Bug 91188 - UI: Crash after undocking Sidebar and switching between items on TabBar
Summary: UI: Crash after undocking Sidebar and switching between items on TabBar
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: UI (show other bugs)
Version:
(earliest affected)
5.0.0.0.alpha0+ Master
Hardware: x86-64 (AMD64) Windows (All)
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: VclPtr
  Show dependency tree / graph
 
Reported: 2015-05-09 16:50 UTC by Gordo
Modified: 2015-05-23 11:49 UTC (History)
5 users (show)

See Also:
Crash report or crash signature:

Attachments
backtrace (16.06 KB, text/plain)
2015-05-09 18:20 UTC, Gordo 		Details
patch for crash (884 bytes, patch)
2015-05-21 22:03 UTC, Markus Mohrhard 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Gordo 2015-05-09 16:50:50 UTC 
I did this in Writer and Draw.

1. Undock Sidebar.
2. Click on Styles and Formatting or Navigator in TabBar.
Result:
Crash.

1. Undock Sidebar.
2. Redock Sidebar.
3. Close application or click on Styles and Formatting or Navigator in TabBar.
Result:
Crash.

Maybe related to commit in bug 91128 or commit mentioned in comment_2 of that bug.  Or maybe even the commit in bug 72007.

I don't have a backtrace because it is taking forever with my connection to download the symbols.

Version: 5.0.0.0.alpha1+
Build ID: 0aa2fd972f8c611df5292ac6ca345fc8d2b223c9
TinderBox: Win-x86@39, Branch:master, Time: 2015-05-09_08:46:26
Comment 1 Gordo 2015-05-09 18:20:45 UTC 
Created attachment 115476 [details]
backtrace
Comment 2 raal 2015-05-11 16:44:11 UTC 
I can confirm with Version: 5.0.0.0.alpha1+
Build ID: ceb6f473837261f2a6e43e028ce9da3daccc2f6c
TinderBox: Linux-rpm_deb-x86_64@46-TDF, Branch:master, Time: 2015-05-11_13:16:38
Comment 3 Julien Nabet 2015-05-18 20:40:57 UTC 
On pc Debian x86-64 with master sources updated today, I don't reproduce this.

I think it could be related to VclPtr problem. Try an even newer version since related bugs have been fixed in these last days.
Comment 4 Gordo 2015-05-18 23:08:10 UTC 
Still happening.

Windows Vista 64
Version: 5.0.0.0.alpha1+
Build ID: 60fb87cf6cfcbdb1a7ece00e8a2e9d1112903ed0
TinderBox: Win-x86@39, Branch:master, Time: 2015-05-18_14:12:34
Comment 5 Philippe Jung 2015-05-19 13:47:02 UTC 
Work under linux with fresh git master build
Comment 6 Markus Mohrhard 2015-05-21 22:03:28 UTC 
Created attachment 115787 [details]
patch for crash

(In reply to Philippe Jung from comment #5)
> Work under linux with fresh git master build

Nope. I can reproduce the current issue with a clean master dbgutil build.

The issue is that ToolBox::dispose calls DockingWindow::dispose which calls GrabFocus for each parent which calls LooseFocus on the ToolBox that called dispose. That accesses mpData which has been deleted in ToolBox::dispose already.

I assume the attached patch is an acceptable fix
Comment 7 Michael Meeks 2015-05-22 11:18:50 UTC 
Thanks Markus - patch looks great to me; pushed.
Comment 8 Buovjaga 2015-05-23 11:49:27 UTC 
No crash.

Win 7 Pro 64-bit Version: 5.1.0.0.alpha1+
Build ID: d8208da8576874fdb07014287e6cbc0aeba741bb
TinderBox: Win-x86@39, Branch:master, Time: 2015-05-23_09:23:03
Locale: fi-FI (fi_FI)