Download it now!
Bug 134475 - Crash PolyPolygon
Summary: Crash PolyPolygon
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
7.1.0.0.alpha0+ Master
Hardware: All All
: high major
Assignee: Not Assigned
URL:
Whiteboard:
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks: Crash Regressions-cairo-speedup
  Show dependency treegraph
 
Reported: 2020-07-03 11:46 UTC by Telesto
Modified: 2020-08-30 11:36 UTC (History)
5 users (show)

See Also:
Crash report or crash signature:


Attachments
BT without symbols (5.71 KB, text/plain)
2020-07-03 11:46 UTC, Telesto
Details
bt with debug symbols (11.23 KB, text/plain)
2020-07-03 12:23 UTC, Julien Nabet
Details
Valgrind trace (274.02 KB, application/x-bzip)
2020-07-03 13:18 UTC, Julien Nabet
Details
Bibisect log (2.75 KB, text/plain)
2020-07-03 15:43 UTC, Telesto
Details
Screencast (1.15 MB, video/mp4)
2020-08-19 10:17 UTC, Telesto
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Telesto 2020-07-03 11:46:00 UTC
Description:
Crash PolyPolygon

Steps to Reproduce:
1. open attachment 162564 [details]'
2. CTRL+A
3. Set font size to 80
4. Press Undo

Actual Results:
Crash

Expected Results:
No crash


Reproducible: Always


User Profile Reset: No



Additional Info:
Version: 7.1.0.0.alpha0+ (x64)
Build ID: c48e4d795e37f23b71d647247590807ab9e52223
CPU threads: 4; OS: Windows 6.3 Build 9600; UI render: Skia/Raster; VCL: win
Locale: nl-NL (nl_NL); UI: en-US
Calc: CL
Comment 1 Telesto 2020-07-03 11:46:18 UTC
Created attachment 162607 [details]
BT without symbols
Comment 2 Telesto 2020-07-03 11:47:09 UTC
Would like a proper BT (if reproducible).. if this is the real PolyPolygon mystery bug
Comment 3 Julien Nabet 2020-07-03 12:23:52 UTC
Created attachment 162610 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today, I could reproduce this.
Comment 4 Telesto 2020-07-03 12:57:16 UTC
Second attempt for a PolyPolygon reproducer

Thread 1 "soffice.bin" received signal SIGSEGV, Segmentation fault.
0x00007fffef631a08 in __gnu_cxx::__atomic_add (__mem=0x100000007, __val=1) at /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/ext/atomicity.h:53
53	  { __atomic_fetch_add(__mem, __val, __ATOMIC_ACQ_REL); }
(gdb) bt
#0  0x00007fffef631a08 in __gnu_cxx::__atomic_add(int volatile*, int) (__mem=0x100000007, __val=1) at /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/ext/atomicity.h:53
#1  0x00007fffef6319b9 in __gnu_cxx::__atomic_add_dispatch(int*, int) (__mem=0x100000007, __val=1) at /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/ext/atomicity.h:96
#2  0x00007fffef6323e3 in std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_add_ref_copy() (this=0xffffffff) at /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/shared_ptr_base.h:139
#3  0x00007fffef632c34 in std::__shared_count<(__gnu_cxx::_Lock_policy)2>::operator=(std::__shared_count<(__gnu_cxx::_Lock_policy)2> const&) (this=0x7ffffffec838, __r=...)
    at /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/shared_ptr_base.h:747
#4  0x00007fffefef6b42 in std::__shared_ptr<tools::PolyPolygon, (__gnu_cxx::_Lock_policy)2>::operator=(std::__shared_ptr<tools::PolyPolygon, (__gnu_cxx::_Lock_policy)2> const&) (this=0x7ffffffec830)
    at /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/shared_ptr_base.h:1168
Comment 5 Telesto 2020-07-03 13:07:07 UTC
Not in
Version: 6.4.0.0.beta1+ (x64)
Build ID: 20be5cd0bdc57d812bf34a2debfe48caa51de881
CPU threads: 4; OS: Windows 6.3 Build 9600; UI render: default; VCL: win; 
Locale: nl-NL (nl_NL); UI-Language: en-US
Calc: CL
Comment 6 Julien Nabet 2020-07-03 13:18:34 UTC
Created attachment 162612 [details]
Valgrind trace
Comment 7 Telesto 2020-07-03 15:43:47 UTC
Created attachment 162615 [details]
Bibisect log

Bisected to
author	Armin Le Grand <armin.le.grand@me.com>	2020-02-27 16:43:44 +0100
committer	Armin Le Grand <Armin.Le.Grand@me.com>	2020-02-27 18:12:30 +0100
commit	424312aa99307da9f0ee60ea6e3213b2b3dc26b4 (patch)
tree	be71b53596bccdba919059799f56bec0412fa101
parent	ab623953b92d82d615bd2af6a9369915fe6fb7a8 (diff)
tdf#130768 Make tiled writer paint reuse decomposes
See more info in comment 23 of task. Roughly it's
about correcting a helper that led to destroying the
View and thus the OC and thus the whole primitive
buffering - what was expensive, for the case where
decompositions were expensive

https://cgit.freedesktop.org/libreoffice/core/commit/?id=424312aa99307da9f0ee60ea6e3213b2b3dc26b4
Comment 8 Telesto 2020-07-03 15:44:09 UTC
Adding CC: to Armin Le Grand
Comment 9 Regina Henschel 2020-07-03 21:17:10 UTC
I get no crash. Do you have waited with "undo" until the formatting to new font size is finished?
Comment 10 Telesto 2020-07-04 07:13:48 UTC
(In reply to Regina Henschel from comment #9)
> I get no crash. Do you have waited with "undo" until the formatting to new
> font size is finished?

Didn't matter to much for me.. Pressing undo at pag 500 something.

Did you try a regular build or bibisect build or only a home build version. This bug has some timing element, i assume
Comment 11 Regina Henschel 2020-07-04 16:00:24 UTC
(In reply to Telesto from comment #10)
> Did you try a regular build or bibisect build or only a home build version.
> This bug has some timing element, i assume

Tested with Version: 7.1.0.0.alpha0+ (x64)
Build ID: 913449e2ba8cea7d3eb1dbe1af93182fd5b85fd0
CPU threads: 8; OS: Windows 10.0 Build 18362; UI render: Skia/Raster; VCL: win
Locale: en-US (en_US); UI: en-US
Calc: CL
(own build)

and with Version: 7.1.0.0.alpha0+ (x64)
Build ID: 4c14c88cc681abab787a461a1bea502a777f37e6
CPU threads: 8; OS: Windows 10.0 Build 18362; UI render: default; VCL: win
Locale: de-DE (en_US); UI: en-US
Calc: CL
("offical" daily build from 30.June)

and with Version: 6.4.5.0.0+ (x64)
Build ID: 70a2071ce91b71326659e645dd97996262ea309a
CPU threads: 8; OS: Windows 10.0 Build 18362; UI render: default; VCL: win; 
Locale: de-DE (en_US); UI-Language: en-US
Calc: threaded

No crash.
Comment 12 Telesto 2020-07-04 16:16:24 UTC
(In reply to Regina Henschel from comment #11)
No clue, except I'm running Windows 8.1. It crashes as a clockwork for me.. And the STR seem to work for Julien..
Comment 13 Xisco Faulí 2020-07-16 13:34:46 UTC
I can reproduce it in

Version: 7.1.0.0.alpha0+ (x64)
Build ID: 616a47c9570f9ce67b18a124f08f4a342bff3468
CPU threads: 16; OS: Windows 6.3 Build 9600; UI render: default; VCL: win
Locale: en-GB (en_GB); UI: en-US
Calc: threaded
Comment 14 Xisco Faulí 2020-07-16 13:51:24 UTC
Also reproducible in

Version: 7.1.0.0.alpha0+
Build ID: d851a02df57ab378ed0cc6d9362516de09c3279c
CPU threads: 4; OS: Linux 4.19; UI render: default; VCL: gtk3
Locale: en-US (en_US.UTF-8); UI: en-US
Calc: threaded
Comment 15 Xisco Faulí 2020-07-16 14:07:23 UTC
I do confirm https://cgit.freedesktop.org/libreoffice/core/commit/?id=424312aa99307da9f0ee60ea6e3213b2b3dc26b4 introduced this issue, bisected with bibisect-linux64-7.0
Comment 16 Telesto 2020-07-28 21:14:19 UTC
I have encountered this bug quite  number of times. See bug 132940. This might be even uncovering a different. BT looks similar to crash bug 134996. Goes back to 6.0
Comment 17 Noel Grandin 2020-08-19 09:39:24 UTC
Sorry, I can't seem to trigger this crash
Comment 18 Telesto 2020-08-19 10:17:32 UTC
Created attachment 164461 [details]
Screencast

I press Undo while it's still processing they font 80 change
Comment 19 Noel Grandin 2020-08-19 14:29:29 UTC
(In reply to Telesto from comment #18)
> I press Undo while it's still processing they font 80 change

I don't see you pressing any button? Are you using ctrl-Z? The Undo icon doesn't seem to enable until the operation is complete (for me).

I can't repro this with master on Windows or on Linux-gtk3
Comment 20 Telesto 2020-08-19 17:44:54 UTC
(In reply to Noel Grandin from comment #19)
> (In reply to Telesto from comment #18)
> > I press Undo while it's still processing they font 80 change
> 
> I don't see you pressing any button? Are you using ctrl-Z? The Undo icon
> doesn't seem to enable until the operation is complete (for me).
> 
> I can't repro this with master on Windows or on Linux-gtk3

I pressed CTRL+Z after I changed the font size. [Need to find a way to record also pressed keys in a screencast] 

Anyhow the crash is I assume a memory corruption. Access after deletion or something like that (bit BT is already about shared pointers)

Anyhow.. this is actually only one out of number of options.. see bug 132940 (and also the see the list also there). It are all examples of the same problem as far I can tell; BT are slightly different; but always in the same area.
Comment 21 Noel Grandin 2020-08-24 06:45:17 UTC
Pretty sure this is fixed with
https://git.libreoffice.org/core/commit/445cf499666f21c2d480ce1df9ce6004b9450b64
Comment 22 Telesto 2020-08-30 11:36:22 UTC
Stable
Version: 7.1.0.0.alpha0+ (x64)
Build ID: 6640d7f405d2970ba2825a9455926cc803284d01
CPU threads: 4; OS: Windows 6.3 Build 9600; UI render: Skia/Raster; VCL: win
Locale: nl-NL (nl_NL); UI: en-US
Calc: CL