Download it now!
Bug 138108 - LO base with Firebird: crash during FORMS design, when entering Groups and exiting (gtk3 only?)
Summary: LO base with Firebird: crash during FORMS design, when entering Groups and ex...
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Base (show other bugs)
Version:
(earliest affected)
7.0.2.2 release
Hardware: All All
: medium normal
Assignee: Caolán McNamara
URL:
Whiteboard: target:7.1.0 target:7.0.4
Keywords: haveBacktrace
Depends on:
Blocks:
 
Reported: 2020-11-10 10:15 UTC by Richard Demattio
Modified: 2020-11-22 08:31 UTC (History)
3 users (show)

See Also:
Crash report or crash signature: https://crashreport.libreoffice.org/stats/crash_details/bbbe7f26-d490-4291-86c2-3b9b61a7aa51


Attachments
Example database to reproduce the crash (14.88 KB, application/vnd.oasis.opendocument.database)
2020-11-12 09:13 UTC, Richard Demattio
Details
bt with debug symbols (2.12 KB, text/plain)
2020-11-19 17:40 UTC, Julien Nabet
Details
bt from warning (5.35 KB, text/plain)
2020-11-19 18:14 UTC, Julien Nabet
Details
assertion (9.96 KB, text/plain)
2020-11-20 18:21 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Richard Demattio 2020-11-10 10:15:45 UTC
Description:
I was not able to reproduce it, but it happens frequently, when entering into a group, changing something there and jump to completely outside of the group and changing the group itself before saving the changes I did inside to a group member. 

Steps to Reproduce:
1.sorry - not able to reproduce (see description)
2.
3.

Actual Results:
crash

Expected Results:
LO must not crash, when navigating in a way, LO does allow.


Reproducible: Always


User Profile Reset: No


OpenGL enabled: Yes

Additional Info:
Version: 7.0.2.2
Build ID: 8349ace3c3162073abd90d81fd06dcfb6b36b994
CPU threads: 4; OS: Linux 5.4; UI render: default; VCL: gtk3
Locale: de-AT (en_US.UTF-8); UI: en-US
Calc: threaded

https://crashreport.libreoffice.org/stats/crash_details/bbbe7f26-d490-4291-86c2-3b9b61a7aa51
Comment 1 Julien Nabet 2020-11-11 18:15:04 UTC
Would it be possible you attach a file with the already present table and above all the form to edit?
Since there's no step by step process to reproduce the crash, at least, we'll have the right tables (structure and data) and forms.
Comment 2 Xisco Faulí 2020-11-11 19:23:21 UTC
Thank you for reporting the bug. Please attach a sample document, as this makes it easier for us to verify the bug. 
I have set the bug's status to 'NEEDINFO'. Please change it back to 'UNCONFIRMED' once the requested document is provided.
(Please note that the attachment will be public, remove any sensitive information before attaching it. 
See https://wiki.documentfoundation.org/QA/FAQ#How_can_I_eliminate_confidential_data_from_a_sample_document.3F for help on how to do so.)
Comment 3 Richard Demattio 2020-11-12 09:13:24 UTC
Created attachment 167230 [details]
Example database to reproduce the crash
Comment 4 Richard Demattio 2020-11-12 09:15:28 UTC
I could produce some more crashes:
crashreport.libreoffice.org/stats/crash_details/169dcaca-89ca-4cf2-b10a-7e51da9e5e87
crashreport.libreoffice.org/stats/crash_details/f16a677e-0fce-4cc4-8a58-e238b031068e

and I can reproduce it now by doing the folowing steps.
These steps are not, what I did originally, but this way it is possible to reproduce:
1.) group the groups "eMail" and "Telefon"
2.) enter this new group
3.) select both group members and group them again (I know: stupid)
4.) move this group
5.) enter this group again
6.) select the sub-group "Telefon"
7.) enter this sub-group "Telefon"
sometimes it crashes already on step 6

IMPORTANT: 
The crash happens only. if you have the "control properties" window open.
Comment 5 Julien Nabet 2020-11-12 21:09:08 UTC
I can't edit the form, I got the error message:
SfxBaseModel::loadFromStorage:0x4070b0f /home/julien/lo/libreoffice/sfx2/source/doc/sfxbasemodel.cxx:3727

with console logs containing:
warn:dbaccess:174974:174974:xmloff/source/core/xmlictxt.cxx:149: unknown attribute urn:oasis:names:tc:opendocument:xmlns:database:1.0 db:name value=qaa_Adressen
warn:legacy.osl:174974:174974:xmloff/source/forms/elementimport.cxx:1767: OColumnWrapperImport::StartElement: AttributeList not clonable!
warn:legacy.osl:174974:174974:xmloff/source/forms/elementimport.cxx:1770: OColumnWrapperImport::StartElement: no cloned list!
warn:legacy.osl:174974:174974:xmloff/source/forms/elementimport.cxx:1756: OColumnWrapperImport::CreateChildContext: had no form:column element!
warn:sax:174974:174974:sax/source/fastparser/fastparser.cxx:615: Unexpected exception from XML parser com.sun.star.xml.sax.SAXException message: FastAttributeList::getValue: unknown token 1051096 /home/julien/lo/libreoffice/sax/source/tools/fastattribs.cxx:246
    wrapped: void message: /home/julien/lo/libreoffice/tools/source/debug/debug.cxx:104
warn:legacy.osl:174974:174974:xmloff/source/forms/elementimport.cxx:1767: OColumnWrapperImport::StartElement: AttributeList not clonable!
warn:legacy.osl:174974:174974:xmloff/source/forms/elementimport.cxx:1770: OColumnWrapperImport::StartElement: no cloned list!
warn:legacy.osl:174974:174974:xmloff/source/forms/elementimport.cxx:1756: OColumnWrapperImport::CreateChildContext: had no form:column element!
warn:sax:174974:174974:sax/source/fastparser/fastparser.cxx:615: Unexpected exception from XML parser com.sun.star.xml.sax.SAXException message: FastAttributeList::getValue: unknown token 1051096 /home/julien/lo/libreoffice/sax/source/tools/fastattribs.cxx:246
    wrapped: void message: /home/julien/lo/libreoffice/tools/source/debug/debug.cxx:104
...
warn:xmloff:174974:174974:xmloff/source/forms/elementimport.cxx:877: OControlImport::implTranslateValueProperty: invalid property type/name combination, Any and EffectiveDefault
warn:sw:174974:174974:sw/source/filter/xml/swxml.cxx:213: SAX parse exception caught while importing: com.sun.star.xml.sax.SAXParseException message: [ line 2]: unknown error /home/julien/lo/libreoffice/sax/source/fastparser/fastparser.cxx:580
    wrapped: com.sun.star.xml.sax.SAXException message: FastAttributeList::getValue: unknown token 1051096 /home/julien/lo/libreoffice/sax/source/tools/fastattribs.cxx:246
    wrapped: void message: /home/julien/lo/libreoffice/tools/source/debug/debug.cxx:104 PublicId:  SystemId:  LineNumber: 2 ColumnNumber: 34854
warn:sw:174974:174974:sw/source/filter/xml/xmlimp.cxx:398: endDocument skipped, dropping shapes now to avoid dangling SvTextShapeImportHelper pointing to this
warn:legacy.osl:174974:174974:dbaccess/source/ui/dlg/sqlmessage.cxx:226: lcl_buildExceptionChain: useless exception: no state, no error code, no message!
Comment 6 Richard Demattio 2020-11-14 08:58:26 UTC
I downloaded the uploaded database to see, if I provided a damaged file.
I have NO problem to open and manipulate it with:

I retested on the following two virtual machines 
################################################

Version: 7.1.0.0.alpha1+
Build ID: 03a9a80125cf887d26348486b71d78d80c99344d
CPU threads: 4; OS: Linux 5.8; UI render: default; VCL: gtk3
Locale: de-AT (en_US.UTF-8); UI: en-US
TinderBox: Linux-rpm_deb-x86_64@86-TDF, Branch:master, Time: 2020-11-07_18:04:03
Calc: threaded
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SystemReport:
Graphics:  Device-1: VMware SVGA II Adapter driver: vmwgfx v: 2.18.0.0 bus ID: 00:02.0 
           chip ID: 15ad:0405 
           Display: x11 server: X.Org 1.20.8 driver: vmware unloaded: fbdev,modesetting,vesa 
           resolution: 1920x1014~60Hz 
Info:      Processes: 208 Uptime: 17m Memory: 9.73 GiB used: 1.17 GiB (12.0%) Init: systemd v: 245 
           runlevel: 5 Compilers: gcc: 9.3.0 alt: 9 Client: Unknown python3.8 client inxi: 3.0.38 
##############
AND
#############
Version: 7.0.3.1
Build ID: d7547858d014d4cf69878db179d326fc3483e082
CPU threads: 4; OS: Linux 5.8; UI render: default; VCL: gtk3
Locale: de-AT (en_US.UTF-8); UI: en-US
Calc: threaded
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SystemReport:
Graphics:  Device-1: VMware SVGA II Adapter driver: vmwgfx v: 2.18.0.0 bus ID: 00:02.0 
           chip ID: 15ad:0405 
           Display: x11 server: X.Org 1.20.8 driver: vmware unloaded: fbdev,modesetting,vesa 
           resolution: 1920x1014~60Hz 
           OpenGL: renderer: SVGA3D; build v: 2.1 Mesa 20.0.8 direct render: Yes 
Info:      Processes: 212 Uptime: 1h 29m Memory: 9.73 GiB used: 4.73 GiB (48.6%) Init: systemd 
           v: 245 runlevel: 5 Compilers: gcc: 9.3.0 alt: 7/9 Client: Unknown python3.8 client 
           inxi: 3.0.38 

################################################
SystemReport: on both virtual machines identical
################
System:    Kernel: 5.8.0-28-generic x86_64 bits: 64 compiler: N/A Desktop: Cinnamon 4.6.7 
           wm: muffin dm: LightDM Distro: Linux Mint 20 Ulyana base: Ubuntu 20.04 focal 
Machine:   Type: Virtualbox System: innotek product: VirtualBox v: 1.2 serial: <filter> 
           Chassis: Oracle Corporation type: 1 serial: <filter> 
           Mobo: Oracle model: VirtualBox v: 1.2 serial: <filter> BIOS: innotek v: VirtualBox 
           date: 12/01/2006 
CPU:       Topology: Quad Core model: Intel Core i5-4570S bits: 64 type: MCP arch: Haswell rev: 3 
           L2 cache: 6144 KiB 
           flags: avx avx2 lm nx pae sse sse2 sse3 sse4_1 sse4_2 ssse3 bogomips: 23200 
           Speed: 2900 MHz min/max: N/A Core speeds (MHz): 1: 2900 2: 2900 3: 2900 4: 2900
Comment 7 Julien Nabet 2020-11-14 09:11:02 UTC
Thank you for your feedback.
Let's put this one to WFM then.
If you can still reproduce this with min version 7.0.3 and can provide step by step process to reproduce this, don't hesitate to reopen this tracker.
Comment 8 Richard Demattio 2020-11-14 09:34:41 UTC
sorry for my incomplete sentence:
"I have NO problem to open and manipulate it "
AND I am able to reproduce the crash with the sequence in my comment4
Comment 9 Richard Demattio 2020-11-14 09:44:44 UTC
let me add, what I would accept as a solution:
* disable the possibility of regrouping if already inside of a group
* ungrouping before restructuring a group is acceptable and makes more sense

+ jumping from inside a group to other objects outside should also be disabled
  (or an automatic "exit group" should be processed)
  + this was, how I produced the crash originally, but could not reproduce

remember - the crashes use to happen only, if the "control properties" window is open
Comment 10 Julien Nabet 2020-11-14 09:59:19 UTC
Ok then.
For the moment I'm stuck because of tdf#138144 put in See also.
Comment 11 Julien Nabet 2020-11-19 17:40:31 UTC
Created attachment 167401 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today + enable-dbgutil + gtk3, I could reproduce this.
Comment 12 Julien Nabet 2020-11-19 17:43:00 UTC
Caolán: thought you might be interested in this one since it seems specific to gtk3 calling (broken?) accessibility part.

Richard: as a workaround for the moment, you can try to launch LO with:
export SAL_USE_VCLPLUGIN=gen && soffice
Comment 13 Julien Nabet 2020-11-19 18:10:41 UTC
Richard: I noticed this log when opening the form:
warn:legacy.osl:28273:28273:forms/source/component/ListBox.cxx:874: OListBoxModel::loadData: logic error!

Digging a bit, I found it was because qaa_Adressen references "tla_Kontaktarten"   which is nowhere to be seen (not a table, view or query).

Don't know if it can help a bit (no specifically about the crash).
Comment 14 Julien Nabet 2020-11-19 18:14:02 UTC
Created attachment 167404 [details]
bt from warning
Comment 15 Caolán McNamara 2020-11-19 20:33:46 UTC
I think I have captured the exception which causes the crash

#1  0x00007ffff5d3fafe in accessibility::AccessibleContextBase::ThrowIfDisposed() (this=0x85de440) at editeng/source/accessibility/AccessibleContextBase.cxx:513
#2  0x00007ffff5d3fbee in accessibility::AccessibleContextBase::getAccessibleParent() (this=0x85de440) at editeng/source/accessibility/AccessibleContextBase.cxx:203
#3  0x00007fff999cad24 in SwAccessibleMap::DoInvalidateShapeSelection(bool) (this=0x687e610, bInvalidateFocusMode=false) at sw/source/core/access/accmap.cxx:1647
#4  0x00007fff999cc5a5 in SwAccessibleMap::InvalidateShapeSelection() (this=0x687e610) at sw/source/core/access/accmap.cxx:1152
#5  0x00007fff999d78b0 in SwAccessibleMap::InvalidateCursorPosition(SwFrame const*) (this=0x687e610, pFrame=0x5a3faa0) at sw/source/core/access/accmap.cxx:2744
#6  0x00007fff9aae5c32 in SwViewShellImp::InvalidateAccessibleCursorPosition(SwFrame const*) (this=0x6594330, pFrame=0x5a3faa0) at sw/source/core/view/viewimp.cxx:345
#7  0x00007fff99b01fcd in SwCursorShell::UpdateCursor(unsigned short, bool) (this=0x6594840, eFlags=7, bIdleEnd=false) at sw/source/core/crsr/crsrsh.cxx:2020
#8  0x00007fff99b02db4 in SwCursorShell::EndAction(bool, bool) (this=0x6594840, bIdleEnd=false, DoSetPosX=false) at sw/source/core/crsr/crsrsh.cxx:279
#9  0x00007fff9a2249b2 in SwFEShell::SelectObj(Point const&, unsigned char, SdrObject*) (this=0x6594840, rPt=Point = {...}, nFlag=0 '\000', pObj=0x0)
    at sw/source/core/frmedt/feshview.cxx:323
#10 0x00007fff9b30eacb in SwWrtShell::UnSelectFrame() (this=0x6594840) at sw/source/uibase/wrtsh/select.cxx:326
Comment 16 Caolán McNamara 2020-11-19 20:51:35 UTC
https://gerrit.libreoffice.org/c/core/+/106190
Comment 17 Commit Notification 2020-11-20 10:07:19 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/09e032aad1ae08458d067d94f2fc3b8341e11903

tdf#138108 terminate on uncaught exception in a11y callback

It will be available in 7.1.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 18 Commit Notification 2020-11-20 10:07:33 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-7-0":

https://git.libreoffice.org/core/commit/4fe86806d0b84ac153e01b4ff4b8688618e7e957

tdf#138108 terminate on uncaught exception in a11y callback

It will be available in 7.0.4.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 19 Julien Nabet 2020-11-20 18:21:35 UTC
Created attachment 167427 [details]
assertion

Thank you Caolán, I don't reproduce this crash on master sources updated today.

However, I had this assertion when closing form edition.
Should I submit a new bugtracker or may it be related?
Comment 20 Caolán McNamara 2020-11-21 20:15:08 UTC
bt in comment #19 is some other a11y assert and is some separate problem. Its possibly cosmetic and dbgutil only.
Comment 21 Julien Nabet 2020-11-22 08:31:24 UTC
(In reply to Caolán McNamara from comment #20)
> bt in comment #19 is some other a11y assert and is some separate problem.
> Its possibly cosmetic and dbgutil only.
Ok so if it's cosmetic, no need to create a bugtracker.
Let's put this one to VERIFIED then.