Description: I was not able to reproduce it, but it happens frequently, when entering into a group, changing something there and jump to completely outside of the group and changing the group itself before saving the changes I did inside to a group member. Steps to Reproduce: 1.sorry - not able to reproduce (see description) 2. 3. Actual Results: crash Expected Results: LO must not crash, when navigating in a way, LO does allow. Reproducible: Always User Profile Reset: No OpenGL enabled: Yes Additional Info: Version: 7.0.2.2 Build ID: 8349ace3c3162073abd90d81fd06dcfb6b36b994 CPU threads: 4; OS: Linux 5.4; UI render: default; VCL: gtk3 Locale: de-AT (en_US.UTF-8); UI: en-US Calc: threaded https://crashreport.libreoffice.org/stats/crash_details/bbbe7f26-d490-4291-86c2-3b9b61a7aa51
Would it be possible you attach a file with the already present table and above all the form to edit? Since there's no step by step process to reproduce the crash, at least, we'll have the right tables (structure and data) and forms.
Thank you for reporting the bug. Please attach a sample document, as this makes it easier for us to verify the bug. I have set the bug's status to 'NEEDINFO'. Please change it back to 'UNCONFIRMED' once the requested document is provided. (Please note that the attachment will be public, remove any sensitive information before attaching it. See https://wiki.documentfoundation.org/QA/FAQ#How_can_I_eliminate_confidential_data_from_a_sample_document.3F for help on how to do so.)
Created attachment 167230 [details] Example database to reproduce the crash
I could produce some more crashes: crashreport.libreoffice.org/stats/crash_details/169dcaca-89ca-4cf2-b10a-7e51da9e5e87 crashreport.libreoffice.org/stats/crash_details/f16a677e-0fce-4cc4-8a58-e238b031068e and I can reproduce it now by doing the folowing steps. These steps are not, what I did originally, but this way it is possible to reproduce: 1.) group the groups "eMail" and "Telefon" 2.) enter this new group 3.) select both group members and group them again (I know: stupid) 4.) move this group 5.) enter this group again 6.) select the sub-group "Telefon" 7.) enter this sub-group "Telefon" sometimes it crashes already on step 6 IMPORTANT: The crash happens only. if you have the "control properties" window open.
I can't edit the form, I got the error message: SfxBaseModel::loadFromStorage:0x4070b0f /home/julien/lo/libreoffice/sfx2/source/doc/sfxbasemodel.cxx:3727 with console logs containing: warn:dbaccess:174974:174974:xmloff/source/core/xmlictxt.cxx:149: unknown attribute urn:oasis:names:tc:opendocument:xmlns:database:1.0 db:name value=qaa_Adressen warn:legacy.osl:174974:174974:xmloff/source/forms/elementimport.cxx:1767: OColumnWrapperImport::StartElement: AttributeList not clonable! warn:legacy.osl:174974:174974:xmloff/source/forms/elementimport.cxx:1770: OColumnWrapperImport::StartElement: no cloned list! warn:legacy.osl:174974:174974:xmloff/source/forms/elementimport.cxx:1756: OColumnWrapperImport::CreateChildContext: had no form:column element! warn:sax:174974:174974:sax/source/fastparser/fastparser.cxx:615: Unexpected exception from XML parser com.sun.star.xml.sax.SAXException message: FastAttributeList::getValue: unknown token 1051096 /home/julien/lo/libreoffice/sax/source/tools/fastattribs.cxx:246 wrapped: void message: /home/julien/lo/libreoffice/tools/source/debug/debug.cxx:104 warn:legacy.osl:174974:174974:xmloff/source/forms/elementimport.cxx:1767: OColumnWrapperImport::StartElement: AttributeList not clonable! warn:legacy.osl:174974:174974:xmloff/source/forms/elementimport.cxx:1770: OColumnWrapperImport::StartElement: no cloned list! warn:legacy.osl:174974:174974:xmloff/source/forms/elementimport.cxx:1756: OColumnWrapperImport::CreateChildContext: had no form:column element! warn:sax:174974:174974:sax/source/fastparser/fastparser.cxx:615: Unexpected exception from XML parser com.sun.star.xml.sax.SAXException message: FastAttributeList::getValue: unknown token 1051096 /home/julien/lo/libreoffice/sax/source/tools/fastattribs.cxx:246 wrapped: void message: /home/julien/lo/libreoffice/tools/source/debug/debug.cxx:104 ... warn:xmloff:174974:174974:xmloff/source/forms/elementimport.cxx:877: OControlImport::implTranslateValueProperty: invalid property type/name combination, Any and EffectiveDefault warn:sw:174974:174974:sw/source/filter/xml/swxml.cxx:213: SAX parse exception caught while importing: com.sun.star.xml.sax.SAXParseException message: [ line 2]: unknown error /home/julien/lo/libreoffice/sax/source/fastparser/fastparser.cxx:580 wrapped: com.sun.star.xml.sax.SAXException message: FastAttributeList::getValue: unknown token 1051096 /home/julien/lo/libreoffice/sax/source/tools/fastattribs.cxx:246 wrapped: void message: /home/julien/lo/libreoffice/tools/source/debug/debug.cxx:104 PublicId: SystemId: LineNumber: 2 ColumnNumber: 34854 warn:sw:174974:174974:sw/source/filter/xml/xmlimp.cxx:398: endDocument skipped, dropping shapes now to avoid dangling SvTextShapeImportHelper pointing to this warn:legacy.osl:174974:174974:dbaccess/source/ui/dlg/sqlmessage.cxx:226: lcl_buildExceptionChain: useless exception: no state, no error code, no message!
I downloaded the uploaded database to see, if I provided a damaged file. I have NO problem to open and manipulate it with: I retested on the following two virtual machines ################################################ Version: 7.1.0.0.alpha1+ Build ID: 03a9a80125cf887d26348486b71d78d80c99344d CPU threads: 4; OS: Linux 5.8; UI render: default; VCL: gtk3 Locale: de-AT (en_US.UTF-8); UI: en-US TinderBox: Linux-rpm_deb-x86_64@86-TDF, Branch:master, Time: 2020-11-07_18:04:03 Calc: threaded ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SystemReport: Graphics: Device-1: VMware SVGA II Adapter driver: vmwgfx v: 2.18.0.0 bus ID: 00:02.0 chip ID: 15ad:0405 Display: x11 server: X.Org 1.20.8 driver: vmware unloaded: fbdev,modesetting,vesa resolution: 1920x1014~60Hz Info: Processes: 208 Uptime: 17m Memory: 9.73 GiB used: 1.17 GiB (12.0%) Init: systemd v: 245 runlevel: 5 Compilers: gcc: 9.3.0 alt: 9 Client: Unknown python3.8 client inxi: 3.0.38 ############## AND ############# Version: 7.0.3.1 Build ID: d7547858d014d4cf69878db179d326fc3483e082 CPU threads: 4; OS: Linux 5.8; UI render: default; VCL: gtk3 Locale: de-AT (en_US.UTF-8); UI: en-US Calc: threaded ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SystemReport: Graphics: Device-1: VMware SVGA II Adapter driver: vmwgfx v: 2.18.0.0 bus ID: 00:02.0 chip ID: 15ad:0405 Display: x11 server: X.Org 1.20.8 driver: vmware unloaded: fbdev,modesetting,vesa resolution: 1920x1014~60Hz OpenGL: renderer: SVGA3D; build v: 2.1 Mesa 20.0.8 direct render: Yes Info: Processes: 212 Uptime: 1h 29m Memory: 9.73 GiB used: 4.73 GiB (48.6%) Init: systemd v: 245 runlevel: 5 Compilers: gcc: 9.3.0 alt: 7/9 Client: Unknown python3.8 client inxi: 3.0.38 ################################################ SystemReport: on both virtual machines identical ################ System: Kernel: 5.8.0-28-generic x86_64 bits: 64 compiler: N/A Desktop: Cinnamon 4.6.7 wm: muffin dm: LightDM Distro: Linux Mint 20 Ulyana base: Ubuntu 20.04 focal Machine: Type: Virtualbox System: innotek product: VirtualBox v: 1.2 serial: <filter> Chassis: Oracle Corporation type: 1 serial: <filter> Mobo: Oracle model: VirtualBox v: 1.2 serial: <filter> BIOS: innotek v: VirtualBox date: 12/01/2006 CPU: Topology: Quad Core model: Intel Core i5-4570S bits: 64 type: MCP arch: Haswell rev: 3 L2 cache: 6144 KiB flags: avx avx2 lm nx pae sse sse2 sse3 sse4_1 sse4_2 ssse3 bogomips: 23200 Speed: 2900 MHz min/max: N/A Core speeds (MHz): 1: 2900 2: 2900 3: 2900 4: 2900
Thank you for your feedback. Let's put this one to WFM then. If you can still reproduce this with min version 7.0.3 and can provide step by step process to reproduce this, don't hesitate to reopen this tracker.
sorry for my incomplete sentence: "I have NO problem to open and manipulate it " AND I am able to reproduce the crash with the sequence in my comment4
let me add, what I would accept as a solution: * disable the possibility of regrouping if already inside of a group * ungrouping before restructuring a group is acceptable and makes more sense + jumping from inside a group to other objects outside should also be disabled (or an automatic "exit group" should be processed) + this was, how I produced the crash originally, but could not reproduce remember - the crashes use to happen only, if the "control properties" window is open
Ok then. For the moment I'm stuck because of tdf#138144 put in See also.
Created attachment 167401 [details] bt with debug symbols On pc Debian x86-64 with master sources updated today + enable-dbgutil + gtk3, I could reproduce this.
Caolán: thought you might be interested in this one since it seems specific to gtk3 calling (broken?) accessibility part. Richard: as a workaround for the moment, you can try to launch LO with: export SAL_USE_VCLPLUGIN=gen && soffice
Richard: I noticed this log when opening the form: warn:legacy.osl:28273:28273:forms/source/component/ListBox.cxx:874: OListBoxModel::loadData: logic error! Digging a bit, I found it was because qaa_Adressen references "tla_Kontaktarten" which is nowhere to be seen (not a table, view or query). Don't know if it can help a bit (no specifically about the crash).
Created attachment 167404 [details] bt from warning
I think I have captured the exception which causes the crash #1 0x00007ffff5d3fafe in accessibility::AccessibleContextBase::ThrowIfDisposed() (this=0x85de440) at editeng/source/accessibility/AccessibleContextBase.cxx:513 #2 0x00007ffff5d3fbee in accessibility::AccessibleContextBase::getAccessibleParent() (this=0x85de440) at editeng/source/accessibility/AccessibleContextBase.cxx:203 #3 0x00007fff999cad24 in SwAccessibleMap::DoInvalidateShapeSelection(bool) (this=0x687e610, bInvalidateFocusMode=false) at sw/source/core/access/accmap.cxx:1647 #4 0x00007fff999cc5a5 in SwAccessibleMap::InvalidateShapeSelection() (this=0x687e610) at sw/source/core/access/accmap.cxx:1152 #5 0x00007fff999d78b0 in SwAccessibleMap::InvalidateCursorPosition(SwFrame const*) (this=0x687e610, pFrame=0x5a3faa0) at sw/source/core/access/accmap.cxx:2744 #6 0x00007fff9aae5c32 in SwViewShellImp::InvalidateAccessibleCursorPosition(SwFrame const*) (this=0x6594330, pFrame=0x5a3faa0) at sw/source/core/view/viewimp.cxx:345 #7 0x00007fff99b01fcd in SwCursorShell::UpdateCursor(unsigned short, bool) (this=0x6594840, eFlags=7, bIdleEnd=false) at sw/source/core/crsr/crsrsh.cxx:2020 #8 0x00007fff99b02db4 in SwCursorShell::EndAction(bool, bool) (this=0x6594840, bIdleEnd=false, DoSetPosX=false) at sw/source/core/crsr/crsrsh.cxx:279 #9 0x00007fff9a2249b2 in SwFEShell::SelectObj(Point const&, unsigned char, SdrObject*) (this=0x6594840, rPt=Point = {...}, nFlag=0 '\000', pObj=0x0) at sw/source/core/frmedt/feshview.cxx:323 #10 0x00007fff9b30eacb in SwWrtShell::UnSelectFrame() (this=0x6594840) at sw/source/uibase/wrtsh/select.cxx:326
https://gerrit.libreoffice.org/c/core/+/106190
Caolán McNamara committed a patch related to this issue. It has been pushed to "master": https://git.libreoffice.org/core/commit/09e032aad1ae08458d067d94f2fc3b8341e11903 tdf#138108 terminate on uncaught exception in a11y callback It will be available in 7.1.0. The patch should be included in the daily builds available at https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: https://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Caolán McNamara committed a patch related to this issue. It has been pushed to "libreoffice-7-0": https://git.libreoffice.org/core/commit/4fe86806d0b84ac153e01b4ff4b8688618e7e957 tdf#138108 terminate on uncaught exception in a11y callback It will be available in 7.0.4. The patch should be included in the daily builds available at https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: https://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Created attachment 167427 [details] assertion Thank you Caolán, I don't reproduce this crash on master sources updated today. However, I had this assertion when closing form edition. Should I submit a new bugtracker or may it be related?
bt in comment #19 is some other a11y assert and is some separate problem. Its possibly cosmetic and dbgutil only.
(In reply to Caolán McNamara from comment #20) > bt in comment #19 is some other a11y assert and is some separate problem. > Its possibly cosmetic and dbgutil only. Ok so if it's cosmetic, no need to create a bugtracker. Let's put this one to VERIFIED then.