.cxx (113)
	swlo.dll!SwXBodyText::createTextCursorByRange(const com::sun::star::uno::Reference<com::sun::star::text::XTextRange> & xTextPosition={...}) Zeile 2521
sw\source\core\unocore\unotext.cxx (2521)
	mscx_uno.dll!`anonymous namespace'::cpp_call(bridges::cpp_uno::shared::UnoInterfaceProxy * pThis=0x0000016638e44d30, bridges::cpp_uno::shared::VtableSlot aVtableSlot={...}, _typelib_TypeDescriptionReference * pReturnTypeRef=0x0000016632284fc0, long nParams=1, _typelib_MethodParameter * pParams=0x0000016631c6e3f0, void * pUnoReturn=0x0000016638fc74b0, void * * pUnoArgs=0x0000016638fc74d0, _uno_Any * * ppUnoExc=0x00000007b377f358) Zeile 214
bridges\source\cpp_uno\msvc_win32_x86-64\uno2cpp.cxx (214)
	mscx_uno.dll!bridges::cpp_uno::shared::unoInterfaceProxyDispatch(_uno_Interface * pUnoI=0x0000016638e44d30, const _typelib_TypeDescription * pMemberTD=0x00000166321078a0, void * pReturn=0x0000016638fc74b0, void * * pArgs=0x0000016638fc74d0, _uno_Any * * ppException=0x00000007b377f358) Zeile 429
bridges\source\cpp_uno\msvc_win32_x86-64\uno2cpp.cxx (429)
	binaryurplo.dll!binaryurp::IncomingRequest::execute_throw(binaryurp::BinaryAny * returnValue=0x00000007b377f6a8, std::vector<binaryurp::BinaryAny,std::allocator<binaryurp::BinaryAny> > * outArguments=0x00000007b377f798) Zeile 242
binaryurp\source\incomingrequest.cxx (242)
	binaryurplo.dll!binaryurp::IncomingRequest::execute() Zeile 73
binaryurp\source\incomingrequest.cxx (73)
	binaryurplo.dll!request(void * pThreadSpecificData=0x0000016639036dc0) Zeile 83
binaryurp\source\reader.cxx (83)
	cppu3.dll!cppu_threadpool::JobQueue::enter(__int64 nDisposeId=1538527448672, bool bReturnWhenNoJob=true) Zeile 108
cppu\source\threadpool\jobqueue.cxx (108)
	cppu3.dll!cppu_threadpool::ORequestThread::run() Zeile 170
cppu\source\threadpool\thread.cxx (170)
	cppu3.dll!threadFunc(void * param=0x000001663761ce70) Zeile 186
include\osl\thread.hxx (186)
	sal3.dll!oslWorkerWrapperFunction(void * pData=0x00000166375798c0) Zeile 59
sal\osl\w32\thread.c (59)
	ucrtbase.dll!00007ff940d203ba()
	kernel32.dll!BaseThreadInitThunk()
	ntdll.dll!RtlUserThreadStart()
Comment 3 Juergen Funk (CIB) 2019-02-14 07:17:54 UTC
Stack-Traces with distro/lhm/libreoffice-5-2+all 8c5b5941228bb9a9a0107b1aa8cf9928e2054505
wollmux 18.04 without LDAP (local wollmux-config)

 
Break through unhandle exception, second
-----------------------------------------


This thread delete

	cppu3.dll!std::_List_val<std::_List_simple_types<cppu_threadpool::Job> >::_Prevnode(std::_List_node<cppu_threadpool::Job,void *> * _Pnode=0x000001b93838f2f0) Line 541
c:\program files (x86)\microsoft visual studio 14.0\vc\include\list(541)
	cppu3.dll!std::_List_alloc<std::_List_base_types<cppu_threadpool::Job,std::allocator<cppu_threadpool::Job> > >::_Prevnode(std::_List_node<cppu_threadpool::Job,void *> * _Pnode=0x000001b93838f2f0) Line 592
c:\program files (x86)\microsoft visual studio 14.0\vc\include\list(592)
	cppu3.dll!std::_List_buy<cppu_threadpool::Job,std::allocator<cppu_threadpool::Job> >::_Freenode(std::_List_node<cppu_threadpool::Job,void *> * _Pnode=0x000001b93838f2f0) Line 851
c:\program files (x86)\microsoft visual studio 14.0\vc\include\list(851)
	cppu3.dll!std::list<cppu_threadpool::Job,std::allocator<cppu_threadpool::Job> >::erase(std::_List_const_iterator<std::_List_val<std::_List_simple_types<cppu_threadpool::Job> > > _Where={...}) Line 1469
c:\program files (x86)\microsoft visual studio 14.0\vc\include\list(1469)
	cppu3.dll!std::list<cppu_threadpool::Job,std::allocator<cppu_threadpool::Job> >::pop_front() Line 1289
c:\program files (x86)\microsoft visual studio 14.0\vc\include\list(1289)
	cppu3.dll!cppu_threadpool::JobQueue::enter(__int64 nDisposeId=1895025159424, bool bReturnWhenNoJob=true) Line 99
cppu\source\threadpool\jobqueue.cxx(99)
	cppu3.dll!cppu_threadpool::ORequestThread::run() Line 170
cppu\source\threadpool\thread.cxx(170)
	cppu3.dll!threadFunc(void * param=0x000001b9384d2d10) Line 186
include\osl\thread.hxx(186)
	sal3.dll!oslWorkerWrapperFunction(void * pData=0x000001b938539270) Line 59
sal\osl\w32\thread.c(59)
	ucrtbase.dll!thread_start<unsigned int (__cdecl*)(void * __ptr64)>()
	kernel32.dll!BaseThreadInitThunk()
	ntdll.dll!RtlUserThreadStart()


 ------------------------------------------------------------------------------

Other thread read

	swlo.dll!sw::Ring<SwNodeIndex>::Ring_node_traits::set_next(sw::Ring<SwNodeIndex> * n=0x0072006f00730003, sw::Ring<SwNodeIndex> * next=0x000000105db0e788) Line 108
sw\inc\ring.hxx(108)
	swlo.dll!boost::intrusive::circular_list_algorithms<sw::Ring<SwNodeIndex>::Ring_node_traits>::link_before(sw::Ring<SwNodeIndex> * const & nxt_node=0x000001b930f4d330, sw::Ring<SwNodeIndex> * const & this_node=0x000000105db0e788) Line 183
workdir\unpackedtarball\boost\boost\intrusive\circular_list_algorithms.hpp(183)
	swlo.dll!sw::Ring<SwNodeIndex>::MoveTo(SwNodeIndex * pDestRing=0x000001b930f4d330) Line 145
sw\inc\ring.hxx(145)
	swlo.dll!SwNodeIndex::RegisterIndex(SwNodes & rNodes={...}) Line 47
sw\inc\ndindex.hxx(47)
	swlo.dll!SwNodeIndex::SwNodeIndex(const SwNodeIndex & rIdx={...}, long nDiff=0) Line 70
sw\inc\ndindex.hxx(70)
	swlo.dll!SwPosition::SwPosition(const SwNodeIndex & rNodeIndex={...}) Line 58
sw\source\core\crsr\pam.cxx(58)
	swlo.dll!SwPaM::SwPaM(const SwNodeIndex & rNodeIdx={...}, long nContent=0, SwPaM * pRing=0x0000000000000000) Line 428
sw\source\core\crsr\pam.cxx(428)
	swlo.dll!SwUnoInternalPaM::SwUnoInternalPaM(SwDoc & rDoc={...}) Line 113
sw\source\core\unocore\unoobj.cxx(113)
	swlo.dll!SwXTextFrame::createTextCursorByRange(const com::sun::star::uno::Reference<com::sun::star::text::XTextRange> & aTextPosition={...}) Line 3272
sw\source\core\unocore\unoframe.cxx(3272)
	mscx_uno.dll!`anonymous namespace'::cpp_call(bridges::cpp_uno::shared::UnoInterfaceProxy * pThis=0x000001b93884f580, bridges::cpp_uno::shared::VtableSlot aVtableSlot={...}, _typelib_TypeDescriptionReference * pReturnTypeRef=0x000001b930a6a980, long nParams=1, _typelib_MethodParameter * pParams=0x000001b9385249d0, void * pUnoReturn=0x000001b9383f27f0, void * * pUnoArgs=0x000001b9383f29b0, _uno_Any * * ppUnoExc=0x000000105db0f098) Line 214
bridges\source\cpp_uno\msvc_win32_x86-64\uno2cpp.cxx(214)
	mscx_uno.dll!bridges::cpp_uno::shared::unoInterfaceProxyDispatch(_uno_Interface * pUnoI=0x000001b93884f580, const _typelib_TypeDescription * pMemberTD=0x000001b9384542f0, void * pReturn=0x000001b9383f27f0, void * * pArgs=0x000001b9383f29b0, _uno_Any * * ppException=0x000000105db0f098) Line 429
bridges\source\cpp_uno\msvc_win32_x86-64\uno2cpp.cxx(429)
	binaryurplo.dll!binaryurp::IncomingRequest::execute_throw(binaryurp::BinaryAny * returnValue=0x000000105db0f3e8, std::vector<binaryurp::BinaryAny,std::allocator<binaryurp::BinaryAny> > * outArguments=0x000000105db0f4d8) Line 242
binaryurp\source\incomingrequest.cxx(242)
	binaryurplo.dll!binaryurp::IncomingRequest::execute() Line 73
binaryurp\source\incomingrequest.cxx(73)
	binaryurplo.dll!request(void * pThreadSpecificData=0x000001b936702830) Line 83
binaryurp\source\reader.cxx(83)
	cppu3.dll!cppu_threadpool::JobQueue::enter(__int64 nDisposeId=1895022705072, bool bReturnWhenNoJob=true) Line 108
cppu\source\threadpool\jobqueue.cxx(108)
	cppu3.dll!cppu_threadpool::ORequestThread::run() Line 170
cppu\source\threadpool\thread.cxx(170)
	cppu3.dll!threadFunc(void * param=0x000001b93827b9c0) Line 186
include\osl\thread.hxx(186)
	sal3.dll!oslWorkerWrapperFunction(void * pData=0x000001b93855b430) Line 59
sal\osl\w32\thread.c(59)
	ucrtbase.dll!thread_start<unsigned int (__cdecl*)(void * __ptr64)>()
	kernel32.dll!BaseThreadInitThunk()
	ntdll.dll!RtlUserThreadStart()
Comment 4 Thorsten Behrens (allotropia) 2019-02-14 08:36:43 UTC
Confirm.
Comment 5 Juergen Funk (CIB) 2019-02-21 09:50:09 UTC
The problem is that the Wollmux requests the various functions which are then no longer available.

The solution is wollmux must be handle the close-listener
Comment 6 Jan-Marek Glogowski 2019-02-21 21:23:39 UTC
(In reply to Juergen Funk (CIB) from comment #5)
> The problem is that the Wollmux requests the various functions which are
> then no longer available.
> 
> The solution is wollmux must be handle the close-listener

Yup - this should fix the problem (with a kind of "workaround" - it'S not really one, but I don't have a better name).

Still you shouldn't be able to crash LO from WollMux via UNO. This should just create some kind of UNO exception. Something in LO doesn't correctly check, if the document is still alive and kicking. Maybe the UNO bridge should hold a reference to something or take the SolarMutex at some point; I don't know. IMHO it's not a NOTOURBUG, as noone should be able to crash LO via RPC.

Regarding _purecall(void);

This function is called if a pure virtual method() is called within the constructor or destructor of an abstract class as part of the construction/destruction of a concrete derived class. (This is a big no-no in C++. Nonetheless, it is refreshing to see that the implementers of Visual SourceSafe are as human as the rest of us, since it regularly crashes with pure-call termination.)

Nothing in your first stack looks like there is some construction involved; it smells like a memory corruption.

I won't work on this so I won't reopen it, but the chosen resolution just handles part of the problem by avoiding it.