Bug 57079 - Crash Using Edit Contour dialog and then changing Configuration
Summary: Crash Using Edit Contour dialog and then changing Configuration
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: UI (show other bugs)
Version:
(earliest affected)
Inherited From OOo
Hardware: Other Windows (All)
: high critical
Assignee: Michael Stahl (CIB)
URL:
Whiteboard: BSA target:4.1.0 target:4.0.4 target:...
Keywords: regression
Depends on:
Blocks: mab4.1
  Show dependency treegraph
 
Reported: 2012-11-13 17:55 UTC by Fernand
Modified: 2013-06-17 14:59 UTC (History)
3 users (show)

See Also:
Crash report or crash signature:


Attachments
Doc who crashes LO after using the Edit contour dialog (356.62 KB, application/vnd.oasis.opendocument.text)
2012-11-13 17:55 UTC, Fernand
Details
Bug 57079 - WinDbg session (3.66 KB, text/plain)
2012-11-30 09:55 UTC, bfoman (inactive)
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Fernand 2012-11-13 17:55:24 UTC
Created attachment 70013 [details]
Doc who crashes LO after using the Edit contour dialog

Problem description: 

After changing the “contour”  (right click on the image in the document and choose “wrap” and then “Edit Contour”, just change a bit the contour and save an close the contour dialog.
Then run the sytemdialog macro (who just change from system dialogs to LO dialogs)
Normaly (noy always) the LO will crash 





Platform (if different from the browser): 
              
Browser: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11
Comment 1 billhook 2012-11-14 23:07:54 UTC
Confirmed on LO 3.6.3.2 Windows Vista 32bit.

To reproduce:

1. Open attached document
2. Right click on the image; Wrap->Edit contour
3. Move the "markers" around quite drastically. e.g. move the bottom one up to the middle and the right marker to the middle.
3. Click the 'tick' in the top left corner.
4. Press the 'Run systemdialog macro' button. (make sure that macros are turned on)

LO will crash.

Note that the first few times I tried this, it didn't crash. Perhaps because I didn't make drastic enough changes when I did 'edit contour'. I can reproduce it every time now though.
Comment 2 Fernand 2012-11-15 08:12:48 UTC
Not the way of changing the contour is important, its sort of the number off times you do the action, but after a first crash, it seems to crash alway's after ?
Comment 3 bfoman (inactive) 2012-11-30 09:55:16 UTC
Created attachment 70822 [details]
Bug 57079 - WinDbg session

Confirmed with:
LO 4.0.0.0.alpha1+ 
Build ID: own W7 debug build (dec8fe97d9f48d59b6bb0f98faded0f6aa8397df) 
Windows 7 Professional SP1 64 bit

Java build 1.6.0_33-b03

Attached full WinDbg session.
Comment 4 John Smith 2013-03-08 16:25:29 UTC
Version 4.0.1.2.
Contour Editor also crashes LO immediately when clicking to finish after using either the Rectangle, Ellipse, or Polygon tool to set a contour.
Comment 5 Gregor 2013-03-16 13:32:20 UTC
Crash in Version 4.0.1.2 (Build ID: 84102822e3d61eb989ddd325abf1ac077904985) on Windows 7
I always get a crash. this happens as soon as I double click to end polygon editing.
The document recovery works flawlessly but the wrap is not edited.
Comment 6 Jorendc 2013-03-20 20:42:17 UTC
I mark this bug as Critical Medium [1]:
Critical: Crash
Medium: as far I can't see any other related bugs which mention this crash or many people in CC, this bug does not affect MANY users. (please see flowchart).

Thanks for your understanding,
Joren

[1] https://wiki.documentfoundation.org/images/0/06/Prioritizing_Bugs_Flowchart.jpg
Comment 7 Fernand 2013-05-17 07:25:52 UTC
Joren, 
I must confirm that "Contour" becomes useless due to crach when "double clicking"
Changed status to High because this bug  prefend us to go to 4.0 ! (100 users)
OO 4.0 do not suffer from this bug !
Comment 8 Michael Stahl (CIB) 2013-05-17 11:16:14 UTC
there are clearly 2 different bugs here.

the crash in comment #4 is also filed as bug 62965.

i think i found the commit that introduced that one, see other bug.

please keep this bug to what is in the description.

the crash in the description is around in every version since OOo 3.2.1
... OOo 3.1.1 does not seem to crash so i guess it's a regression.
Comment 9 Michael Stahl (CIB) 2013-05-17 11:40:54 UTC
Comment on attachment 70822 [details]
Bug 57079 - WinDbg session

sadly this windbg trace is useless, just shows some random place where it crashes subsequently...
Comment 10 Michael Stahl (CIB) 2013-05-17 11:43:19 UTC
apparently the SvxSuperContourDlg registers an event handler
that is called on configuration changes... but it somehow isn't
unregistered when the dialog is closed

==21999== Invalid read of size 2
==21999==    at 0x86CDCB4: ToolBox::SetOutStyle(unsigned short) (toolbox2.cxx:1791)
==21999==    by 0x225E44B6: SvxSuperContourDlg::MiscHdl(void*) (_contdlg.cxx:806)
==21999==    by 0x6D2DE86: SvtMiscOptions_Impl::CallListeners() (link.hxx:143)
==21999==    by 0x7F48B0A: utl::ConfigChangeListener_Impl::changesOccurred(com::sun::star::util::ChangesEvent const&) (configitem.cxx:208)
==21999==    by 0x16BA7705: configmgr::Broadcaster::send() (broadcaster.cxx:198)
==21999==    by 0x16BDBC78: configmgr::RootAccess::commitChanges() (rootaccess.cxx:197)
==21999==  Address 0x26ba7b4c is 1,964 bytes inside a block of size 4,680 free'd
==21999==    at 0x4A073CC: operator delete(void*) (vg_replace_malloc.c:480)
==21999==    by 0x6228869: SfxChildWindow::~SfxChildWindow() (childwin.cxx:201)
==21999==    by 0x225E4596: SvxContourDlgChildWindow::~SvxContourDlgChildWindow() (contdlg.hxx:45)
==21999==    by 0x6229140: SfxChildWindow::Destroy() (childwin.cxx:193)
==21999==    by 0x6277B27: SfxWorkWindow::RemoveChildWin_Impl(SfxChildWin_Impl*) (workwin.cxx:1622)
==21999==    by 0x6278EA6: SfxWorkWindow::ToggleChildWindow_Impl(unsigned short, unsigned char) (workwin.cxx:2072)
==21999==    by 0x21236144: SwBaseShell::Execute(SfxRequest&) (basesh.cxx:956)
==21999==    by 0x62A76CC: SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, unsigned char) (shell.hxx:199)
==21999==    by 0x62AF9CC: SfxDispatcher::Execute(unsigned short, unsigned short, SfxPoolItem const*, ...) (dispatch.cxx:1208)
==21999==    by 0x62D61AE: SfxFloatingWindow::Close() (basedlgs.cxx:562)
==21999==    by 0x225E0F78: SvxSuperContourDlg::Close() (_contdlg.cxx:337)
==21999==    by 0x871D9CD: DelayedCloseEventLink(void*, void*) (winproc.cxx:1918)
Comment 11 Michael Stahl (CIB) 2013-05-17 12:24:50 UTC
fixed on master
Comment 12 Commit Notification 2013-05-17 12:29:45 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=fc63700181ab0f42eab5f98328074fe1682344f8

fdo#57079: SvxSuperContourDlg: unregister configuration listener



The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 13 Björn Michaelsen 2013-05-17 12:39:34 UTC
setting version back as per comment 8 by mst (this wasnt introduced in 3.6, but is much older)
Comment 14 Fernand 2013-05-17 14:21:25 UTC
thanks
you made our day , on monday we move to 4.03
Comment 15 Commit Notification 2013-05-17 14:38:41 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-4-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=253871bca7d5f8085424bf920eb781596dc0371e&h=libreoffice-4-0

fdo#57079: SvxSuperContourDlg: unregister configuration listener


It will be available in LibreOffice 4.0.4.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 16 Commit Notification 2013-05-17 14:46:28 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-3-6":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=c04dc880044ca84b80bb13ac900de84ceae2a561&h=libreoffice-3-6

fdo#57079: SvxSuperContourDlg: unregister configuration listener


It will be available in LibreOffice 3.6.7.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 17 Armand DELCROS 2013-06-17 14:59:57 UTC
Verified on 4.0.4.2.