Bug 131956 - Crash on file reload after file recovery ( steps in comment 9 )
Summary: Crash on file reload after file recovery ( steps in comment 9 )
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
6.3.0.1 rc
Hardware: All All
: medium normal
Assignee: Caolán McNamara
URL:
Whiteboard: target:7.0.0 target:6.4.5 target:6.4.4
Keywords: bibisected, bisected, regression
Depends on:
Blocks:
 
Reported: 2020-04-07 12:29 UTC by Telesto
Modified: 2020-05-12 15:08 UTC (History)
3 users (show)

See Also:
Crash report or crash signature: [mergedlo.dll]


Attachments
Bibisect log (2.75 KB, text/plain)
2020-05-01 20:48 UTC, Telesto
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Telesto 2020-04-07 12:29:54 UTC
Description:
Crash on file reload after file recovery

Steps to Reproduce:
A way to crash Libreoffice 
1. Open attachment 143995 [details] (bug  119126)
2. CTRL+A
3. CTRL+C
4. CTRL+V after the yellow marking
5. CTRL+Z -> Crash (once no RTTI, mostly normal)

6. Press OK when the crash notifier popups up
7. Restart LibreOffice if it not restarting by itself.. There might be a hanging process blocking restart (see bug 131681) 

8. Start the file recovery & Press Finish
9. File -> Reload 
10. Cancel all changes -> Yes -> Crash

mergedlo!SvxRelativeField::set_value

Actual Results:
Crash

Expected Results:
No crash


Reproducible: Always


User Profile Reset: No



Additional Info:
Version: 7.0.0.0.alpha0+ (x64)
Build ID: 4501a0ba623ad61c5a4e0b807da2e96f0e4ce82c
CPU threads: 4; OS: Windows 6.3 Build 9600; UI render: Skia/Raster; VCL: win; 
Locale: nl-NL (nl_NL); UI-Language: en-US
Calc: CL
Comment 1 Dieter 2020-04-08 09:11:18 UTC
(In reply to Telesto from comment #0)

> 10. Cancel all changes -> Yes -> Crash

Not sure, how you did this step. I've closed document without saving changes => No crash

Version: 7.0.0.0.alpha0+ (x64)
Build ID: 1c9ced04189c9d23ffea05d5570960b54b05ef28
CPU threads: 4; OS: Windows 10.0 Build 18363; UI render: Skia/Raster; VCL: win; 
Locale: de-DE (de_DE); UI-Language: en-GB
Calc: CL
Comment 2 Telesto 2020-04-08 12:05:46 UTC
(In reply to Dieter from comment #1)
> (In reply to Telesto from comment #0)
> 
> > 10. Cancel all changes -> Yes -> Crash
> 
Thanks for testing.. Did you follow step 9?
9. File -> Reload
Comment 3 Dieter 2020-04-08 13:07:38 UTC
(In reply to Telesto from comment #2)

> Thanks for testing.. Did you follow step 9?
> 9. File -> Reload

I've overlooked it, indeed. Following this step, I could reproduce the crash
=> NEW

I've also tried with
Version: 6.3.5.2 (x64)
Build-ID: dd0751754f11728f69b42ee2af66670068624673
CPU-Threads: 4; BS: Windows 10.0; UI-Render: Standard; VCL: win; 
Gebietsschema: de-DE (de_DE); UI-Sprache: de-DE
Calc: threaded

but reload option was greyed out
=> possible Regression?
Comment 4 Telesto 2020-04-30 19:24:01 UTC
1. Open https://bugs.documentfoundation.org/attachment.cgi?id=156698 (tdf#129524)
2. Set design-mode of the form to "yes".
3. Mark the listfield and set Anchor > To Character. -> Crash
4. Recover the file
5. File reload -> Crash

Not with
Version: 5.4.0.2
Build ID: 2b906d450a44f2bbe506dcd22c51b3fa11dc65fd
CPU threads: 4; OS: Windows 6.2; UI render: default; 
Locale: nl-NL (nl_NL); Calc: CL
Comment 5 Telesto 2020-04-30 19:28:03 UTC
Not with
Versie: 6.1.6.3
Build ID: 5896ab1714085361c45cf540f76f60673dd96a72
CPU-threads: 4; Besturingssysteem: Windows 6.3; UI-render: GL; 
Locale: nl-NL (nl_NL); Calc: CL
Comment 6 Telesto 2020-05-01 20:48:39 UTC Comment hidden (obsolete)
Comment 7 Telesto 2020-05-01 20:49:28 UTC
Adding CC to Caolán McNamara
Comment 8 Caolán McNamara 2020-05-02 16:53:35 UTC
in master i don't get a crash after the reload, what panel is open in the sidebar for you when you use reload ? (or is the sidebar not visible?)
Comment 9 Telesto 2020-05-02 19:28:59 UTC
It surely crashes.. But the bibisect doesn't make much sense, seeing the BT
https://crashreport.libreoffice.org/stats/crash_details/c88e8ea2-c323-459f-a9f6-1213e17c2f26#allthreads

It surely crashes.. 
1. Open https://bugs.documentfoundation.org/attachment.cgi?id=156698 (tdf#129524)
2. Set design-mode of the form to "yes".
3. Mark the listfield and set Anchor > To Character. -> Crash
3. Press OK
4. At the document recovery, press Start
5. Press Finish
6. File reload -> Crash
Comment 10 Xisco Faulí 2020-05-04 08:32:09 UTC
(In reply to Telesto from comment #9)
> It surely crashes.. But the bibisect doesn't make much sense, seeing the BT
> https://crashreport.libreoffice.org/stats/crash_details/c88e8ea2-c323-459f-
> a9f6-1213e17c2f26#allthreads
> 
> It surely crashes.. 
> 1. Open https://bugs.documentfoundation.org/attachment.cgi?id=156698
> (tdf#129524)
> 2. Set design-mode of the form to "yes".
> 3. Mark the listfield and set Anchor > To Character. -> Crash
> 3. Press OK
> 4. At the document recovery, press Start
> 5. Press Finish
> 6. File reload -> Crash

No Crash in

Version: 7.0.0.0.alpha0+
Build ID: d8c77a54cebdbb60006aa2391ad75e9d6fd0444b
CPU threads: 4; OS: Linux 4.19; UI render: default; VCL: x11; 
Locale: en-US (en_US.UTF-8); UI-Language: en-US
Calc: threaded
Comment 11 Xisco Faulí 2020-05-04 08:38:26 UTC
However it crashes for me in

Version: 6.4.4.0.0+
Build ID: 4f8325dbcb63627997289889a377a4893e03fcf1
CPU threads: 4; OS: Linux 4.19; UI render: default; VCL: x11; 
Locale: en-US (en_US.UTF-8); UI-Language: en-US
Calc: threaded

so it might be indeed fixed in master, checking
Comment 12 Xisco Faulí 2020-05-04 08:55:20 UTC
Actually I can reproduce it in master if I clean first the profile and gen

rm -rf instdir/user/ && SAL_USE_VCLPLUGIN=gen instdir/program/swriter /home/xisco/Downloads/Formularfeld_in_Kopfzeile.odt
Comment 13 Xisco Faulí 2020-05-04 09:07:25 UTC
The bisection in comment 6 is wrong.
Regression introduced by:

https://cgit.freedesktop.org/libreoffice/core/commit/?id=a9eb7df678655bd71f062ba404b7d6b6f9cc18d4

author	Caolán McNamara <caolanm@redhat.com>	2019-02-21 11:04:33 +0000
committer	Caolán McNamara <caolanm@redhat.com>	2019-02-21 16:33:03 +0100
commit a9eb7df678655bd71f062ba404b7d6b6f9cc18d4 (patch)
tree 5ee99fab0ef7a242eac4b2b5b65d48d24c37c9a5
parent 47e03f30dc34371b9421a0179d047b85539a8494 (diff)
weld RecoveryDialog

Bisected with: bibisect-linux64-6.3
Comment 14 Caolán McNamara 2020-05-06 19:07:30 UTC
I can't reproduce this in my own builds, though I can see it in the bibisect-linux-64-6.3 repo. It must be the Progressbar passed in during recovery which presumably gets, somewhat unexpectedly, reused by reload
Comment 15 Caolán McNamara 2020-05-06 19:20:28 UTC
https://gerrit.libreoffice.org/c/core/+/93590 is my ~educated guess as to the problem
Comment 16 Xisco Faulí 2020-05-06 19:32:25 UTC
(In reply to Caolán McNamara from comment #15)
> https://gerrit.libreoffice.org/c/core/+/93590 is my ~educated guess as to
> the problem

Hi Caolán,
I can reproduce the problem in my local build and i do confirm your patch fixes the issue
Comment 17 Caolán McNamara 2020-05-06 20:16:33 UTC
excellent, variability of crashing might be timing related wrt load finished before progress bar needed or something like that
Comment 18 Commit Notification 2020-05-06 20:32:43 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/40bc11d4d6232c7acb94a3ae9efb5827f39eb64e

tdf#131956 dispose progressbar when its target is destroyed

It will be available in 7.0.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 19 Caolán McNamara 2020-05-07 08:13:21 UTC
fixed in master, backport to 6-4 in gerrit
Comment 21 Caolán McNamara 2020-05-07 15:57:38 UTC
(In reply to Xisco Faulí from comment #20)
> I do believe the patch might fix
> https://crashreport.libreoffice.org/stats/signature/svx::DocRecovery::
> PluginProgress::start(rtl::OUString%20const%20&,long)

that's very plausible
Comment 22 Commit Notification 2020-05-08 08:41:18 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-6-4":

https://git.libreoffice.org/core/commit/509c94f1a94d9a2faf835862c400cd78385a2549

tdf#131956 dispose progressbar when its target is destroyed

It will be available in 6.4.5.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 23 Xisco Faulí 2020-05-08 08:45:57 UTC
Verified in

Version: 7.0.0.0.alpha1+
Build ID: b6ad72a34c150df18905e47e588fd35c400dd6b9
CPU threads: 4; OS: Linux 4.19; UI render: default; VCL: x11; 
Locale: en-US (en_US.UTF-8); UI: en-US
Calc: threaded

@Caolán, thanks for fixing this issue!!
Comment 24 Commit Notification 2020-05-12 15:08:50 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-6-4-4":

https://git.libreoffice.org/core/commit/8a11c49299af5a8b5eda68ad535c0d45702e0919

tdf#131956 dispose progressbar when its target is destroyed

It will be available in 6.4.4.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.