Bug Hunting Session
Bug 88352 - Freeze with simple animation Impress
Summary: Freeze with simple animation Impress
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Impress (show other bugs)
Version:
(earliest affected)
4.3.5.2 release
Hardware: IA64 (Itanium) All
: medium critical
Assignee: Armin Le Grand
URL:
Whiteboard: target:5.1.0
Keywords: bibisectRequest, regression
Depends on:
Blocks:
 
Reported: 2015-01-13 05:47 UTC by Massimo
Modified: 2016-10-25 19:19 UTC (History)
5 users (show)

See Also:
Crash report or crash signature:


Attachments
One page with animations (31.45 KB, application/vnd.oasis.opendocument.presentation)
2015-01-13 05:47 UTC, Massimo
Details
Another example crashing Impress (73.51 KB, application/vnd.oasis.opendocument.presentation)
2015-01-17 11:12 UTC, Massimo
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Massimo 2015-01-13 05:47:22 UTC
Created attachment 112151 [details]
One page with animations

Open the attached file
Launch the animation (F5)
Click on next (mouse, arrow). At the second animation it stops. Keep clicking: Impress crashes.
Comment 1 Julien Nabet 2015-01-13 20:22:35 UTC
On pc Debian x86-64 with master sources updated today, I've got a freeze.
Comment 2 Julien Nabet 2015-01-13 20:38:36 UTC
A part (because I had a segfault during bt retrieving) of a random bt:
#0  0x00002aaab4962fef in rtl::math::approxEqual (a=860, b=779) at /home/julien/compile-libreoffice/libreoffice/include/rtl/math.hxx:254
#1  0x00002aaab49630cf in basegfx::fTools::equal (rfValA=@0x7fffffff2a00: 860, rfValB=@0x7fffffff28c0: 779)
    at /home/julien/compile-libreoffice/libreoffice/include/basegfx/numeric/ftools.hxx:172
#2  0x00002aaab496db35 in basegfx::B2DTuple::equal (this=0x7fffffff2a00, rTup=...) at /home/julien/compile-libreoffice/libreoffice/include/basegfx/tuple/b2dtuple.hxx:153
#3  0x00002aaab49b0781 in basegfx::tools::isPointOnLine (rStart=..., rEnd=..., rCandidate=..., bWithPoints=true)
    at /home/julien/compile-libreoffice/libreoffice/basegfx/source/polygon/b2dpolygontools.cxx:2105
Comment 3 Buovjaga 2015-01-16 15:45:36 UTC
No crash for me. CPU was working a bit harder at times.
4.5 was much slower than 3.5.0, but did not freeze completely.

I guess a bibisect would be nice to see, when it starts being awfully slow.

Ubuntu 14.10 64-bit Version: 4.5.0.0.alpha0+
Build ID: 0ffa3abc7d6c0437ece30cfb1430d28ffcc9f5c1
TinderBox: Linux-rpm_deb-x86_64@46-TDF-dbg, Branch:master, Time: 2015-01-15_22:47:16

LibreOffice 3.5.0rc3 
Build ID: 7e68ba2-a744ebf-1f241b7-c506db1-7d53735
Comment 4 Massimo 2015-01-17 11:12:37 UTC
Created attachment 112381 [details]
Another example crashing Impress

I add a second example of animation crashing Impress. I am stuck with this bug, if it is not fixed quickly I have to go back to some previous versions.
Comment 5 Massimo 2015-01-17 11:16:01 UTC
It may be useful to note that if I change the animations from "after the previous" to "on click", the crash no longer occurs.
Comment 6 Buovjaga 2015-01-17 12:20:22 UTC
(In reply to Massimo from comment #4)
> Created attachment 112381 [details]
> Another example crashing Impress
> 
> I add a second example of animation crashing Impress. I am stuck with this
> bug, if it is not fixed quickly I have to go back to some previous versions.

Please create a new report for that and comment here. One report per bug. Thanks.
Comment 7 Massimo 2015-01-17 12:58:45 UTC
(In reply to Beluga from comment #6)
> (In reply to Massimo from comment #4)
> > Created attachment 112381 [details]
> > Another example crashing Impress
> > 
> > I add a second example of animation crashing Impress. I am stuck with this
> > bug, if it is not fixed quickly I have to go back to some previous versions.
> 
> Please create a new report for that and comment here. One report per bug.
> Thanks.

It's the SAME bug, just another file with the same problem.
Comment 8 Buovjaga 2015-01-17 13:07:17 UTC
(In reply to Massimo from comment #7)
> (In reply to Beluga from comment #6)
> > (In reply to Massimo from comment #4)
> > > Created attachment 112381 [details]
> > > Another example crashing Impress
> > > 
> > > I add a second example of animation crashing Impress. I am stuck with this
> > > bug, if it is not fixed quickly I have to go back to some previous versions.
> > 
> > Please create a new report for that and comment here. One report per bug.
> > Thanks.
> 
> It's the SAME bug, just another file with the same problem.

Ok. It certainly LOOKS like they're different bugs, though.

I can't repro crash on Linux for attachment 112151 [details] or attachment 112381 [details].
Can't repro crash on Win for attachment 112151 [details].
Can repro crash on Win 4.4 RC2 for attachment 112381 [details], but not with 4.5 alpha.
The titles for attachment 112381 [details] are funky in Windows: red title invisible, black subtitle disappears intermittently.

I tried to get a backtrace on Windows, but for some reason 4.4 crashes only after I close WinDbg!? The crash occurs even if I've closed the presentation and am in the start center and then close WinDbg.

Ubuntu 14.10 64-bit Version: 4.5.0.0.alpha0+
Build ID: 0ffa3abc7d6c0437ece30cfb1430d28ffcc9f5c1
TinderBox: Linux-rpm_deb-x86_64@46-TDF-dbg, Branch:master, Time: 2015-01-15_22:47:16

and

Version: 4.3.3.2
Build ID: 430m0(Build:2)

Win 7 Pro 64-bit, LibO Version: 4.4.0.2
Build ID: a3603970151a6ae2596acd62b70112f4d376b99

Version: 4.5.0.0.alpha0+
Build ID: 5f6bdce0c0ac687f418821ce328f2987bf340cda
TinderBox: Win-x86@62-TDF, Branch:MASTER, Time: 2015-01-17_01:06:46
Comment 9 Massimo 2015-01-17 13:18:58 UTC
The text is in Japanese, produced with Impress 4.3.5.2 with Japanese interface under Win8.1 Japanese.
As I said above, changing the animation from "after the previous" to "on click" seems to fix the problem. Strange enough, this occurs in some slides, not in others. I can't find a systematic rule, unfortunately.
Comment 10 Robinson Tryon (qubit) 2015-10-07 22:30:00 UTC
Dropping Severity -> critical (we've deprecated the 'blocker' value)
https://wiki.documentfoundation.org/QA/Bugzilla/Fields/Severity#Severity_Levels
Comment 11 Armin Le Grand 2015-11-11 16:21:04 UTC
Tried comment 8 (Can repro crash on Win 4.4 RC2 for attachment 112381 [details]) on win7 LO 5.1.0.0.alpha1+, no crash. Animations worked as expected.
Comment 12 Armin Le Grand 2015-11-11 16:52:34 UTC
Could now reproduce, has to do with basegfx::triangulator which seems to go to endless loops in some cases. Looking deeper...
Comment 13 Armin Le Grand 2015-11-12 09:55:02 UTC
The trick to reproduce is to start the slideshow, click three times (to speedup stuff) and then to wait for the last animation. The last checkerboard animation then seems to create checkerboard geomery with rectangle points so colose that the triangulator gets into trouble. Debugging the triangulator...
Comment 14 Armin Le Grand 2015-11-12 10:45:44 UTC
It is a numerical problem with the checkerboard effect involved, but not specifoc to it. The current slideshow uses the canvas which has to triangulate the geometries to use them. The effect creates a set of masks where the points of the rects are - depending on timing, thus hard to reproduce - sometimes very close. The triangulation gets to numerical trouble in this cases (rarely, but once is enough).
The triangulator uses isPointInTriangle to check, then to see if it's on one of the triangle points compares the points. First uses fTools::equalZero to test the cross product, second uses rtl::math::approxEqual. Thus the situation is that a point close to one of the points of a line is detected as inside the triangle, but the test if it is one of the points later fails.
Using rtl::math::approxEqual(val, 0.0) against zero applies the same order of accuracy to both which solve sthe problem. The cross product will be checked with more accuracy. It could even be checked directly against 0.0 due to the fact that it is pretty stable (the two multiplications create two interim values which have to be in the same value range to give zero when substracted). This is not needed, but a possibility.
Preparing patch...
Comment 15 Armin Le Grand 2015-11-12 11:03:52 UTC
patch on gerrit for review
Comment 16 Commit Notification 2015-11-13 09:26:44 UTC
Armin Le Grand committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=b701bd8cbd46644e28d0dbcae94d5098b72036d8

tdf#88352 correct triangulator numerical problem

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 17 raal 2015-11-19 18:38:06 UTC
No crash or freeze with Version: 5.1.0.0.alpha1+
Build ID: 32d4c03cba399ada807b8ec113a3928aa9e3ff7b
TinderBox: Linux-rpm_deb-x86_64@70-TDF, Branch:master, Time: 2015-11-17_00:57:30
Comment 18 Robinson Tryon (qubit) 2015-12-17 08:44:03 UTC Comment hidden (obsolete)