Bug 78536 - Libreoffice Writer and Calc (and possibly others) crash when styles window closed
Summary: Libreoffice Writer and Calc (and possibly others) crash when styles window cl...
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: framework (show other bugs)
Version:
(earliest affected)
4.2.0.4 release
Hardware: All All
: medium major
Assignee: Michael Stahl (allotropia)
URL:
Whiteboard: target:4.3.0 target:4.2.5
Keywords: regression
Depends on:
Blocks:
 
Reported: 2014-05-10 17:56 UTC by Miguel Guedes
Modified: 2014-05-20 11:59 UTC (History)
3 users (show)

See Also:
Crash report or crash signature:


Attachments
bt with symbols (4.76 KB, text/plain)
2014-05-10 20:25 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Miguel Guedes 2014-05-10 17:56:00 UTC
Libreoffice Writer and Calc (and possibly Impress and others) crash when, whilst modifying or creating a style, the styles window is closed and one cancels creation or modification of said style.

Steps to reproduce:

  1) F11 to display styles window

  2) Select a style -> context menu -> select "Modify"

  3) close styles window

  4) close window on which style is being modified

Always crashes.
Comment 1 Julien Nabet 2014-05-10 20:25:33 UTC
Created attachment 98829 [details]
bt with symbols

On pc Debian x86-64 with master sources updated today, I could reproduce this.
Comment 2 Julien Nabet 2014-05-10 20:33:29 UTC
On pc Debian x86-64 with 4.2 sources updated yesterday, I can reproduce this too.
However with 4.1.6.2 Debian package, I don't reproduce this.

Miguel: on which env are you? (Windows, MacOs, Linux)
Comment 3 Julien Nabet 2014-05-10 20:59:45 UTC
Michael: I tried some debug and noticed than when closing main Style window, it destroys pStyleFamilies, see:
(gdb) bt
#0  SfxCommonTemplateDialog_Impl::~SfxCommonTemplateDialog_Impl (this=0x8392d50, __in_chrg=<optimized out>)
    at /home/julien/compile-libreoffice/libreoffice/sfx2/source/dialog/templdlg.cxx:1008
#1  0x00002aaaad9b1c1e in SfxTemplateDialog_Impl::~SfxTemplateDialog_Impl (this=0x8392d50, __in_chrg=<optimized out>)
    at /home/julien/compile-libreoffice/libreoffice/sfx2/source/dialog/templdlg.cxx:2518
#2  0x00002aaaad9b1c4e in SfxTemplateDialog_Impl::~SfxTemplateDialog_Impl (this=0x8392d50, __in_chrg=<optimized out>)
    at /home/julien/compile-libreoffice/libreoffice/sfx2/source/dialog/templdlg.cxx:2520
#3  0x00002aaaad9a835d in SfxTemplateDialog::~SfxTemplateDialog (this=0x8398a10, __in_chrg=<optimized out>)
    at /home/julien/compile-libreoffice/libreoffice/sfx2/source/dialog/templdlg.cxx:154
#4  0x00002aaaad9a8398 in SfxTemplateDialog::~SfxTemplateDialog (this=0x8398a10, __in_chrg=<optimized out>)
    at /home/julien/compile-libreoffice/libreoffice/sfx2/source/dialog/templdlg.cxx:155
#5  0x00002aaaad7ff48d in SfxChildWindow::~SfxChildWindow (this=0x83a2730, __in_chrg=<optimized out>)
    at /home/julien/compile-libreoffice/libreoffice/sfx2/source/appl/childwin.cxx:189
#6  0x00002aaaad9bbdfc in SfxTemplateDialogWrapper::~SfxTemplateDialogWrapper (this=0x83a2730, __in_chrg=<optimized out>)
    at /home/julien/compile-libreoffice/libreoffice/include/sfx2/templdlg.hxx:72
#7  0x00002aaaad9bbe2c in SfxTemplateDialogWrapper::~SfxTemplateDialogWrapper (this=0x83a2730, __in_chrg=<optimized out>)
    at /home/julien/compile-libreoffice/libreoffice/include/sfx2/templdlg.hxx:72

Should the solution be to make impossible to close main style window without closing the related style windows?
Comment 4 Miguel Guedes 2014-05-11 00:20:12 UTC
(In reply to comment #2)
> Miguel: on which env are you? (Windows, MacOs, Linux)

On Xubuntu 14.04 Linux; using Libreoffice 4.2.4.2.
Comment 5 Michael Stahl (allotropia) 2014-05-19 20:30:39 UTC
4.2.0 regression from:

commit bcc52fb2ebdf77a1cc089857775fd742085b45b6
Author:     Noel Power <noel.power@suse.com>
AuthorDate: Thu Aug 29 17:15:33 2013 +0100

    add support for in-place style preview
    
specifically the additional call to Execute_Impl
from ~SfxCommonTemplateDialog_Impl()...
there is a ridiculous hack in Execute_Impl
to detect if the "this" instance has been deleted,
and that hack is not re-entrant, i.e. there
are 2 Execute_Impl on the stack now, and the
"outer" one will not return early and accesses
deleted members.

fixed on master.

hmm.... now i notice:

commit dda842bec338efb06457551136678340d0718807
Author:     Noel Power <noel.power@suse.com>
AuthorDate: Thu Aug 29 17:22:48 2013 +0100

    disable/disconnect style preview from styles dialog
  
... which #ifdefs out a bunch of code, but strangely
duplicates the code in ~SfxCommonTemplateDialog_Impl()
- i assume this is an accident and it should have been
#ifdef'd instead?

will push a patch to remove this to master, if i'm wrong
it can always be reverted :)
Comment 6 Commit Notification 2014-05-19 20:30:50 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=838c580fdba8b1c72bc854d101d302be0e3861d5

fdo#78536: sfx2: template dialog: make the am-i-dead-yet check reentrant



The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 7 Commit Notification 2014-05-19 20:31:05 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=b18ff2a2ef8dae006d6bc976a61510f2dbaa27f2

fdo#78536: sfx2: remove (likely) accidentally duplicated call



The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 8 Noel Power 2014-05-20 09:01:13 UTC
(In reply to comment #5)
> 4.2.0 regression from:
> 
> commit bcc52fb2ebdf77a1cc089857775fd742085b45b6
> Author:     Noel Power <noel.power@suse.com>
> AuthorDate: Thu Aug 29 17:15:33 2013 +0100
> 
>     add support for in-place style preview
>     
> specifically the additional call to Execute_Impl
> from ~SfxCommonTemplateDialog_Impl()...
> there is a ridiculous hack in Execute_Impl
> to detect if the "this" instance has been deleted,
> and that hack is not re-entrant, i.e. there
> are 2 Execute_Impl on the stack now, and the
> "outer" one will not return early and accesses
> deleted members.
did I do that, sorry if I did :-(
> 
> fixed on master.
> 
> hmm.... now i notice:
> 
> commit dda842bec338efb06457551136678340d0718807
> Author:     Noel Power <noel.power@suse.com>
> AuthorDate: Thu Aug 29 17:22:48 2013 +0100
> 
>     disable/disconnect style preview from styles dialog
>   
> ... which #ifdefs out a bunch of code, but strangely
> duplicates the code in ~SfxCommonTemplateDialog_Impl()
> - i assume this is an accident and it should have been
> #ifdef'd instead?
yes, looks like it should have been #ifdefed out, was it that 'Execute_Impl(SID_STYLE_END_PREVIEW)' that was causing this core? <sigh> apologies
for the carelessness
> 
> will push a patch to remove this to master, if i'm wrong
> it can always be reverted :)
<shrug> the STYLESPREVIEW doesn't do anything much useful anyway, I doubt I will have time to get back to it, feel free to revert the whole lot if you wish (I hope that changes are independent of the associated font preview changes)
Comment 9 Commit Notification 2014-05-20 11:59:15 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-4-2":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=2fd89dd60366caa64ed8b31b588e72dd639104bd&h=libreoffice-4-2

fdo#78536: sfx2: template dialog: make the am-i-dead-yet check reentrant


It will be available in LibreOffice 4.2.5.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.