Bug 149966 - Crash on Windows and freeze on Linux when customizing Menu
Summary: Crash on Windows and freeze on Linux when customizing Menu
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: UI (show other bugs)
Version:
(earliest affected)
7.4.0.0 alpha1+
Hardware: All All
: highest critical
Assignee: Not Assigned
URL:
Whiteboard: target:7.5.0 target:7.4.1 target:7.4.0
Keywords: bibisected, bisected, regression
Depends on:
Blocks:
 
Reported: 2022-07-12 20:49 UTC by Laurent BP
Modified: 2022-08-13 19:13 UTC (History)
7 users (show)

See Also:
Crash report or crash signature:
Regression By:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Laurent BP 2022-07-12 20:49:07 UTC
Description:
When I tried to customize a menu in LibO 7.4.0 RC1, it freezes LibO

Steps to Reproduce:
1. Launch Writer, Calc, Impress, Draw or Base (it does not affect Start Center, nor Math)
2. Tools > Customize > Menus Tab
3. Select a Command in "Available Commands" list (p.e. "About LibreOfficeDev")
4. Select a position in "Assigned Commands" list (p.e. "Wizards")
5. Click left arrow button to add this command
6. Click OK button

Actual Results:
LibreOffice freezes

Expected Results:
Dialog should close


Reproducible: Always


User Profile Reset: Yes


OpenGL enabled: Yes

Additional Info:
Version: 7.4.0.1.0+ / LibreOffice Community
Build ID: 1ee65b067e101e54506a14ca3f7e8fc290e708f8
CPU threads: 8; OS: Linux 5.4; UI render: default; VCL: gtk3
Locale: fr-FR (fr_FR.UTF-8); UI: en-US
Calc: threaded
Comment 1 Rainer Bielefeld Retired 2022-07-13 12:19:40 UTC
Laurent BP
Please decide and tell with which Version you observed the freeze problem.
Comment 2 Laurent BP 2022-07-13 12:28:08 UTC
(In reply to Rainer Bielefeld Retired from comment #1)
> Laurent BP
> Please decide and tell with which Version you observed the freeze problem.

Actually, I observe it in 7.4RC1, but this version is not yet available in Version list.
I observe it also on my master, that's why I selected Version 7.5 master.
Comment 3 raal 2022-07-13 15:00:39 UTC
Confirm with Version: 7.5.0.0.alpha0+ / LibreOffice Community
Build ID: a93d7e7df6804cd6f1f2fa1ef0e6e95ce6c3752a
CPU threads: 4; OS: Linux 5.13; UI render: default; VCL: gtk3
Locale: cs-CZ (cs_CZ.UTF-8); UI: en-US
Calc: threaded
Comment 4 raal 2022-07-13 15:06:01 UTC
It works in 7.4-master, but fails in 7.5-oldest bibisect builds, so cannot bibisect.
Comment 5 Laurent BP 2022-07-21 15:48:54 UTC
Reproduced on Win10 with crash with:
- Version: 7.5.0.0.alpha0+ (x64) / LibreOffice Community
Build ID: eea7038c182cc1f6cd792359053ea2561a200026
CPU threads: 8; OS: Windows 10.0 Build 19042; UI render: Skia/Vulkan; VCL: win
Locale: fr-FR (fr_FR); UI: fr-FR
Calc: CL
- Version: 7.4.0.1 (x64) / LibreOffice Community
Build ID: 43e5fcfbbadd18fccee5a6f42ddd533e40151bcf
CPU threads: 8; OS: Windows 10.0 Build 19042; UI render: Skia/Vulkan; VCL: win
Locale: fr-FR (fr_FR); UI: fr-FR
Calc: CL
- Version: 7.4.0.0.beta1 (x64) / LibreOffice Community
Build ID: cec1fe9b57a55c032f9f118c907f34e22a63d040
CPU threads: 8; OS: Windows 10.0 Build 19042; UI render: Skia/Vulkan; VCL: win
Locale: fr-FR (fr_FR); UI: fr-FR
Calc: CL
- Version: 7.4.0.0.alpha1 (x64) / LibreOffice Community
Build ID: b871abad383583f02eb49c7e49aeae01f6941072
CPU threads: 8; OS: Windows 10.0 Build 19042; UI render: Skia/Vulkan; VCL: win
Locale: fr-FR (fr_FR); UI: fr-FR
Calc: CL

Change OS to all. Change title freeze to crash. Change version
Comment 6 Julien Nabet 2022-07-26 09:30:31 UTC
On pc Debian x86-64 with master sources updated today, I could reproduce this.

The location where it freezes is here:
#6  0x00007f6ed8dc1911 in std::unique_lock<std::mutex>::unique_lock(std::mutex&) (this=0x7ffc5d950b38, __m=...) at /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/unique_lock.h:69
#7  0x00007f6ed9067c39 in (anonymous namespace)::ModuleUIConfigurationManager::removeConfigurationListener(com::sun::star::uno::Reference<com::sun::star::ui::XUIConfigurationListener> const&)
    (this=0x5a42f30, xListener=uno::Reference to ((anonymous namespace)::ResourceMenuController *) 0x62269f0) at framework/source/uiconfiguration/moduleuiconfigurationmanager.cxx:976
#8  0x00007f6ed9104633 in (anonymous namespace)::ResourceMenuController::disposing() (this=0x6226920) at framework/source/uielement/resourcemenucontroller.cxx:338
#9  0x00007f6ed9e7d07d in cppu::WeakComponentImplHelperBase::dispose() (this=0x6226920) at cppuhelper/source/implbase.cxx:104
#10 0x00007f6ed90bb9d5 in cppu::PartialWeakComponentImplHelper<com::sun::star::lang::XServiceInfo, com::sun::star::frame::XPopupMenuController, com::sun::star::lang::XInitialization, com::sun::star::frame::XStatusListener, com::sun::star::awt::XMenuListener, com::sun::star::frame::XDispatchProvider, com::sun::star::frame::XDispatch>::dispose() (this=0x6226920) at include/cppuhelper/compbase.hxx:90
#11 0x00007f6ed90d6cbf in framework::MenuBarManager::RemoveListener() (this=0x5b9c740) at framework/source/uielement/menubarmanager.cxx:427
#12 0x00007f6ed90d6576 in framework::MenuBarManager::disposing(std::unique_lock<std::mutex>&) (this=0x5b9c740) at framework/source/uielement/menubarmanager.cxx:151
#13 0x00007f6eda3d87ed in comphelper::WeakComponentImplHelperBase::dispose() (this=0x5b9c740) at comphelper/source/misc/compbase.cxx:25
#14 0x00007f6ed8f3a805 in comphelper::WeakComponentImplHelper<com::sun::star::frame::XStatusListener, com::sun::star::frame::XFrameActionListener, com::sun::star::ui::XUIConfigurationListener, com::sun::star::awt::XSystemDependentMenuPeer>::dispose() (this=0x5b9c740) at include/comphelper/compbase.hxx:71
#15 0x00007f6ed90d6e6f in framework::MenuBarManager::RemoveListener() (this=0x5b958c0) at framework/source/uielement/menubarmanager.cxx:444
#16 0x00007f6ed90d6576 in framework::MenuBarManager::disposing(std::unique_lock<std::mutex>&) (this=0x5b958c0) at framework/source/uielement/menubarmanager.cxx:151
#17 0x00007f6eda3d87ed in comphelper::WeakComponentImplHelperBase::dispose() (this=0x5b958c0) at comphelper/source/misc/compbase.cxx:25
#18 0x00007f6ed8f3a805 in comphelper::WeakComponentImplHelper<com::sun::star::frame::XStatusListener, com::sun::star::frame::XFrameActionListener, com::sun::star::ui::XUIConfigurationListener, com::sun::star::awt::XSystemDependentMenuPeer>::dispose() (this=0x5b958c0) at include/comphelper/compbase.hxx:71
#19 0x00007f6ed90d6e6f in framework::MenuBarManager::RemoveListener() (this=0x5b90900) at framework/source/uielement/menubarmanager.cxx:444
#20 0x00007f6ed90dc4ab in framework::MenuBarManager::SetItemContainer(com::sun::star::uno::Reference<com::sun::star::container::XIndexAccess> const&)
    (this=0x5b90900, rItemContainer=uno::Reference to (framework::ConstItemContainer *) 0x61adb48) at framework/source/uielement/menubarmanager.cxx:1446
#21 0x00007f6ed90ef5fe in framework::MenuBarWrapper::updateSettings() (this=0x5b1bc00) at framework/source/uielement/menubarwrapper.cxx:244
#22 0x00007f6ed8f39113 in framework::LayoutManager::elementReplaced(com::sun::star::ui::ConfigurationEvent const&) (this=0x24d1be0, Event=...) at framework/source/layoutmanager/layoutmanager.cxx:2993
#23 0x00007f6ed9070278 in (anonymous namespace)::ModuleUIConfigurationManager::implts_notifyContainerListener(com::sun::star::ui::ConfigurationEvent const&, (anonymous namespace)::ModuleUIConfigurationManager::NotifyOp) (this=0x5a42f30, aEvent=..., eOp=(anonymous namespace)::ModuleUIConfigurationManager::NotifyOp_Replace) at framework/source/uiconfiguration/moduleuiconfigurationmanager.cxx:1636
#24 0x00007f6ed9069f8d in (anonymous namespace)::ModuleUIConfigurationManager::replaceSettings(rtl::OUString const&, com::sun::star::uno::Reference<com::sun::star::container::XIndexAccess> const&)
    (this=0x5a42f30, ResourceURL="private:resource/menubar/menubar", aNewData=uno::Reference to (framework::RootItemContainer *) 0x87bace8)
    at framework/source/uiconfiguration/moduleuiconfigurationmanager.cxx:1258


I don't know enough about mutex mechanism so can't help here.
Comment 7 Xisco Faulí 2022-07-27 13:27:54 UTC
Regression introduced by:

author	Stephan Bergmann <sbergman@redhat.com>	2022-03-24 13:52:44 +0100
committer	Stephan Bergmann <sbergman@redhat.com>	2022-03-25 08:21:14 +0100
commit 6e135909d398a08105e2df4cae834e73f253b440 (patch)
tree 51bcfd722ca5f18947b0e707150206e6d38b072d
parent 9fd5446c6f3281789ed21847f25cf56ce84dd395 (diff)
tdf#147668: Destroy still needs to do its work when called from disposing

Bisected with: bibisect-linux64-7.4

Adding Cc: to Stephan Bergmann
Comment 8 Heiko Tietze 2022-07-28 14:23:30 UTC
No crash with 

Version: 7.5.0.0.alpha0+ / LibreOffice Community
Build ID: cae349e4770862b36176b601d7d572844c215d4f
CPU threads: 8; OS: Mac OS X 12.4; UI render: Skia/Raster; VCL: osx
Locale: en-US (en_DE.UTF-8); UI: en-US
Calc: threaded

(build from master with debug information)
Comment 9 Caolán McNamara 2022-07-28 14:42:07 UTC
frame #7 and frame #23 both lock the same std::mutex so that's the hang anyway. Trying a std::recursive_mutex as a quick and easy solution doesn't look trivial in this case with the various calls to things that only take std::mutex, alternatively unlocking and relocking before/after elementReplaced etc looks unappealing.
Comment 10 Stephan Bergmann 2022-08-02 12:54:51 UTC
(In reply to Laurent BP from comment #0)
> Description:
> When I tried to customize a menu in LibO 7.4.0 RC1, it freezes LibO

@Laurent:  So, contrary to the bug title "Crash when customizing Menu", this is about LO freezing rather than crashing?

(In reply to Caolán McNamara from comment #9)
> frame #7 and frame #23 both lock the same std::mutex so that's the hang
> anyway.

...which would be fallout from <https://git.libreoffice.org/core/+/dab35c152af3345786b8335e83cd067b67d08b81%5E!/> "osl::Mutex->std::mutex in ModuleUIConfigurationManager".

@Noel:  Are you confident that that change was sound, and it was guaranteed that ModuleUIConfigurationManager::m_mutex would never be locked recursively?
Comment 11 Laurent BP 2022-08-02 16:39:31 UTC
(In reply to Stephan Bergmann from comment #10)
> (In reply to Laurent BP from comment #0)
> > Description:
> > When I tried to customize a menu in LibO 7.4.0 RC1, it freezes LibO
> 
> @Laurent:  So, contrary to the bug title "Crash when customizing Menu", this
> is about LO freezing rather than crashing?
Actually, there is a freeze on Linux (Comment 0, it was the first title of this bug report) and a crash on Windows (Comment 5, where title was changed to crash).
I modified the title to have a better description.
Comment 12 Kamil Landa 2022-08-02 18:03:04 UTC
Under my Win10 it crashes if there are these lines in User profile in file registrymodifications.xcu:


<item oor:path="/org.openoffice.VCL/Settings/org.openoffice.VCL:ConfigurableSettings['Accessibility']"><prop oor:name="EnableATToolSupport" oor:op="fuse" oor:type="xs:string"><value>true</value></prop></item>
<item oor:path="/org.openoffice.VCL/Settings/org.openoffice.VCL:ConfigurableSettings['DesktopManagement']"><prop oor:name="DisablePrinting" oor:op="fuse" oor:type="xs:string"><value>false</value></prop></item>
<item oor:path="/org.openoffice.VCL/Settings/org.openoffice.VCL:ConfigurableSettings['Menu']"><prop oor:name="SuppressAccelerators" oor:op="fuse" oor:type="xs:string"><value>false</value></prop></item>
<item oor:path="/org.openoffice.VCL/Settings/org.openoffice.VCL:ConfigurableSettings['PrintDialog']"><prop oor:name="Collate" oor:op="fuse" oor:type="xs:string"><value>true</value></prop></item>
<item oor:path="/org.openoffice.VCL/Settings/org.openoffice.VCL:ConfigurableSettings['PrintDialog']"><prop oor:name="CollateBox" oor:op="fuse" oor:type="xs:string"><value>Default</value></prop></item>
<item oor:path="/org.openoffice.VCL/Settings/org.openoffice.VCL:ConfigurableSettings['PrintDialog']"><prop oor:name="CollateSingleJobs" oor:op="fuse" oor:type="xs:string"><value>false</value></prop></item>
<item oor:path="/org.openoffice.VCL/Settings/org.openoffice.VCL:ConfigurableSettings['PrintDialog']"><prop oor:name="CopyCount" oor:op="fuse" oor:type="xs:string"><value>1</value></prop></item>
<item oor:path="/org.openoffice.VCL/Settings/org.openoffice.VCL:ConfigurableSettings['PrintDialog']"><prop oor:name="HasPreview" oor:op="fuse" oor:type="xs:string"><value>true</value></prop></item>
<item oor:path="/org.openoffice.VCL/Settings/org.openoffice.VCL:ConfigurableSettings['PrintDialog']"><prop oor:name="LastPage" oor:op="fuse" oor:type="xs:string"><value>Obecné</value></prop></item>
<item oor:path="/org.openoffice.VCL/Settings/org.openoffice.VCL:ConfigurableSettings['PrintDialog']"><prop oor:name="LastPrinter" oor:op="fuse" oor:type="xs:string"><value>PDFill PDF&amp;Image Writer</value></prop></item>
<item oor:path="/org.openoffice.VCL/Settings/org.openoffice.VCL:ConfigurableSettings['PrintDialog']"><prop oor:name="LastPrinterUsed" oor:op="fuse" oor:type="xs:string"><value>PDFill PDF&amp;Image Writer</value></prop></item>
<item oor:path="/org.openoffice.VCL/Settings/org.openoffice.VCL:ConfigurableSettings['PrintDialog']"><prop oor:name="WindowState" oor:op="fuse" oor:type="xs:string"><value>523,276,802,553;1;0,0,0,0;</value></prop></item>
<item oor:path="/org.openoffice.VCL/Settings/org.openoffice.VCL:ConfigurableSettings['Transfer']"><prop oor:name="SelectionTimeout" oor:op="fuse" oor:type="xs:string"><value>3</value></prop></item>
<item oor:path="/org.openoffice.VCL/Settings/org.openoffice.VCL:ConfigurableSettings['WM']"><prop oor:name="ShouldSwitchWorkspace" oor:op="fuse" oor:type="xs:string"><value>false</value></prop></item>


It seems these lines are saved from the Writer menu File/Print...

I deleted these lines from the registrymodifications.xcu and OK, no crash. 

Tested in:
Version: 7.4.0.2 (x64) / LibreOffice Community
Build ID: 1512ce97d7ed39dce3121f7e15651fd8895f950e
CPU threads: 8; OS: Windows 10.0 Build 17763; UI render: Skia/Raster; VCL: win
Locale: cs-CZ (cs_CZ); UI: cs-CZ
Calc: CL

Version: 7.5.0.0.alpha0+ (x64) / LibreOffice Community
Build ID: 41f02927b6d8470c298c8a2f407c98420a5ebe24
CPU threads: 8; OS: Windows 10.0 Build 17763; UI render: Skia/Raster; VCL: win
Locale: cs-CZ (cs_CZ); UI: cs-CZ
Calc: CL
Comment 13 Noel Grandin 2022-08-02 18:19:24 UTC
fix is here: https://gerrit.libreoffice.org/c/core/+/137705
Comment 14 Commit Notification 2022-08-03 07:13:22 UTC
Noel Grandin committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/84c4ccfec1cbbd573609623a026a8cd2ad20400f

tdf#149966 Crash on Windows and freeze on Linux when customizing Menu

It will be available in 7.5.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 15 Kamil Landa 2022-08-05 17:39:33 UTC
Confirmed, fixed in: 

Version: 7.5.0.0.alpha0+ (x64) / LibreOffice Community
Build ID: a56d0c34716f381accbd9d2e3040a62d3583d18d
CPU threads: 8; OS: Windows 10.0 Build 17763; UI render: Skia/Raster; VCL: win
Locale: cs-CZ (cs_CZ); UI: cs-CZ
Calc: CL
Comment 16 Commit Notification 2022-08-08 14:18:34 UTC
Noel Grandin committed a patch related to this issue.
It has been pushed to "libreoffice-7-4":

https://git.libreoffice.org/core/commit/fff5829dc00a1d823aa9bd23430737f82158e484

tdf#149966 Crash on Windows and freeze on Linux when customizing Menu

It will be available in 7.4.1.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 17 Commit Notification 2022-08-10 09:47:10 UTC
Noel Grandin committed a patch related to this issue.
It has been pushed to "libreoffice-7-4-0":

https://git.libreoffice.org/core/commit/3429be2b219bc9b27cb5da94f91348f632cb10db

tdf#149966 Crash on Windows and freeze on Linux when customizing Menu

It will be available in 7.4.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 18 Kamil Landa 2022-08-13 19:13:14 UTC
Verified, fixed in 7.4.0.3

Version: 7.4.0.3 (x64) / LibreOffice Community
Build ID: f85e47c08ddd19c015c0114a68350214f7066f5a
CPU threads: 8; OS: Windows 10.0 Build 17763; UI render: Skia/Raster; VCL: win
Locale: cs-CZ (cs_CZ); UI: cs-CZ
Calc: CL