Bug 39313 - XTableRows.removeByIndex and also symply remove Row / Column crashes Libo
Summary: XTableRows.removeByIndex and also symply remove Row / Column crashes Libo
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
(earliest affected)
Master old -3.6
Hardware: x86 (IA32) All
: high blocker
Assignee: Not Assigned
Keywords: regression
Depends on:
Blocks: mab3.5
  Show dependency treegraph
Reported: 2011-07-17 13:42 UTC by Xisco Faulí
Modified: 2013-12-18 00:43 UTC (History)
8 users (show)

See Also:
Crash report or crash signature:

test (2.65 KB, text/x-python)
2011-07-17 13:46 UTC, Xisco Faulí

Note You need to log in before you can comment on or make changes to this bug.
Description Xisco Faulí 2011-07-17 13:42:34 UTC
Libo crashes when it tries to load the agenda wizard ( File > Wizards > Agenda ) here : http://opengrok.libreoffice.org/xref/components/wizards/com/sun/star/wizards/agenda/AgendaTemplate.java#1617

# A fatal error has been detected by the Java Runtime Environment:
#  SIGSEGV (0xb) at pc=0xb0fa8d71, pid=11674, tid=2876791664
# JRE version: 6.0_20-b20
# Java VM: OpenJDK Client VM (19.0-b09 mixed mode, sharing linux-x86 )
# Derivative: IcedTea6 1.9.7
# Distribution: Ubuntu 10.10, package 6b20-1.9.7-0ubuntu1
# Problematic frame:
# C  [libswlo.so+0x47ed71]
# An error report file with more information is saved as:
# /home/xisco/libo/solver/350/unxlngi6.pro/installation/opt/program/hs_err_pid11674.log
# If you would like to submit a bug report, please include
# instructions how to reproduce the bug and visit:
#   https://bugs.launchpad.net/ubuntu/+source/openjdk-6/

[error occurred during error reporting , id 0xb]

I created a test in python which reproduce this error. The output:

Traceback (most recent call last):
  File "test.py", line 75, in <module>
  File "test.py", line 72, in createTable
__main__.DisposedException: URP_Bridge : disposed
(tid=3) Unexpected connection closure

In order the run the script:
./soffice "--accept=socket,host=localhost,port=2002;urp;"
python test.py
Comment 1 Xisco Faulí 2011-07-17 13:46:42 UTC
Created attachment 49221 [details]
Comment 2 Cor Nouws 2011-09-02 00:29:50 UTC
Also crashes when removing row/column via GUI

- New writer document
- Enter, Ctrl-F12, OK
- Table > Delete > Column
  > Crash

Build ID: 6ecb780-4eb4f62-09af278
Comment 3 Cor Nouws 2011-09-02 00:40:42 UTC
tried to get backtrace,
but gdb freezed
Comment 4 Petr Mladek 2011-09-06 01:06:05 UTC
(In reply to comment #2)
> Also crashes when removing row/column via GUI

Cor, please open separate bug for this.

In general, please, do not mix two completely different bugs together. It will just create mess that nobody would be interested to read and work on.
Comment 5 Petr Mladek 2011-09-06 01:12:12 UTC
(In reply to comment #4)
> (In reply to comment #2)
> > Also crashes when removing row/column via GUI
> Cor, please open separate bug for this.

Ah, I see that they are related, so it is actually great catch. I am sorry for rumour. I think that I am still sleeping :-/
Comment 6 Markus Mohrhard 2011-09-06 03:09:45 UTC
I think it is a writer bug

#0  0x00007fffdbdd21ae in SvPtrarr::Count (this=0x6c006c00610074) at /devel/libo/libo1/solver/unxlngx6.pro/inc/svl/svarray.hxx:455
#1  0x00007fffdc2ee80a in SwUndoTblNdsChg::SaveSection (this=0x1b46d48, pSttNd=0x1957ab0) at /devel/libo/libo1/sw/source/core/undo/untbl.cxx:1749
#2  0x00007fffdbf7ef85 in _DeleteBox (rTbl=..., pBox=0x1b22cc0, pUndo=0x1b46d48, bCalcNewSize=1 '\001', bCorrBorder=1 '\001', pShareFmts=0x7fffffffbaa0)
    at /devel/libo/libo1/sw/source/core/doc/tblrwcl.cxx:889
#3  0x00007fffdbf7fe2b in SwTable::DeleteSel (this=0x1a39348, pDoc=0x16aca78, rBoxes=..., pMerged=0x0, pUndo=0x1b46d48, bDelMakeFrms=1 '\001', bCorrBorder=1 '\001')
    at /devel/libo/libo1/sw/source/core/doc/tblrwcl.cxx:1130
#4  0x00007fffdbfad8ca in SwDoc::DeleteRowCol (this=0x16aca78, rBoxes=..., bColumn=true) at /devel/libo/libo1/sw/source/core/docnode/ndtbl.cxx:2111
#5  0x00007fffdc07845d in SwFEShell::DeleteCol (this=0x175d8f8) at /devel/libo/libo1/sw/source/core/frmedt/fetab.cxx:333
#6  0x00007fffdc6c0863 in SwTableShell::Execute (this=0x1a3c378, rReq=...) at /devel/libo/libo1/sw/source/ui/shells/tabsh.cxx:721
#7  0x00007fffdc6bd973 in SfxStubSwTableShellExecute (pShell=0x1a3c378, rReq=...) at /devel/libo/libo1/workdir/unxlngx6.pro/SdiTarget/sw/sdi/swslots.hxx:9887
#8  0x00007ffff50cd230 in SfxShell::CallExec (this=0x1a3c378, pFunc=0x7fffdc6bd950 <SfxStubSwTableShellExecute(SfxShell*, SfxRequest&)>, rReq=...)
    at /devel/libo/libo1/sfx2/inc/sfx2/shell.hxx:202
#9  0x00007ffff50c6e04 in SfxDispatcher::Call_Impl (this=0x1741368, rShell=..., rSlot=..., rReq=..., bRecord=1 '\001') at /devel/libo/libo1/sfx2/source/control/dispatch.cxx:280
#10 0x00007ffff50c870a in SfxDispatcher::_Execute (this=0x1741368, rShell=..., rSlot=..., rReq=..., eCallMode=4) at /devel/libo/libo1/sfx2/source/control/dispatch.cxx:987
#11 0x00007ffff50beb9a in SfxBindings::Execute_Impl (this=0x173f748, aReq=..., pSlot=0x7fffdce42880, pShell=0x1a3c378) at /devel/libo/libo1/sfx2/source/control/bindings.cxx:1305

It somewhere crashs in a macro in SvPtrarr
Comment 7 Rainer Bielefeld Retired 2011-09-13 23:21:52 UTC
My Server installation of Master "LibO-dev 3.5.0 – WIN7 Home Premium (64bit) English UI [(Build ID:  d3d1481-3f8994a-2ba0a9f)]" does not crash when I proceed 'File > Wizards > Agenda   ... <Finish>'

CONFIRM crash due to Comment 2, rather old Master problem, already visible with Master "LibO-dev 3.4.5 – WIN7 Home Premium (64bit) English UI 
[(Build ID:d337f79-a24c961-2865670-9752b71-7f8fd43
Column becomes deleted, then LibO crashes immediately.
Same when I use 'Delete Column' icon from toolbar.

Questions to the experts:
- Is a step by step instruction available how a non-developer can reproduce 
  the Wizards - problem?
Comment 8 Jean-Baptiste Faure 2011-09-21 21:19:39 UTC
No crash for me with my own nightly build (Ubuntu x86_64).
Build ID: 8819edb-c07240c-1e62dcb-7252360-6a3a910

Comment 9 Stephan Bergmann 2011-09-22 03:31:01 UTC
Maybe <http://cgit.freedesktop.org/libreoffice/core/commit/?id=f2326368c0a8d6ee56fea10ffc28d16a249b6747> "SwUndoTblNdsChg::pDelSects was used unitialized." happened to fix this.
Comment 10 Cor Nouws 2011-09-22 11:17:00 UTC
Indeed does not crash any more in my recent Build, ID: 91a7e5a-3dca5fd-da627d2

@sbergman: could well be, I can't tell ;-)

@ ..: Do we really need to know or just close this as fixed?
Comment 11 Rainer Bielefeld Retired 2011-09-22 22:18:19 UTC
I added this report to my hold-file and will test again October 5th and 31rst - you never know.

Comment 12 Björn Michaelsen 2011-12-23 13:27:17 UTC
Since all new unconfirmed bugs start in state UNCONFIRMED now and old unconfirmed bugs were moved to NEEDINFO with a explanatory comment, all bugs promoted above those bug states to NEW and later are automatically confirmed making the CONFIRMED whiteboard status redundant. Thus it will be removed.
Comment 13 Rainer Bielefeld Retired 2012-08-22 05:53:32 UTC
Now did test as promised: no crash as per comment 2 with "LibreOffice  German UI/Locale [Build-ID:  4db6344] on German WIN7 Home Premium (64bit)