Bug 134551 - CRASH: Deleting module in macro editor
Summary: CRASH: Deleting module in macro editor
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: BASIC (show other bugs)
Version:
(earliest affected)
4.4 all versions
Hardware: All All
: medium normal
Assignee: Caolán McNamara
URL:
Whiteboard: target:7.1.0 target:6.4.6 target:7.0.0.2
Keywords: haveBacktrace
Depends on:
Blocks:
 
Reported: 2020-07-06 09:27 UTC by Xisco Faulí
Modified: 2020-07-07 07:22 UTC (History)
3 users (show)

See Also:
Crash report or crash signature:


Attachments
bt with debug symbols (9.43 KB, text/plain)
2020-07-06 10:31 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Xisco Faulí 2020-07-06 09:27:59 UTC
Steps to reproduce:
1. Open Writer
2. Go to Tools - Macros - Edit Macros
3. Right click on tab Module1 at the bottom of the window - Delete
4. Yes

-> Crash

Reproduced in

Version: 7.1.0.0.alpha0+
Build ID: 9af38b4504ccda57a0c32eb8bdd03e5a8ca29ddc
CPU threads: 4; OS: Linux 4.19; UI render: default; VCL: gtk3
Locale: en-US (en_US.UTF-8); UI: en-US
Calc: threaded

and


Version: 4.3.0.0.alpha1+
Build ID: c15927f20d4727c3b8de68497b6949e72f9e6e9e
Comment 1 Julien Nabet 2020-07-06 10:31:21 UTC
Created attachment 162693 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today, I could reproduce this.
Comment 2 Xisco Faulí 2020-07-06 13:17:44 UTC
@Caolán, I thought you might be interested in this issue
Comment 3 Caolán McNamara 2020-07-06 15:14:01 UTC
doesn't crash for me, but a valgrind trace confirms the suspicious "Cannot access memory at address 0x999999999999999d" hint in the bt. On removing the last module the ModulWindow is destroyed and the m_aName which was passed by reference is now junk, but we continue to use it

==1097527==    at 0xB40A23C: rtl::OUString::getStr() const (ustring.hxx:700)
==1097527==    by 0xB422FBD: INetURLObject::encodeText(rtl::OUString const&, INetURLObject::Part, INetURLObject::EncodeMechanism, unsigned short, bool) (urlobj.hxx:1133)
==1097527==    by 0xB41AA17: INetURLObject::insertName(rtl::OUString const&, bool, int, INetURLObject::EncodeMechanism, unsigned short) (urlobj.cxx:3277)
==1097527==    by 0x735BD18: basic::SfxLibrary::impl_removeWithoutChecks(rtl::OUString const&) (namecont.cxx:3074)
==1097527==    by 0x735BF75: basic::SfxLibrary::removeByName(rtl::OUString const&) (namecont.cxx:3097)
==1097527==    by 0x4291B57E: basctl::ScriptDocument::Impl::removeModuleOrDialog(basctl::LibraryContainerType, rtl::OUString const&, rtl::OUString const&) (scriptdocument.cxx:519)
==1097527==    by 0x429212D1: basctl::ScriptDocument::removeModule(rtl::OUString const&, rtl::OUString const&) const (scriptdocument.cxx:1295)
==1097527==    by 0x4283FD48: basctl::ModulWindow::ExecuteCommand(SfxRequest&) (baside2.cxx:1012)
==1097527==    by 0x42863CD0: basctl::Shell::ExecuteCurrent(SfxRequest&) (basides1.cxx:263)
==1097527==    by 0x4287AB54: SfxStubbasctl_ShellExecuteCurrent(SfxShell*, SfxRequest&) (basslots.hxx:153)
==1097527==    by 0x7924091: SfxShell::CallExec(void (*)(SfxShell*, SfxRequest&), SfxRequest&) (shell.hxx:197)
==1097527==    by 0x790DC88: SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, bool) (dispatch.cxx:252)
==1097527==  Address 0x39de77a0 is 640 bytes inside a block of size 736 free'd
==1097527==    at 0x483AEFC: operator delete(void*) (vg_replace_malloc.c:584)
==1097527==    by 0x4283B027: basctl::ModulWindow::~ModulWindow() (baside2.cxx:233)
==1097527==    by 0x427CEC04: VclReferenceBase::release() const (vclreferencebase.hxx:40)
==1097527==    by 0x4284BF86: rtl::Reference<basctl::ModulWindow>::~Reference() (ref.hxx:113)
==1097527==    by 0x42846508: VclPtr<basctl::ModulWindow>::~VclPtr() (vclptr.hxx:111)
==1097527==    by 0x42882EAC: basctl::ContainerListenerImpl::elementRemoved(com::sun::star::container::ContainerEvent const&) (basidesh.cxx:136)
==1097527==    by 0x7367DB3: comphelper::OInterfaceContainerHelper2::NotifySingleListener<com::sun::star::container::XContainerListener, com::sun::star::container::ContainerEvent>::operator()(com::sun::star::uno::Reference<com::sun::star::container::XContainerListener> const&) const (interfacecontainer2.hxx:253)
==1097527==    by 0x7367B5E: void comphelper::OInterfaceContainerHelper2::forEach<com::sun::star::container::XContainerListener, comphelper::OInterfaceContainerHelper2::NotifySingleListener<com::sun::star::container::XContainerListener, com::sun::star::container::ContainerEvent> >(comphelper::OInterfaceContainerHelper2::NotifySingleListener<com::sun::star::container::XContainerListener, com::sun::star::container::ContainerEvent> const&) (interfacecontainer2.hxx:266)
==1097527==    by 0x735E486: void comphelper::OInterfaceContainerHelper2::notifyEach<com::sun::star::container::XContainerListener, com::sun::star::container::ContainerEvent>(void (com::sun::star::container::XContainerListener::*)(com::sun::star::container::ContainerEvent const&), com::sun::star::container::ContainerEvent const&) (interfacecontainer2.hxx:279)
==1097527==    by 0x73462FD: basic::NameContainer::removeByName(rtl::OUString const&) (namecont.cxx:268)
==1097527==    by 0x735BC75: basic::SfxLibrary::impl_removeWithoutChecks(rtl::OUString const&) (namecont.cxx:3066)
==1097527==    by 0x735BF75: basic::SfxLibrary::removeByName(rtl::OUString const&) (namecont.cxx:3097)
Comment 4 Commit Notification 2020-07-06 18:47:52 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/d299dc45409503ec4500b07c517b25e06438c611

Resolves: tdf#134551 ModulWindow deleted when last module removed

It will be available in 7.1.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 5 Commit Notification 2020-07-06 18:51:37 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-6-4":

https://git.libreoffice.org/core/commit/6e240dd933d1dd54480cad0f1f2ecb45b1c5326e

Resolves: tdf#134551 ModulWindow deleted when last module removed

It will be available in 6.4.6.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 6 Commit Notification 2020-07-06 18:53:00 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-7-0":

https://git.libreoffice.org/core/commit/3a11365898939d6426d6171ddb3a05cf4fa08aa8

Resolves: tdf#134551 ModulWindow deleted when last module removed

It will be available in 7.0.0.2.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 7 Caolán McNamara 2020-07-06 18:54:05 UTC
fixed in master and 7-0, then accidentally pushed myself to 6-4 without review, oops.
Comment 8 Julien Nabet 2020-07-07 07:22:32 UTC
On pc Debian x86-64 with master sources updated today, I don't reproduce this.
Thank you Caolán!