157849 – EDITING: crash on "Set Character Spacing" with custom value when hitting Enter (GTK3)

Bug 157849 - EDITING: crash on "Set Character Spacing" with custom value when hitting Enter (GTK3)

Summary: EDITING: crash on "Set Character Spacing" with custom value when hitting Ente...

Status:	VERIFIED FIXED

Alias:	None

Product:	LibreOffice
Classification:	Unclassified
Component:	Impress (show other bugs)
Version: (earliest affected)	7.1.0.3 release
Hardware:	All All

Importance:	medium normal
Assignee:	Caolán McNamara

URL:	https://crashreport.libreoffice.org/s...
Whiteboard:	target:24.2.0 target:7.6.3 target:7.5...
Keywords:

Depends on:
Blocks:	GTK3 Crash Kerning
	Show dependency tree / graph

Reported:	2023-10-20 10:36 UTC by Riesi
Modified:	2024-05-02 13:21 UTC (History)
CC List:	4 users (show)

See Also:	141646
Crash report or crash signature:	["(anonymous namespace)::GtkInstanceSpinButton::signal_activate() [clone .lto_priv.1893]","(anonymous namespace)::GtkInstanceSpinButton::signal_activate() [clone .lto_priv.1858]","libvclplug_gtk3lo.so","GtkInstanceEditable::signal_activate"]

Attachments
GIF on how to reproduce. (152.93 KB, image/gif) 2023-10-20 10:36 UTC, Riesi	Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Riesi 2023-10-20 10:36:38 UTC

Created attachment 190329 [details]
GIF on how to reproduce.

When doing "Set Character Spacing" for some text you can set a custom value for the spacing. Entering the value works fine, but when you hit the Enter key the program crashes.

It does not matter if the value is positive or negative. Not pressing enter, but instead just clicking away from the pop-up works

Kind regards,
Riesi

Comment 1 Xisco Faulí 2023-10-20 10:53:47 UTC

I can reproduced it in

Version: 24.2.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 7eda35a36c8837c620722e5c26c90324ae9b48e9
CPU threads: 8; OS: Linux 6.1; UI render: default; VCL: gtk3
Locale: es-ES (es_ES.UTF-8); UI: en-US
Calc: threaded

Comment 2 Xisco Faulí 2023-10-20 10:58:10 UTC

it seems to be reproducible only with GTK3. I can't reproduce it in

Version: 24.2.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 7eda35a36c8837c620722e5c26c90324ae9b48e9
CPU threads: 8; OS: Linux 6.1; UI render: default; VCL: x11
Locale: es-ES (es_ES.UTF-8); UI: en-US
Calc: threaded

@Caolán, I thought you might be interested in this issue

Comment 3 Xisco Faulí 2023-10-20 10:59:57 UTC

I'm trying to bisect it with bibisect-linux64-7.5 but the result is not accurate

Comment 4 Riesi 2023-10-20 11:06:03 UTC

Can confirm changing the UI toolkit to "SAL_USE_VCLPLUGIN=kf5" to use QT doesn't crash.

Comment 5 Stéphane Guillou (stragu) 2023-10-20 11:25:17 UTC

Crash report https://crashreport.libreoffice.org/stats/crash_details/bf9b990e-8e1e-4e73-af1e-00598b44da1f for:

Version: 7.6.2.1 (X86_64) / LibreOffice Community
Build ID: 56f7684011345957bbf33a7ee678afaf4d2ba333
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: threaded

Comment 6 Julien Nabet 2023-10-20 13:20:57 UTC

On pc Debian x86-64 with master sources updated today, I could reproduce this.
Part of bt:
Thread 1 "soffice.bin" received signal SIGSEGV, Segmentation fault.
Link<weld::Entry&, bool>::IsSet (this=0xd5d96ed53e68) at include/tools/link.hxx:113
113	    bool IsSet() const { return function_ != nullptr; }
(gdb) bt
#0  Link<weld::Entry&, bool>::IsSet() const (this=0xd5d96ed53e68) at include/tools/link.hxx:113
#1  0x00007fe1ad0d9834 in (anonymous namespace)::GtkInstanceEditable::signal_activate() (this=0x55f7add61d30) at /home/julien/lo/libreoffice/vcl/unx/gtk3/gtkinst.cxx:13199
#2  0x00007fe1ad0da979 in (anonymous namespace)::GtkInstanceSpinButton::signal_activate() (this=0x55f7add61d30) at /home/julien/lo/libreoffice/vcl/unx/gtk3/gtkinst.cxx:17382
#3  0x00007fe1ad0db435 in (anonymous namespace)::GtkInstanceEditable::signalActivate(void*, void*) (widget=0x55f7add61d30) at /home/julien/lo/libreoffice/vcl/unx/gtk3/gtkinst.cxx:13185
#4  0x00007fe1b9bb5540 in g_closure_invoke () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0

Comment 7 Julien Nabet 2023-10-20 13:26:13 UTC

I don't reproduce this with gtk4, so really gtk3 specific.

I just noticed these:
(soffice:840140): Gtk-WARNING **: 15:24:59.681: Unknown key gtk-button-images in /home/julien/.config/gtk-4.0/settings.ini

(soffice:840140): Gtk-WARNING **: 15:24:59.681: Unknown key gtk-menu-images in /home/julien/.config/gtk-4.0/settings.ini

(soffice:840140): Gtk-WARNING **: 15:24:59.681: Unknown key gtk-toolbar-style in /home/julien/.config/gtk-4.0/settings.ini

(soffice:840140): GLib-GObject-CRITICAL **: 15:25:05.214: ../../../gobject/gsignal.c:2625: signal 'size-allocate' is invalid for instance '0x557fff428050' of type 'GtkNotebook'

(soffice:840140): GLib-GObject-CRITICAL **: 15:25:07.853: invalid cast from 'GMenu' to 'GtkPopoverMenu'

(soffice:840140): Gtk-CRITICAL **: 15:25:07.853: gtk_popover_menu_get_menu_model: assertion 'GTK_IS_POPOVER_MENU (popover)' failed

(soffice:840140): Gtk-WARNING **: 15:25:08.042: Cannot connect attribute 'surface' for cell renderer class 'GtkCellRendererPixbuf' since attribute does not exist

Comment 8 Stéphane Guillou (stragu) 2023-10-20 13:29:10 UTC

(In reply to Xisco Faulí from comment #3)
> I'm trying to bisect it with bibisect-linux64-7.5 but the result is not
> accurate

I also get inconsistent results. I'm unable to find reliable steps to bibisect.
I could reproduce all the way back to 7.1:

Crash signatures and reports:
- 7.5: (anonymous namespace)::GtkInstanceSpinButton::signal_activate() [clone .lto_priv.1858]  https://crashreport.libreoffice.org/stats/crash_details/58f6a18e-6589-48ba-9499-e6db75d9e9a5
- 7.4: (anonymous namespace)::GtkInstanceSpinButton::signal_activate() [clone .lto_priv.1715]  https://crashreport.libreoffice.org/stats/crash_details/eccf487a-b9b3-473c-9a50-61dc56321314
- 7.3: libvclplug_gtk3lo.so  https://crashreport.libreoffice.org/stats/crash_details/09ea1f4d-479e-484c-bd52-cb3ac7f9b2e2
- 7.2: GtkInstanceEditable::signal_activate  https://crashreport.libreoffice.org/stats/crash_details/dc89dd66-27c1-456c-8904-63f1401f39e1
- 7.1: GtkInstanceEntry::signal_activate  https://crashreport.libreoffice.org/stats/crash_details/806ce935-4c14-42e7-a7fc-7c3024dfbe13

Haven't managed to reproduce in 7.0.6.2.

Comment 9 Caolán McNamara 2023-10-20 13:37:24 UTC

I can reproduce.

Comment 10 Commit Notification 2023-10-21 15:17:06 UTC

Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/a8c30238bc91f7bb7a5462c608eb27dd74c73db0

Resolves: tdf#157849 gtk_spin_button_update callback can delete widget

It will be available in 24.2.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.

Comment 11 Caolán McNamara 2023-10-21 15:17:50 UTC

done in trunk, backports to 7-6 and 7-5 in gerrit

Comment 12 Commit Notification 2023-10-23 05:30:10 UTC

Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-7-6":

https://git.libreoffice.org/core/commit/3eb06d4708c79726607ad1ec4554b8f7cd66bbb2

Resolves: tdf#157849 gtk_spin_button_update callback can delete widget

It will be available in 7.6.3.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.

Comment 13 Commit Notification 2023-10-23 08:21:25 UTC

Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-7-5":

https://git.libreoffice.org/core/commit/80e4a1215729b68be67a448afa39efe1cec97e16

Resolves: tdf#157849 gtk_spin_button_update callback can delete widget

It will be available in 7.5.9.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.

Comment 14 Commit Notification 2023-10-23 10:27:44 UTC

Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-7-5-8":

https://git.libreoffice.org/core/commit/9f38870924421fd88b2446fae8ab98ea773c8c11

Resolves: tdf#157849 gtk_spin_button_update callback can delete widget

It will be available in 7.5.8.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.

Comment 15 Stéphane Guillou (stragu) 2024-05-02 13:21:54 UTC

Verified in:

Version: 24.8.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: ce454f382d0d005dd3de021c7820be3ffa0bb582
CPU threads: 8; OS: Linux 6.5; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: CL threaded

Thanks Caolán!