Bug 157849 - EDITING: crash on "Set Character Spacing" with custom value when hitting Enter (GTK3)
Summary: EDITING: crash on "Set Character Spacing" with custom value when hitting Ente...
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Impress (show other bugs)
Version:
(earliest affected)
7.1.0.3 release
Hardware: All All
: medium normal
Assignee: Caolán McNamara
URL: https://crashreport.libreoffice.org/s...
Whiteboard: target:24.2.0 target:7.6.3 target:7.5...
Keywords:
Depends on:
Blocks: GTK3 Crash Kerning
  Show dependency tree / graph
 
Reported: 2023-10-20 10:36 UTC by Riesi
Modified: 2023-10-23 10:27 UTC (History)
4 users (show)

See Also:
Crash report or crash signature: ["(anonymous namespace)::GtkInstanceSpinButton::signal_activate() [clone .lto_priv.1893]","(anonymous namespace)::GtkInstanceSpinButton::signal_activate() [clone .lto_priv.1858]","libvclplug_gtk3lo.so","GtkInstanceEditable::signal_activate"]

Attachments
GIF on how to reproduce. (152.93 KB, image/gif)
2023-10-20 10:36 UTC, Riesi 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Riesi 2023-10-20 10:36:38 UTC 
Created attachment 190329 [details]
GIF on how to reproduce.

When doing "Set Character Spacing" for some text you can set a custom value for the spacing. Entering the value works fine, but when you hit the Enter key the program crashes.

It does not matter if the value is positive or negative. Not pressing enter, but instead just clicking away from the pop-up works

Kind regards,
Riesi
Comment 1 Xisco Faulí 2023-10-20 10:53:47 UTC 
I can reproduced it in

Version: 24.2.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 7eda35a36c8837c620722e5c26c90324ae9b48e9
CPU threads: 8; OS: Linux 6.1; UI render: default; VCL: gtk3
Locale: es-ES (es_ES.UTF-8); UI: en-US
Calc: threaded
Comment 2 Xisco Faulí 2023-10-20 10:58:10 UTC 
it seems to be reproducible only with GTK3. I can't reproduce it in

Version: 24.2.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 7eda35a36c8837c620722e5c26c90324ae9b48e9
CPU threads: 8; OS: Linux 6.1; UI render: default; VCL: x11
Locale: es-ES (es_ES.UTF-8); UI: en-US
Calc: threaded

@Caolán, I thought you might be interested in this issue
Comment 3 Xisco Faulí 2023-10-20 10:59:57 UTC 
I'm trying to bisect it with bibisect-linux64-7.5 but the result is not accurate
Comment 4 Riesi 2023-10-20 11:06:03 UTC 
Can confirm changing the UI toolkit to "SAL_USE_VCLPLUGIN=kf5" to use QT doesn't crash.
Comment 5 Stéphane Guillou (stragu) 2023-10-20 11:25:17 UTC 
Crash report https://crashreport.libreoffice.org/stats/crash_details/bf9b990e-8e1e-4e73-af1e-00598b44da1f for:

Version: 7.6.2.1 (X86_64) / LibreOffice Community
Build ID: 56f7684011345957bbf33a7ee678afaf4d2ba333
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: threaded
Comment 6 Julien Nabet 2023-10-20 13:20:57 UTC 
On pc Debian x86-64 with master sources updated today, I could reproduce this.
Part of bt:
Thread 1 "soffice.bin" received signal SIGSEGV, Segmentation fault.
Link<weld::Entry&, bool>::IsSet (this=0xd5d96ed53e68) at include/tools/link.hxx:113
113	    bool IsSet() const { return function_ != nullptr; }
(gdb) bt
#0  Link<weld::Entry&, bool>::IsSet() const (this=0xd5d96ed53e68) at include/tools/link.hxx:113
#1  0x00007fe1ad0d9834 in (anonymous namespace)::GtkInstanceEditable::signal_activate() (this=0x55f7add61d30) at /home/julien/lo/libreoffice/vcl/unx/gtk3/gtkinst.cxx:13199
#2  0x00007fe1ad0da979 in (anonymous namespace)::GtkInstanceSpinButton::signal_activate() (this=0x55f7add61d30) at /home/julien/lo/libreoffice/vcl/unx/gtk3/gtkinst.cxx:17382
#3  0x00007fe1ad0db435 in (anonymous namespace)::GtkInstanceEditable::signalActivate(void*, void*) (widget=0x55f7add61d30) at /home/julien/lo/libreoffice/vcl/unx/gtk3/gtkinst.cxx:13185
#4  0x00007fe1b9bb5540 in g_closure_invoke () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0
Comment 7 Julien Nabet 2023-10-20 13:26:13 UTC 
I don't reproduce this with gtk4, so really gtk3 specific.

I just noticed these:
(soffice:840140): Gtk-WARNING **: 15:24:59.681: Unknown key gtk-button-images in /home/julien/.config/gtk-4.0/settings.ini

(soffice:840140): Gtk-WARNING **: 15:24:59.681: Unknown key gtk-menu-images in /home/julien/.config/gtk-4.0/settings.ini

(soffice:840140): Gtk-WARNING **: 15:24:59.681: Unknown key gtk-toolbar-style in /home/julien/.config/gtk-4.0/settings.ini

(soffice:840140): GLib-GObject-CRITICAL **: 15:25:05.214: ../../../gobject/gsignal.c:2625: signal 'size-allocate' is invalid for instance '0x557fff428050' of type 'GtkNotebook'

(soffice:840140): GLib-GObject-CRITICAL **: 15:25:07.853: invalid cast from 'GMenu' to 'GtkPopoverMenu'

(soffice:840140): Gtk-CRITICAL **: 15:25:07.853: gtk_popover_menu_get_menu_model: assertion 'GTK_IS_POPOVER_MENU (popover)' failed

(soffice:840140): Gtk-WARNING **: 15:25:08.042: Cannot connect attribute 'surface' for cell renderer class 'GtkCellRendererPixbuf' since attribute does not exist
Comment 8 Stéphane Guillou (stragu) 2023-10-20 13:29:10 UTC 
(In reply to Xisco Faulí from comment #3)
> I'm trying to bisect it with bibisect-linux64-7.5 but the result is not
> accurate

I also get inconsistent results. I'm unable to find reliable steps to bibisect.
I could reproduce all the way back to 7.1:

Crash signatures and reports:
- 7.5: (anonymous namespace)::GtkInstanceSpinButton::signal_activate() [clone .lto_priv.1858]  https://crashreport.libreoffice.org/stats/crash_details/58f6a18e-6589-48ba-9499-e6db75d9e9a5
- 7.4: (anonymous namespace)::GtkInstanceSpinButton::signal_activate() [clone .lto_priv.1715]  https://crashreport.libreoffice.org/stats/crash_details/eccf487a-b9b3-473c-9a50-61dc56321314
- 7.3: libvclplug_gtk3lo.so  https://crashreport.libreoffice.org/stats/crash_details/09ea1f4d-479e-484c-bd52-cb3ac7f9b2e2
- 7.2: GtkInstanceEditable::signal_activate  https://crashreport.libreoffice.org/stats/crash_details/dc89dd66-27c1-456c-8904-63f1401f39e1
- 7.1: GtkInstanceEntry::signal_activate  https://crashreport.libreoffice.org/stats/crash_details/806ce935-4c14-42e7-a7fc-7c3024dfbe13

Haven't managed to reproduce in 7.0.6.2.
Comment 9 Caolán McNamara 2023-10-20 13:37:24 UTC 
I can reproduce.
Comment 10 Commit Notification 2023-10-21 15:17:06 UTC 
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/a8c30238bc91f7bb7a5462c608eb27dd74c73db0

Resolves: tdf#157849 gtk_spin_button_update callback can delete widget

It will be available in 24.2.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 11 Caolán McNamara 2023-10-21 15:17:50 UTC 
done in trunk, backports to 7-6 and 7-5 in gerrit
Comment 12 Commit Notification 2023-10-23 05:30:10 UTC 
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-7-6":

https://git.libreoffice.org/core/commit/3eb06d4708c79726607ad1ec4554b8f7cd66bbb2

Resolves: tdf#157849 gtk_spin_button_update callback can delete widget

It will be available in 7.6.3.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 13 Commit Notification 2023-10-23 08:21:25 UTC 
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-7-5":

https://git.libreoffice.org/core/commit/80e4a1215729b68be67a448afa39efe1cec97e16

Resolves: tdf#157849 gtk_spin_button_update callback can delete widget

It will be available in 7.5.9.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 14 Commit Notification 2023-10-23 10:27:44 UTC 
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-7-5-8":

https://git.libreoffice.org/core/commit/9f38870924421fd88b2446fae8ab98ea773c8c11

Resolves: tdf#157849 gtk_spin_button_update callback can delete widget

It will be available in 7.5.8.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.