Bug 76214 - UI: segfault in SvTreeListEntry::HasChildrenOnDemand
Summary: UI: segfault in SvTreeListEntry::HasChildrenOnDemand
Status: RESOLVED WORKSFORME
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Base (show other bugs)
Version:
(earliest affected)
4.3.0.0.alpha0+ Master
Hardware: x86-64 (AMD64) Linux (All)
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords: haveBacktrace
Depends on:
Blocks:
 
Reported: 2014-03-15 18:54 UTC by Terrence Enger
Modified: 2014-04-13 18:14 UTC (History)
0 users

See Also:
Crash report or crash signature:


Attachments
backtrace from segfault in embedded Firebird database (14.36 KB, text/plain)
2014-03-15 18:58 UTC, Terrence Enger
Details
comparable .odb with embedded HSQLDB (20.82 KB, application/vnd.oasis.opendocument.database)
2014-03-15 19:02 UTC, Terrence Enger
Details
tail of terminal output with segfault in HSQLDB (3.30 KB, text/plain)
2014-03-15 19:03 UTC, Terrence Enger
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Terrence Enger 2014-03-15 18:54:51 UTC
STR:

(1) Download file BugDB.odb attached to bug 74019
    <https://bugs.freedesktop.org/attachment.cgi?id=92726>.

(2) Open the file from the command line.

    Program presents window BugDB.odb.

(3) In left pane, click <Queries>.  

    In lower right pane, program presents two items: BugQuery,
    GoodQuery

(4) In lower right pane, right-click BugQuery and in the pop-up menu
    click Edit.

    Program presents window "BugDB.odb : BugQuery ... Query Design".
    Upper pane shows a list of fields in table Exchange.  Lower pane
    shows grid of fields selected into the query; the eleventh column
    of the grid is field 1998, and the twelfth column is empty.

(5) In the lower pane, drag the slider all the way to the right.  

    The grid shows eight empty columns; this brings to 19 the number
    of columns in the grid.

(6) Drag 1998 into the first empty column in the lower pane.  

    The program moves the filled-in column out of sight to the left
    and adds an empty column, the twentieth, at the right.

(7) Drag successive columns from table Exchange, starting with 1999,
    to cell Field of successive empty columns in the lower pane.

    Program action observed:
        After you drop 2007 into the twentieth column, the scroll
        bar at the bottom of the lower pane is at the right end of
        its area.
    Program action expected:
        The scrollbar should be displaced from the right end of its
        area, so that you can drag it to the right, revealing more
        empty columns.

(8) Close the Edit window.  

    Program prompts "The query has been changed ... save ...?".

(9) Click <Yes> button.

    Segfault.  The last warning in the terminal output is (newline
    added):

        warn:legacy.tools:5251:1:svtools/source/contnr/treelistbox.cxx:3879:
            SvTreeListBox::FillAccessibleEntryStateSet: invalid entry

    This function is evident in frame 1 of the backtrace.


The preceding STR are written with column numbers and so forth as I
see them in a Query Designer window of a specific size.  An experiment
with a smaller window size requires moving the scroll bar more often,
but the end result is the same.

With an embedded HSQLDB, LibreOffice also crashes, but of course the
JRE catches the segfault for its own purposes.

Alas, I cannot test other database engines until I fix my package
manager <sigh />.  I shall leave the status UNCO in the hope that some
hellpful triager will try another backend.


My LibreOffice is master commit 806f4d8, fetched 2014-03-04, configured:
    --enable-option-checking=fatal
    --enable-dbgutil
    --enable-crashdump
    --without-system-postgresql
    --without-myspell-dicts
    --with-extra-buildid
    --without-doxygen
    --with-external-tar=/home/terry/lo_hacking/git/src
built and running on debian-wheezy 64-bit.
Comment 1 Terrence Enger 2014-03-15 18:58:53 UTC
Created attachment 95868 [details]
backtrace from segfault in embedded Firebird database
Comment 2 Terrence Enger 2014-03-15 19:02:39 UTC
Created attachment 95869 [details]
comparable .odb with embedded HSQLDB
Comment 3 Terrence Enger 2014-03-15 19:03:24 UTC
Created attachment 95870 [details]
tail of terminal output with segfault in HSQLDB
Comment 4 Terrence Enger 2014-03-15 19:11:33 UTC
Note, mostly to self: When this bug is fixed, go back to bug 74019 and
try to confirm or disconfirm it.
Comment 5 Terrence Enger 2014-03-15 19:18:46 UTC
Whoops.  I really meant bug 76164 in previous comment.
Comment 6 Thomas Hackert 2014-04-13 14:56:15 UTC
Hello Terrence, *,
(In reply to comment #0)
<snip>
> (3) In left pane, click <Queries>.  
> 
>     In lower right pane, program presents two items: BugQuery,
>     GoodQuery
> 
> (4) In lower right pane, right-click BugQuery and in the pop-up menu
>     click Edit.
> 
>     Program presents window "BugDB.odb : BugQuery ... Query Design".
>     Upper pane shows a list of fields in table Exchange.  Lower pane
>     shows grid of fields selected into the query; the eleventh column
>     of the grid is field 1998, and the twelfth column is empty.

If I follow your steps up to point 4, I get only a "LibO..." window with "std::bad_alloc" and an "OK" button on it. When I hit the Enter key, LO crashes without any comment at the command prompt ... :(

Tested with Version: 4.3.0.0.alpha0+ Build ID: b7c7bd3de0fdadaf5e4769e0759d68ad17fb7bd0 TinderBox: Linux-rpm_deb-x86@45-TDF, Branch:master, Time: 2014-04-10_02:05:19 (parallel installed, following the instructions from https://wiki.documentfoundation.org/Installing_in_parallel) with en_US lang- as well as helppack under Debian Testing i686 ... ;)

<snip>
> My LibreOffice is master commit 806f4d8, fetched 2014-03-04, configured:
>     --enable-option-checking=fatal
>     --enable-dbgutil
>     --enable-crashdump
>     --without-system-postgresql
>     --without-myspell-dicts
>     --with-extra-buildid
>     --without-doxygen
>     --with-external-tar=/home/terry/lo_hacking/git/src
> built and running on debian-wheezy 64-bit.

Have you tried it with a newer version? Does your problem occur there as well? Or do you see my error message above?
Sorry for the inconvenience
Thomas.
Comment 7 Thomas Hackert 2014-04-13 15:11:52 UTC
Hello again,
further testing reveals, that – if I start with "/path/to/soffice -backtrace", I

1. do not get the message with "std::bad_malloc" and I can open the Query Design window
2. I can follow your instructions up to the last point without any problem.

But I do not see twenty columns (Calc stays with 19 columns) after dragging 1998 to the column next to the column with 1997 nor does the filled-in column moves out of sight nor does LO crash, when I save the window nor the Base file itself ... :( The only observation I can confirm, is your point 7. There are no empty columns added after dragging the numbers to the empty columns. But here I am not sure, if this is a bug or "works as expected" ... :(
HTH
Thomas.
Comment 8 Terrence Enger 2014-04-13 18:14:06 UTC
Thank you for the reminder about this one, thackert; no inconvenience
at all.

With recent versions of master, built --enable-dbgutil and
--disable-dbgutil, I see no crash.  I am closing this bug report
WORKSFORMEN.