Bug 127205 - Crash when terminating the StarDesktop from running a document macro
Summary: Crash when terminating the StarDesktop from running a document macro
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: BASIC (show other bugs)
Version:
(earliest affected)
Inherited From OOo
Hardware: All All
: medium normal
Assignee: Jan-Marek Glogowski
URL:
Whiteboard: target:7.0.0
Keywords:
: 106294 (view as bug list)
Depends on:
Blocks:
 
Reported: 2019-08-28 15:55 UTC by Jan-Marek Glogowski
Modified: 2020-07-02 08:46 UTC (History)
4 users (show)

See Also:
Crash report or crash signature: ["SbxValue::Put(SbxValues%20const%20&)"]


Attachments
Crashes LO on load, if macros are enabled! (9.24 KB, application/vnd.oasis.opendocument.text)
2019-08-28 16:00 UTC, Jan-Marek Glogowski
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Jan-Marek Glogowski 2019-08-28 15:55:47 UTC
Description:
This is basically a variant of bug 115090. But instead of closing the running document, this closes LO. Eventually the same happens when calling XDesktop::terminate() from an extension, but I didn't yet test that.

Interesting, but unrelated fact: if you have a modified document when opening the crash document, this will trigger the veto handling and LO doesn't crash, if you abort the shutdown / terminate. So everything else seem to work as expected.

I also found https://ask.libreoffice.org/en/question/175943/stardesktopterminate-does-not-terminateclose-libre-office/, which suggest that probably adding a "wait" will prevent the crash, but even if that works, it is just a workaround.

Some times an older LO version won't show the recovery dialog on crash, but just on the next start. Some times you don't get any recovery dialog, but dmesg shows a crash like

[25671.427177] soffice.bin[12655]: segfault at 0 ip 0000000000000000 sp 00007ffd9e2fcdf8 error 14 in soffice.bin[400000+1000]

Steps to Reproduce:
1. Open the attached document and click ok from the message box.


Actual Results:
LO crashes.

Expected Results:
LO should just exit without a crash.


Reproducible: Always


User Profile Reset: No



Additional Info:
Tested with OOo 3.3.0 and various releases in between (bibisect releases) and LO master (6.4).
Comment 1 Jan-Marek Glogowski 2019-08-28 16:00:29 UTC
Created attachment 153714 [details]
Crashes LO on load, if macros are enabled!

The whole macro code is:

Sub Main
    MsgBox "Lets close LO"
    StarDesktop.terminate
End Sub

Resulting backtrace:

Thread 1 "soffice.bin" received signal SIGSEGV, Segmentation fault.
0x00007ffff6ca4055 in SbxValue::Put (this=this@entry=0x55555bfd2240, rVal=...) at /home/jmg/Development/libreoffice/symbols/basic/source/sbx/sbxvalue.cxx:415
415         ErrCode eOld = GetError();
(gdb) bt
#0  0x00007ffff6ca4055 in SbxValue::Put (this=this@entry=0x55555bfd2240, rVal=...) at /home/jmg/Development/libreoffice/symbols/basic/source/sbx/sbxvalue.cxx:415
#1  0x00007ffff6ca5656 in SbxValue::PutBool (this=this@entry=0x55555bfd2240, b=<optimized out>) at /home/jmg/Development/libreoffice/symbols/basic/source/sbx/sbxvalue.cxx:571
#2  0x00007ffff6be99e9 in unoToSbxValue (pVar=pVar@entry=0x55555bfd2240, aValue=...) at /home/jmg/Development/libreoffice/symbols/basic/source/classes/sbunoobj.cxx:793
#3  0x00007ffff6bf2fee in SbUnoObject::Notify (this=<optimized out>, rBC=..., rHint=...) at /home/jmg/Development/libreoffice/symbols/basic/source/classes/sbunoobj.cxx:2228
#4  0x00007ffff6320205 in SfxBroadcaster::Broadcast (this=this@entry=0x55555bfd7ac0, rHint=...) at /home/jmg/Development/libreoffice/symbols/svl/source/notify/SfxBroadcaster.cxx:49
#5  0x00007ffff6ca7485 in SbxVariable::Broadcast (this=0x55555bfd2240, nHintId=<optimized out>) at /home/jmg/Development/libreoffice/symbols/basic/source/sbx/sbxvar.cxx:183
#6  0x00007ffff6ca29f2 in SbxValue::SbxValue (this=0x55555bfd2330, __vtt_parm=0x7ffff6d37ee0 <VTT for SbxMethod+16>, r=..., __in_chrg=<optimized out>)
    at /home/jmg/Development/libreoffice/symbols/basic/source/sbx/sbxvalue.cxx:64
#7  0x00007ffff6ca7773 in SbxVariable::SbxVariable (this=0x55555bfd2330, __vtt_parm=0x7ffff6d37ed8 <VTT for SbxMethod+8>, r=..., __in_chrg=<optimized out>)
    at /home/jmg/Development/libreoffice/symbols/basic/source/sbx/sbxvar.cxx:69
#8  0x00007ffff6c9bd48 in SbxMethod::SbxMethod (this=0x55555bfd2330, r=..., __in_chrg=<optimized out>, __vtt_parm=<optimized out>) at /home/jmg/Development/libreoffice/symbols/basic/source/sbx/sbxobj.cxx:840
#9  0x00007ffff6c640db in SbiRuntime::FindElement (this=this@entry=0x55555bfc6070, pObj=<optimized out>, nOp1=<optimized out>, nOp1@entry=5, nOp2=nOp2@entry=12, nNotFound=..., nNotFound@entry=..., 
    bLocal=bLocal@entry=false, bStatic=false) at /home/jmg/Development/libreoffice/symbols/basic/source/runtime/runtime.cxx:3506
#10 0x00007ffff6c64ccd in SbiRuntime::StepELEM (this=<optimized out>, nOp1=5, nOp2=12) at /home/jmg/Development/libreoffice/symbols/basic/source/runtime/runtime.cxx:3981
#11 0x00007ffff6c5aef1 in SbiRuntime::Step (this=this@entry=0x55555bfc6070) at /home/jmg/Development/libreoffice/symbols/basic/source/runtime/runtime.cxx:777
#12 0x00007ffff6c089e8 in SbModule::Run (this=this@entry=0x55555a512760, pMeth=pMeth@entry=0x55555bfc7250) at /home/jmg/Development/libreoffice/symbols/basic/source/classes/sbxmod.cxx:1110
#13 0x00007ffff6c0962c in SbModule::Notify (this=0x55555a512760, rBC=..., rHint=...) at /home/jmg/Development/libreoffice/symbols/basic/source/classes/sbxmod.cxx:776
#14 0x00007ffff6320205 in SfxBroadcaster::Broadcast (this=this@entry=0x55555c023670, rHint=...) at /home/jmg/Development/libreoffice/symbols/svl/source/notify/SfxBroadcaster.cxx:49
#15 0x00007ffff6c049a4 in SbMethod::Broadcast (this=0x55555c036920, nHintId=<optimized out>) at /home/jmg/Development/libreoffice/symbols/basic/source/classes/sbxmod.cxx:2070
#16 0x00007ffff6ca300e in SbxValue::Get (this=this@entry=0x55555c036920, rRes=...) at /home/jmg/Development/libreoffice/symbols/basic/source/sbx/sbxvalue.cxx:286
#17 0x00007ffff6c021a8 in SbMethod::Call (this=0x55555c036920, pRet=pRet@entry=0x55555bfc71c0, pCaller=pCaller@entry=0x0) at /home/jmg/Development/libreoffice/symbols/basic/source/classes/sbxmod.cxx:2026
#18 0x00007fffd8d3ed9c in basprov::BasicScriptImpl::invoke (this=0x55555c04c840, aParams=..., aOutParamIndex=..., aOutParam=...)
    at /home/jmg/Development/libreoffice/symbols/scripting/source/basprov/basscript.cxx:234
#19 0x00007fffddf8dec8 in scripting_protocolhandler::ScriptProtocolHandler::dispatchWithNotification (this=0x55555a4e6a20, aURL=..., lArgs=..., xListener=...)
    at /home/jmg/Development/libreoffice/symbols/scripting/source/protocolhandler/scripthandler.cxx:215
#20 0x00007fffddf8b989 in scripting_protocolhandler::ScriptProtocolHandler::dispatch (this=<optimized out>, aURL=..., lArgs=...)
    at /home/jmg/Development/libreoffice/symbols/scripting/source/protocolhandler/scripthandler.cxx:299
#21 0x00007ffff685c38c in SfxEvents_Impl::Execute (aEventData=..., aTrigger=..., pDoc=<optimized out>, pDoc@entry=0x555559fe7910)
    at /home/jmg/Development/libreoffice/symbols/sfx2/source/notify/eventsupplier.cxx:267
#22 0x00007ffff685d0c9 in SfxEvents_Impl::notifyEvent (this=<optimized out>, aEvent=...) at /home/jmg/Development/libreoffice/symbols/sfx2/source/notify/eventsupplier.cxx:292
#23 0x00007ffff681db09 in (anonymous namespace)::NotifySingleListenerIgnoreRE<com::sun::star::document::XEventListener, com::sun::star::document::EventObject>::operator() (
    listener=<error reading variable: Dwarf Error: Cannot find DIE at 0x0 referenced in module /home/jmg/Development/libreoffice/symbols/instdir/program/libsfxlo.so>, this=<optimized out>)
    at /home/jmg/Development/libreoffice/symbols/sfx2/source/doc/sfxbasemodel.cxx:3097
#24 cppu::OInterfaceContainerHelper::forEach<com::sun::star::document::XEventListener, (anonymous namespace)::NotifySingleListenerIgnoreRE<com::sun::star::document::XEventListener, com::sun::star::document::EventObject> > (func=..., this=<optimized out>) at /home/jmg/Development/libreoffice/symbols/include/cppuhelper/interfacecontainer.h:288
#25 SfxBaseModel::postEvent_Impl (this=this@entry=0x55555a1e6a50, aName=..., xController=...) at /home/jmg/Development/libreoffice/symbols/sfx2/source/doc/sfxbasemodel.cxx:3144
#26 0x00007ffff681dec2 in SfxBaseModel::Notify (this=0x55555a1e6a50, rBC=..., rHint=...) at /home/jmg/Development/libreoffice/symbols/sfx2/source/doc/sfxbasemodel.cxx:2780
#27 0x00007ffff6320205 in SfxBroadcaster::Broadcast (this=this@entry=0x555559fe7910, rHint=...) at /home/jmg/Development/libreoffice/symbols/svl/source/notify/SfxBroadcaster.cxx:49
#28 0x00007ffff659bbdd in SfxEventAsyncer_Impl::IdleHdl (this=0x55555bf321b0, pAsyncIdle=<optimized out>) at /home/jmg/Development/libreoffice/symbols/sfx2/source/appl/appcfg.cxx:123
#29 0x00007ffff416c3be in Scheduler::ProcessTaskScheduling () at /home/jmg/Development/libreoffice/symbols/vcl/source/app/scheduler.cxx:480
#30 0x00007fffea50ba5a in SalTimer::CallCallback (this=0x5555568e7560) at /home/jmg/Development/libreoffice/symbols/vcl/inc/saltimer.hxx:54
#31 Qt5Timer::timeoutActivated (this=0x5555568e7550) at /home/jmg/Development/libreoffice/symbols/vcl/qt5/Qt5Timer.cxx:41
#32 0x00007fffea50bb55 in Qt5Timer::qt_static_metacall (_o=<optimized out>, _id=<optimized out>, _a=<optimized out>, _c=<optimized out>)
    at /home/jmg/Development/libreoffice/symbols/workdir/CustomTarget/vcl/qt5/Qt5Timer.moc:90
#33 0x00007fffeb5a7906 in QMetaObject::activate(QObject*, int, int, void**) () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#34 0x00007fffeb5b34b7 in QTimer::timeout(QTimer::QPrivateSignal) () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#35 0x00007fffeb5a813b in QObject::event(QEvent*) () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#36 0x00007fffea8914b1 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /lib/x86_64-linux-gnu/libQt5Widgets.so.5
#37 0x00007fffea898950 in QApplication::notify(QObject*, QEvent*) () from /lib/x86_64-linux-gnu/libQt5Widgets.so.5
#38 0x00007fffeb57e5a9 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#39 0x00007fffeb5cec78 in QTimerInfoList::activateTimers() () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#40 0x00007fffeb5cf4d4 in ?? () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#41 0x00007fffeeafef2e in g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#42 0x00007fffeeaff1c8 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#43 0x00007fffeeaff25c in g_main_context_iteration () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#44 0x00007fffeb5cf8e4 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /lib/x86_64-linux-gnu/libQt5Core.so.5
#45 0x00007fffe89383e1 in ?? () from /lib/x86_64-linux-gnu/libQt5XcbQpa.so.5
#46 0x00007fffea502ae3 in Qt5Instance::ImplYield (this=this@entry=0x5555556ec770, bWait=bWait@entry=true, bHandleAllCurrentEvents=bHandleAllCurrentEvents@entry=false)
    at /home/jmg/Development/libreoffice/symbols/vcl/qt5/Qt5Instance.cxx:354
#47 0x00007fffea502cd6 in Qt5Instance::DoYield (this=0x5555556ec770, bWait=<optimized out>, bHandleAllCurrentEvents=<optimized out>) at /home/jmg/Development/libreoffice/symbols/vcl/qt5/Qt5Instance.cxx:365
#48 0x00007ffff417bf72 in ImplYield (i_bWait=i_bWait@entry=true, i_bAllEvents=i_bAllEvents@entry=false) at /home/jmg/Development/libreoffice/symbols/vcl/source/app/svapp.cxx:447
#49 0x00007ffff417c65c in Application::Yield () at /home/jmg/Development/libreoffice/symbols/vcl/source/app/svapp.cxx:511
#50 0x00007ffff417df85 in Application::Execute () at /home/jmg/Development/libreoffice/symbols/vcl/source/app/svapp.cxx:428
#51 0x00007ffff7e7e514 in desktop::Desktop::Main (this=0x7fffffff2160) at /home/jmg/Development/libreoffice/symbols/desktop/source/app/app.cxx:1620
#52 0x00007ffff41855c6 in ImplSVMain () at /home/jmg/Development/libreoffice/symbols/vcl/source/app/svmain.cxx:191
#53 0x00007ffff4185745 in SVMain () at /home/jmg/Development/libreoffice/symbols/vcl/source/app/svmain.cxx:225
#54 0x00007ffff7eaf4ed in soffice_main () at /home/jmg/Development/libreoffice/symbols/desktop/source/app/sofficemain.cxx:170
#55 0x000055555555477b in sal_main () at /home/jmg/Development/libreoffice/symbols/desktop/source/app/main.c:48
#56 main (argc=<optimized out>, argv=<optimized out>) at /home/jmg/Development/libreoffice/symbols/desktop/source/app/main.c:47
Comment 2 Michael Weghorn 2019-08-28 16:48:56 UTC
Confirmed with

Version: 6.4.0.0.alpha0+
Build ID: 5c50f1a2d4487b9303974c7cf39d6208192a0c96
CPU threads: 4; OS: Linux 5.2; UI render: default; VCL: kf5; 
Locale: en-GB (en_GB.UTF-8); UI-Language: en-US
Calc: threaded
Comment 3 Oliver Brinzing 2019-08-28 18:16:54 UTC
reproducible with:

Version: 6.3.1.1 (x64)
Build ID: e979878b49a48dab15ebe528f238b88125e32c65
CPU threads: 4; OS: Windows 10.0; UI render: default; VCL: win; 
Locale: de-DE (de_DE); UI-Language: en-US
Calc:
Comment 4 Commit Notification 2020-02-22 08:15:22 UTC
Jan-Marek Glogowski committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/f0a50d230756fc0a60780d992b807f9eb82106c2

tdf#127205 split Desktop::terminate process

It will be available in 7.0.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 5 Xisco Faulí 2020-02-24 11:07:31 UTC
Verified in

Version: 7.0.0.0.alpha0+
Build ID: f32a59a52e3ee2a0a8df9bb76bc1ff0ada7c7f1d
CPU threads: 4; OS: Linux 4.19; UI render: default; VCL: gtk3; 
Locale: en-US (en_US.UTF-8); UI-Language: en-US
Calc: threaded

@Jan-marek, thanks for fixing this issue!
Comment 6 Xisco Faulí 2020-02-24 11:09:03 UTC
@Jan-marek, do you plan to backport it to 6-4 branch or do you prefer to wait for 7.0 and have a better testing on it ?
Comment 7 Jan-Marek Glogowski 2020-02-24 13:31:42 UTC
Not sure about the backport. This is tricky stuff, and I had my amount of broken unit tests while working on it. Maybe backport this later, if we remember, and all the platforms don't report failures.
Comment 8 Commit Notification 2020-03-17 13:06:01 UTC
Jan-Marek Glogowski committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/908b0deb84c4a09c5afdcf70ef407382a6e4d7b2

tdf#127205 call shutdown in terminate, if not exec

It will be available in 7.0.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 9 Justin L 2020-07-02 08:46:46 UTC
*** Bug 106294 has been marked as a duplicate of this bug. ***