Bug Hunting Session
Bug 91395 - Accessibility Crash in Special Characters dialog
Summary: Accessibility Crash in Special Characters dialog
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: UI (show other bugs)
Version:
(earliest affected)
5.0.0.0.alpha0+ Master
Hardware: Other All
: high major
Assignee: Not Assigned
URL:
Whiteboard: target:5.1.0 target:5.0.0.0.beta2
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks: VclPtr
  Show dependency treegraph
 
Reported: 2015-05-19 16:30 UTC by Matthew Francis
Modified: 2016-10-25 19:20 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:


Attachments
Linux 5.0 master backtrace (9.70 KB, text/plain)
2015-05-19 16:31 UTC, Matthew Francis
Details
Linux 5.0 master backtrace (after comment 4 patch) (10.07 KB, text/plain)
2015-05-20 03:37 UTC, Matthew Francis
Details
Reproducer script (535 bytes, text/x-python)
2015-05-20 04:27 UTC, Matthew Francis
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Matthew Francis 2015-05-19 16:30:04 UTC
Apparently another VclPtr one:

Unfortunately this is only reproducible under the experimental UI testing automation I've been working on, and not by hand, but the crash doesn't occur in builds before VclPtr was merged.

What the test is doing is:
- Open a new Writer window
- Open "Insert - Special Character..."
- Click on the table cell "!"
- Click on the button "Insert"
Comment 1 Matthew Francis 2015-05-19 16:31:20 UTC
Created attachment 115726 [details]
Linux 5.0 master backtrace

(5f653490a40850886f94c9fd6b381b4bed1de58a)
Comment 2 Matthew Francis 2015-05-19 16:33:08 UTC
Confirmed with (also unpublished ;) bibisect-50max - this started at exactly the below commit
Adding Cc: to michael.meeks@collabora.com; Could you possibly take a look at this one? Thanks

    commit e8b97a52c96df9c8e8055407b1e40ed7cb9cfc67
    Merge: 2b0be6c 0cde74f
    Author:     Michael Meeks <michael.meeks@collabora.com>
    AuthorDate: Tue Apr 28 11:41:31 2015 +0100
    Commit:     Michael Meeks <michael.meeks@collabora.com>
    CommitDate: Tue Apr 28 15:08:48 2015 +0100
    
        Merge remote-tracking branch 'origin/feature/vclptr'
Comment 3 Matthew Francis 2015-05-19 16:58:01 UTC
Additional information on the last part of the reproduction - in fact it's doing an accessibility action "press" of the button. If a mouse click is simulated instead, no crash
Comment 4 Julien Nabet 2015-05-19 19:42:05 UTC
Could you give a try with this patch?
diff --git a/svx/source/dialog/charmap.cxx b/svx/source/dialog/charmap.cxx
index c57a4e3..7ec9edd 100644
--- a/svx/source/dialog/charmap.cxx
+++ b/svx/source/dialog/charmap.cxx
@@ -219,7 +219,7 @@ sal_uInt16 SvxShowCharSet::GetColumnPos(sal_uInt16 _nPos)
 int SvxShowCharSet::FirstInView() const
 {
     int nIndex = 0;
-    if (aVscrollSB->IsVisible())
+    if (aVscrollSB && aVscrollSB->IsVisible())
         nIndex += aVscrollSB->GetThumbPos() * COLUMN_COUNT;
     return nIndex;
 }

Indeed, aVscrollSB has already been disposed, your bt shows svx/source/dialog/charmap.cxx:699 (frame 7), see:
    694 void SvxShowCharSet::dispose()
    695 {
    696     if ( m_pAccessible )
    697         ReleaseAccessible();
    698     aVscrollSB.disposeAndClear();
    699     Control::dispose();
    700 }
Comment 5 Matthew Francis 2015-05-20 03:37:52 UTC
Created attachment 115738 [details]
Linux 5.0 master backtrace (after comment 4 patch)

With the patch it gets slightly further, but still ends up crashing with a different trace
Comment 6 Matthew Francis 2015-05-20 04:27:43 UTC
Created attachment 115739 [details]
Reproducer script

Attached is a minimal reproducer, without various setup dependencies the original script has

To run it you'll need:
- Python 2 (everyone should have)
- A release dogtail package (e.g. python-dogtail on Ubuntu)
- LibreOffice running with a single Writer window open and accessibility enabled (export SAL_USE_VCLPLUGIN="gtk" GTK_MODULES="gail:atk-bridge")
Comment 7 Commit Notification 2015-05-22 12:30:30 UTC
Michael Meeks committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=1940d8b85b6cb7321ded254e092cd55bee7007aa

tdf#91395 - avoid post-dispose charmap crasher.

It will be available in 5.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 8 Michael Meeks 2015-05-22 12:58:10 UTC
Hopefully I nailed it - can you re-try with master ? =)
Comment 9 Matthew Francis 2015-05-22 13:54:38 UTC
Looks good now - thanks!
Comment 10 Commit Notification 2015-05-22 14:30:30 UTC
Michael Meeks committed a patch related to this issue.
It has been pushed to "libreoffice-5-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=15b6db458f5516377703bab8a2860d43753441ed&h=libreoffice-5-0

tdf#91395 - avoid post-dispose charmap crasher.

It will be available in 5.0.0.0.beta2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 11 Robinson Tryon (qubit) 2015-12-17 09:10:31 UTC Comment hidden (obsolete)