Bug 58893 - [CRASH] FILEOPEN : master document with linked template modified
Summary: [CRASH] FILEOPEN : master document with linked template modified
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: framework (show other bugs)
Version:
(earliest affected)
3.6.0.0.beta1
Hardware: Other All
: high major
Assignee: Michael Stahl
QA Contact:
URL:
Whiteboard: bibisected40 target:4.1.0 target:3.6....
Keywords: regression
Depends on:
Blocks: mab3.6
  Show dependency treegraph
 
Reported: 2012-12-30 21:23 UTC by Pierre C
Modified: 2013-01-18 09:16 UTC (History)
5 users (show)

See Also:


Attachments
Crashlog Mac OSX (76.55 KB, text/rtf)
2013-01-02 17:19 UTC, Jorendc
Details
typescript with backtrace from Linux (60.15 KB, text/plain)
2013-01-10 17:55 UTC, Terrence Enger
Details
typescript of execution under valgrind (162.33 KB, text/plain)
2013-01-10 17:58 UTC, Terrence Enger
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Pierre C 2012-12-30 21:23:03 UTC
Libo crash when opening a master document attached with a template file

it crashes when the template file as been modified. No crash elsewhere

Step to reproduce :

1 Create a template document (odt) and save it into the template folder

2 create a new document by template (file / new / templates and documents) using template just created

3 save it as master document (file / send / Create master document)

4 insert a file with the navigator (f5)

5 save the master document

6 open the template and make any change

7 save the template

8 open the master document
 - answer yes to update the documents --> Ok
 - answer yes to update styles --> crash

same problem with libo 4.0b2
same problem with libo 3.6.4 on two different computers

works fine with OpenOffice 3.4.0
Comment 1 Jorendc 2013-01-02 17:19:27 UTC
I can reproduce using Mac OS X 10.8.2

LibreOffice 4.1.0.0.alpha0+ (Build ID: 73731b01cd65defdf9b42a9754bede3ba84221d)
TinderBox: MacOSX-Intel@1-built_no-moz_on_10.6.8, Branch:master, Time: 2013-01-02_08:47:51

I'll attach crashlog
Comment 2 Jorendc 2013-01-02 17:19:56 UTC
Created attachment 72391 [details]
Crashlog Mac OSX
Comment 3 Pierre C 2013-01-04 21:22:14 UTC
This bug has been confirmed on the French discuss list under libo 3.6.3

There is no bug with libo 3.5.7, so it is a regression 

more information
step 1 of course you create an ott doc, not odt

after step 2, you must at least create a small document with one heading style otherwise you will get an error message (can't create document)
Comment 4 Pierre C 2013-01-05 11:34:28 UTC
Same crash under libo 3.6.0 (XP)

I've build several virtual machines with libo 3.3, 3.4, 3.5

No problem with 3.3 to 3.5 (XP)

So the problem is between 3.5.7 and 3.6.0
Comment 5 Pierre C 2013-01-05 13:40:36 UTC
Further investigation

crash with libo 3.6.0b3
Comment 6 Pierre C 2013-01-05 14:19:40 UTC
crash with libo 3.6.0b1
Comment 7 Terrence Enger 2013-01-10 17:55:44 UTC
Created attachment 72791 [details]
typescript with backtrace from Linux

I have succeeded in provoking at least a couple of superficially
different segfaults.  For the attached backtrace, here is what I did
as closely as I can reconstruct it.

( 1) Presume existence of bugs_058893/subdoc.odt.  [This brings us to
     line 14 of the typescript.]

( 2) Make not to exist the template and the master document that we
     shall create in following steps.  [line 15]

( 3) Run LibreOffice; specifically 
         ./soffice.bin --norestore --writer
     Program displays empty Writer document "Untitled 1" [line 23]

( 4) Type "This is the template.<enter>".  The program displays that
     text in the document.

( 5) Take menu options File > "Save As".  The program displays dialog
     Save.

( 6) Navigate to your templates folder (mine is
     ~/lo_hacking/git/libo2/solver/unxlngi6/installation/opt/share/template/common)
     and press <enter>.  The program displays the contents of that
     folder.  (For me that was just folders internal/, layout/, and
     wizard/.

( 7) In Name field, type "bug_058893" and click to open the drop-down
     list of file formats.

( 8) In the drop-down list of file formats, click "ODF Tdext Document
     Template (.ott)" and click <Save>.  The program displays the
     document window and changes the title to bug_058839.ott.  [line
     23]

( 9) Take menu options File > New > Templates.  The program displays
     dialog Template Manager.

(10) Double click "My Templates".  The program displays some files,
     including ~.lock.bug_058893... and bug_058893. [line 35]

(11) Click bug_058893.  The program displays Writer document "Untitled
     1" with content "This is the tmplate."  The caret is before the
     first letter.

(12) Take menu options File > Send > "Create Master Document".  Program
     displays dialog "Name and Path of Master Document" with file type
     "ODF Master Document" selected.

(13) Navigate to your chosen folder.  Then type name "master" and click
     Save.  Program displays the document window, changes the title to
     master.odm, and displays the floating navigator toolbar.

(14) In the navigator toolbar click the Insert icon and select File.
     Program displays dialog Insert.

(15) Select file subdoc.odt and click Open.  The program displays
     document window master.odm with two paragraphs ...

         This is the subdoc.
         This is the template.

     There is a fine border around the first paragraph.

(16) On the toolbar click the Save icon.  Program runs a progress bar
     across the bottom of the screen and clears the document-modified
     flag in the status bar.

(17) Switch to window bug_058893.ott.

(18) Change the content to read "This is the template, updated one
     time."  Program sets the modified flag in the status bar.

(19) Take menu options File > Save.  Program runs a progress bar across
     the bottom of the screen and clears the document-modified flag in
     the status bar.

(20) Switch to the window master.odm and take menu options File >
     Close.  Program displays document window bug_058893.ott.  [line
     53]

(21) Take menu options File > "Recent Documents" and select master.odm.
     Program displays dialog "... Would you like to change the
     document, and ...".

(22) Click Yes.  Program displays dialog "... Do want to update style
     based formatting ...".

(23) Click "Update Styles".  

     Expected program action: display Writer document master.odm.

     Actual program action: Program displays window master.odm with no
     content but only a gray background in the content area and quickly
     produces a segmentation fault in in SfxRequest::IsCancelled.
     [line 59]


This is from master commit 58376a6, pulled 2013-01-02 and subsequently
lightly hacked in irrelevant ways, configured with

    --enable-dbgutil
    --enable-crashdump
    --disable-build-mozilla
    --without-system-postgresql
    --without-myspell-dicts
    --without-help
    --with-extra-buildid

and built and executing on ubuntu-natty (11.04) with classic desktop
(no effects):

    $ uname -a
    Linux cougar-natty 2.6.38-16-generic #67-Ubuntu SMP Thu Sep 6 18:00:43 UTC 2012 i686 athlon i386 GNU/Linux
    $ gcc --version
    gcc (Ubuntu/Linaro 4.5.2-8ubuntu4) 4.5.2
Comment 8 Terrence Enger 2013-01-10 17:58:28 UTC
Created attachment 72792 [details]
typescript of execution under valgrind

Same scenario as in comment 7.
Comment 9 Terrence Enger 2013-01-11 14:52:32 UTC
The results from bibisect are ..

    d9be4b56c2e61bb94c677582dc92419f8468a927 is the first bad commit
    commit d9be4b56c2e61bb94c677582dc92419f8468a927
    Author: Bjoern Michaelsen <bjoern.michaelsen@canonical.com>
    Date:   Sun Dec 9 10:57:02 2012 +0000
    
        source-hash-ef7a460fa51140782b7ad4d87aa782ca007c56ca
        
        commit ef7a460fa51140782b7ad4d87aa782ca007c56ca
        Author:     Fridrich Štrba <fridrich.strba@bluewin.ch>
        AuthorDate: Wed May 9 17:19:34 2012 +0200
        Commit:     Fridrich Štrba <fridrich.strba@bluewin.ch>
        CommitDate: Wed May 9 17:20:14 2012 +0200
        
            deliver the boost libraries we build
        
            Change-Id: Idd3a133ee8271716518eb167192be91e76f90075

    :100644 100644 bebb01a19f12e02e6fb75daad416aba9af218982 5551006cf10864218763ece1e9dcf9b5aacdb8aa M	ccache.log
    :100644 100644 59155385ab9b27dc7ac549d48fd2e53527c7f3d5 b11eb9d63c3acffd41d21c6b78dc94e07cba4320 M	commitmsg
    :100644 100644 074a5a088f639b83c92a0ca75cd15b71d3876ff2 8b3060cf9aff63fff9573ca3fee0d2b5c9ea6bf6 M	dev-install.log
    :100644 100644 e5be7fd1088e66ad194f08733463ffa36518de86 24ca6a9a4ed51852cec16105e50c73ec52596482 M	make.log
    :040000 040000 8bd7bf282cb79e1b18e5a5e5a9890a46d177d45b cf5a8a7b0b4ac211f56c938bccbc4190c5dab879 M	opt

and `git bisect log` says ...

    # bad: [5b4b36d87517a6ea96ff8c84c46b12f462fc9a1a] source-hash-8450a99c744e9005f19173e4df35d65640bcf5c4
    # good: [65fd30f5cb4cdd37995a33420ed8273c0a29bf00] source-hash-d6cde02dbce8c28c6af836e2dc1120f8a6ef9932
    git bisect start 'latest' 'oldest'
    # bad: [16b0b88cbd4ef0f51816e97277e40c5cf78f7bf9] source-hash-099198a4224778fe6e43f5dc13b5b9b1b4dc828c
    git bisect bad 16b0b88cbd4ef0f51816e97277e40c5cf78f7bf9
    # good: [598083cdb5699e7f45183da8b750815f62ff5485] source-hash-ecb1599ad00e71dfe05f3ae9a71bdce5f7540a40
    git bisect good 598083cdb5699e7f45183da8b750815f62ff5485
    # good: [cc1fc072dd691da3da43742dfc3fdd126157257b] source-hash-18c661f715a0b6850d30b374e5556dc14a377d2b
    git bisect good cc1fc072dd691da3da43742dfc3fdd126157257b
    # good: [fb0ce84a03588593a081ac3a26b2ada2d960b76c] source-hash-1aa91a2d8e7db5cebff5b47f3005f1acff64d25e
    git bisect good fb0ce84a03588593a081ac3a26b2ada2d960b76c
    # bad: [d9be4b56c2e61bb94c677582dc92419f8468a927] source-hash-ef7a460fa51140782b7ad4d87aa782ca007c56ca
    git bisect bad d9be4b56c2e61bb94c677582dc92419f8468a927
    # good: [b3d0d6cf5ddad3c3642ec069bcc2946f7f4b2853] source-hash-f5080ebb7022c9f5d7d7fdca4fe9d19f9bb8cabf
    git bisect good b3d0d6cf5ddad3c3642ec069bcc2946f7f4b2853
    # good: [874c746f2771abce8304b81680ab7b7d2246596e] source-hash-3a35fd8f1c6b176e675b998a82526636aad5a00b
    git bisect good 874c746f2771abce8304b81680ab7b7d2246596e
    # good: [c351d72548ef0ca30ec0d3672bd514caaa497a99] source-hash-35be7d7574cd0f45a18ee5838dd14cb1040890d4
    git bisect good c351d72548ef0ca30ec0d3672bd514caaa497a99
Comment 10 Pierre C 2013-01-12 11:28:30 UTC
If I can help for anything... Just ask
Comment 11 Michael Stahl 2013-01-15 20:40:42 UTC
regression from a1d265be484f1c70f57ab3de9b2d8c27d2fd3aa4

problem is that a SfxRequest is deleted but there is an event
pending from SfxHintPoster that refers to it and that's
what crashes later.
Comment 12 Not Assigned 2013-01-16 16:13:52 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=5090267eada3d68a618769c5dbae8b2ee8d6dab5

fdo#58893: Revert "Resolves: rhbz#818557 crash with NULL shell..."



The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 13 Pierre C 2013-01-16 17:44:49 UTC
I suppose that it is too late to have this patch for Libo 3.6.5...
Comment 14 Michael Stahl 2013-01-16 19:54:07 UTC
indeed too late for 3.6.5.

fixed on master by reverting the original fix for rhbz#818557
and then fixing that problem in a different way that
at least doesn't cause _this_ problem.
Comment 15 Not Assigned 2013-01-17 08:24:17 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-3-6":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=b2c076455cb911863a954e3d7d6d2aabe3723978&h=libreoffice-3-6

fdo#58893: Revert "Resolves: rhbz#818557 crash with NULL shell..."


It will be available in LibreOffice 3.6.6.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 16 Not Assigned 2013-01-18 09:16:17 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-4-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=89fb1aee1a9e80e901f9e23ef6239177645b0101&h=libreoffice-4-0

fdo#58893: Revert "Resolves: rhbz#818557 crash with NULL shell..."


It will be available in LibreOffice 4.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.