Bug 133053 - Crash in: x11::SelectionManager::handleDragEvent
Summary: Crash in: x11::SelectionManager::handleDragEvent
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
6.3.0.0.alpha0+
Hardware: x86-64 (AMD64) Linux (All)
: medium normal
Assignee: Caolán McNamara
URL:
Whiteboard: target:7.0.0 target:6.4.5
Keywords: bibisected, bisected, regression
: 133580 (view as bug list)
Depends on:
Blocks:
 
Reported: 2020-05-15 07:06 UTC by Bjorn
Modified: 2020-06-01 14:00 UTC (History)
5 users (show)

See Also:
Crash report or crash signature: ["x11::SelectionManager::handleDragEvent"]


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Bjorn 2020-05-15 07:06:17 UTC
This bug was filed from the crash reporting server and is br-3a40c44b-e78b-4e45-9990-a3c345f6236b.
=========================================

This bug can be reproduced with an empty Calc file.

Open a new file.
Select an area, for example: A1:D10.
Drag the area to another location.
While dragging (i.e. left mouse button still down), press the escape key.
Comment 1 Xisco Faulí 2020-05-15 08:24:41 UTC
Reproduced in

Version: 7.0.0.0.alpha1+
Build ID: 56d381c3deb213a40c54ce6e194f79f0334b5d7b
CPU threads: 4; OS: Linux 4.19; UI render: default; VCL: x11; 
Locale: en-US (en_US.UTF-8); UI: en-US
Calc: threaded

nice catch!
Comment 2 Julien Nabet 2020-05-15 08:26:14 UTC
On pc Debian x86-64 with master sources updated today, I could reproduce this with gen rendering

#26 0x00007f2b94be955b in __GI_abort () at abort.c:79
#27 0x00007f2b94be942f in __assert_fail_base (fmt=0x7f2b94d4fb48 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x7f2b82fc5722 "pT", file=0x7f2b82fc5725 "/home/julien/lo/libreoffice/include/osl/mutex.hxx", line=189, function=<optimized out>) at assert.c:92
#28 0x00007f2b94bf8092 in __GI___assert_fail (assertion=0x7f2b82fc5722 "pT", file=0x7f2b82fc5725 "/home/julien/lo/libreoffice/include/osl/mutex.hxx", line=189, function=0x7f2b82fc5757 "void osl::ClearableGuard<osl::Mutex>::clear() [T = osl::Mutex]") at assert.c:101
#29 0x00007f2b82ef1e62 in osl::ClearableGuard<osl::Mutex>::clear() (this=0x7f2b80771f40) at include/osl/mutex.hxx:189
#30 0x00007f2b82f136f5 in x11::SelectionManager::handleDragEvent(_XEvent const&) (this=0x4b388c0, rMessage=...) at vcl/unx/generic/dtrans/X11_selection.cxx:2770
#31 0x00007f2b82f0b1ea in x11::SelectionManager::handleXEvent(_XEvent&) (this=0x4b388c0, rEvent=...) at vcl/unx/generic/dtrans/X11_selection.cxx:3705
#32 0x00007f2b82f17788 in x11::SelectionManager::dispatchEvent(int) (this=0x4b388c0, millisec=-1) at vcl/unx/generic/dtrans/X11_selection.cxx:3748
#33 0x00007f2b82f179a5 in x11::SelectionManager::run(void*) (pThis=0x4b388c0) at vcl/unx/generic/dtrans/X11_selection.cxx:3776

I don't reproduce this with gtk3 rendering.

On Win10 with master sources updated today, I don't reproduce this too.
Comment 3 Julien Nabet 2020-05-15 08:28:18 UTC
Caolán: since it concerns vcl, thought you might be interested in this one.
Comment 4 Xisco Faulí 2020-05-15 08:31:23 UTC
Not sure it's a regression but it started to happen after

https://cgit.freedesktop.org/libreoffice/core/commit/?id=d38f9934f08939032cca64a32de58fa3901a88d5

author	Mike Kaganski <mike.kaganski@collabora.com>	2019-04-07 15:29:35 +0100
committer	Mike Kaganski <mike.kaganski@collabora.com>	2019-04-09 21:34:07 +0200
commit d38f9934f08939032cca64a32de58fa3901a88d5 (patch)
tree e853e4ad432ec1c8eb08bb4d430835682cda6b90
parent c1e320836b7dbcd9fe6ded8352355ea6101bd821 (diff)
[API CHANGE] Asserts to never clear already cleared guard

Bisected with: bibisect-linux64-6.3

Adding Cc: to Mike Kaganski
Comment 5 Mike Kaganski 2020-05-15 09:01:32 UTC
(In reply to Xisco Faulí from comment #4)

From the call stack in [1], I can't see how clear() could ever be called in SelectionManager::dispatchEvent [2] twice in a row without being reset in the middle.

[1] https://crashreport.libreoffice.org/stats/crash_details/3a40c44b-e78b-4e45-9990-a3c345f6236b
[2] https://git.libreoffice.org/core/+/master/vcl/unx/generic/dtrans/X11_selection.cxx#3713
Comment 6 Caolán McNamara 2020-05-15 09:29:24 UTC
I can reproduce and https://gerrit.libreoffice.org/c/core/+/94265 seems sufficient to make it stop
Comment 7 Commit Notification 2020-05-15 11:13:53 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/773b8e3cc1340e6f5bfc364f0705344b744edd8d

tdf#133053 reset after clear so avoid later assert

It will be available in 7.0.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 8 Julien Nabet 2020-05-15 11:23:36 UTC
Very quick! I've updated my local repo and it works now!
Thank you Caolán!
Comment 9 Caolán McNamara 2020-05-15 11:24:47 UTC
seems to work in master, backported to 6-4. There might be other cases but I didn't really investigate cause I think this stuff is now linux+gen only code
Comment 10 Commit Notification 2020-05-19 07:53:52 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-6-4":

https://git.libreoffice.org/core/commit/206ccbad07b459fa93db5c783d6b65eef60f7629

tdf#133053 reset after clear so avoid later assert

It will be available in 6.4.5.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 11 Xisco Faulí 2020-05-19 18:36:19 UTC
Verified in

Version: 7.0.0.0.alpha1+
Build ID: 8209c2569f5726f9ed29f75d30efdccb94f98fe5
CPU threads: 4; OS: Linux 4.19; UI render: default; VCL: x11; 
Locale: en-US (en_US.UTF-8); UI: en-US
Calc: threaded

@Caolán, thanks for fixing this issue!!
Comment 12 Xisco Faulí 2020-06-01 14:00:39 UTC
*** Bug 133580 has been marked as a duplicate of this bug. ***