Bug 61025 - Crash when adding a comment on a cell
Summary: Crash when adding a comment on a cell
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
(earliest affected) Master
Hardware: x86-64 (AMD64) Linux (All)
: medium normal
Assignee: Markus Mohrhard
Whiteboard: target:4.1.0
Depends on:
Reported: 2013-02-17 19:44 UTC by Jean-Baptiste Faure
Modified: 2013-03-10 09:47 UTC (History)
7 users (show)

See Also:
Crash report or crash signature:

bt + console logs on master (5.32 KB, text/plain)
2013-02-17 20:00 UTC, Julien Nabet
typescript of valgrind run (30.26 KB, text/plain)
2013-03-07 18:53 UTC, Terrence Enger

Note You need to log in before you can comment on or make changes to this bug.
Description Jean-Baptiste Faure 2013-02-17 19:44:11 UTC
Steps to reproduce:
1/ open a new spreadsheet
2/ select cell A1 -> right click > Add a comment
==> crash (segmentation fault)

tested on Version (Build ID: 5a9b1bcc3941574f0f42791c189f90b302816da) with Ubuntu 12.04 x86-64

Best regards. JBF
Comment 1 Julien Nabet 2013-02-17 20:00:47 UTC
Created attachment 75007 [details]
bt + console logs on master

On pc Debian x86-64 with master sources updated today (commit e2f6fd6abee572c86d25e39f799d477ffcee7b3d), I reproduced the crash.

I attached console logs + bt
Comment 2 Julien Nabet 2013-02-17 20:02:28 UTC
Kohei/Markus/Eike: one for you or for Caolán (since bt shows vcl part)?
Comment 3 Jean-Baptiste Faure 2013-02-17 22:03:29 UTC
I am not sure but this bug may be related to bug 61024. I found this crash when trying to confirm bug 61024 on the master.

Best regards. JBF
Comment 4 Markus Mohrhard 2013-02-22 01:39:13 UTC
I think I know what is the problem here.

Sadly it requires much more debugging. We are somehow deleting the object that we are still using indirectly out of one of the object's methods. As nice as it sounds as ugly is it to debug.
Comment 5 Terrence Enger 2013-03-07 18:53:37 UTC
Created attachment 76129 [details]
typescript of valgrind run

Markus is probably far ahead of me on this, but just in case, here is
a run under valgrind.  Summary ...

    typescript    user
         lines    action
         -----    ---------------------
            57    rt-click A1
                  insert comment
            62    "foo bar"
            78    click A2
           269    close document
                  <Close without saving>
           270    close Start Center

This reports 7 cases of FuText::MouseButtonDown(MouseEvent const&)
(futext.cxx) doing a read at various offsets within the same
previously freed block.

These observations are from master commit 2082dc5, pulled around
2013-03-06 06:00 UTC, built and executing on ubuntu-natty (11.04)
32-bit, configured with...


Comment 6 Commit Notification 2013-03-09 21:08:56 UTC
Markus Mohrhard committed a patch related to this issue.
It has been pushed to "master":


fix fdo#61025, Revert "fdo#55430 switches off text mode when ...

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
Affected users are encouraged to test the fix and report feedback.
Comment 7 Markus Mohrhard 2013-03-10 00:42:11 UTC
So the bug has been fixed by reverting the problematic part of the commit. I have to understand now why it introduced the regression before I commit the patch again.

The problem has been introduced with the last patch from Bug 55430.
Comment 8 Jean-Baptiste Faure 2013-03-10 09:47:13 UTC
Verified on Version (Build ID: 1e67ecc6569e1c01485471a4c396a63b597a052) on Ubuntu 12.04 x86-64

Thank you very much, Markus. :-)

Best regards. JBF