Bug 91416 - EDITING: Crash on changing value in simple spreadsheet
Summary: EDITING: Crash on changing value in simple spreadsheet
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
4.4.2.2 release
Hardware: x86-64 (AMD64) Linux (All)
: medium major
Assignee: Caolán McNamara
URL:
Whiteboard: target:5.1.0 target:5.0.0.0.beta2 ta...
Keywords: haveBacktrace
Depends on:
Blocks: VclPtr
  Show dependency treegraph
 
Reported: 2015-05-20 20:42 UTC by waldo000000
Modified: 2016-10-25 19:24 UTC (History)
7 users (show)

See Also:
Crash report or crash signature:


Attachments
spreadsheet that experiences crash on edit (59.89 KB, application/vnd.oasis.opendocument.spreadsheet)
2015-05-20 20:42 UTC, waldo000000
Details
profile.tar.gz (543.61 KB, application/gzip)
2015-05-23 09:14 UTC, waldo000000
Details
bt with debug symbols (10.49 KB, text/plain)
2015-05-23 11:17 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description waldo000000 2015-05-20 20:42:26 UTC
Created attachment 115758 [details]
spreadsheet that experiences crash on edit

Version: 4.4.2.2
Build ID: 40m0(Build:2)
Locale: en_AU
OS: Xubuntu 15.04

Steps to reproduce:

1) Open attached spreadsheet, forrepro.ods
2) Click in cell I2 in sheet "Target data"
3) Type "1" and press Enter (or click outside)

Expected result: value updated to "1"
Actual result: calc disappears (crashes). On second open, Document Recovery dialog appears
Comment 1 Michael 2015-05-20 21:21:43 UTC
I can not reproduce this on 4.3.7.2 (Fedora 64bit) or on current master (commit 15a7ae3e8008ef7dbafdcb4b7604cac1fe1f9061)
Comment 2 m.a.riosv 2015-05-20 22:52:46 UTC
Hi @waldo000000,

have you test resetting the user profile?, sometimes solves strange issues.

https://wiki.documentfoundation.org/UserProfile
Comment 3 raal 2015-05-22 11:08:24 UTC
No crash with LO 4.4.3, win7
To be certain the reported issue is not related to corruption in the user profile, could you rename this LibreOffice user directory ( see https://wiki.documentfoundation.org/UserProfile#Default_location or http://ask.libreoffice.org/en/question/903/where-are-the-libreoffice-data-profile-files/ ) and re-test?
Comment 4 waldo000000 2015-05-22 22:41:26 UTC
(In reply to raal from comment #3)
> No crash with LO 4.4.3, win7
> To be certain the reported issue is not related to corruption in the user
> profile, could you rename this LibreOffice user directory ( see
> https://wiki.documentfoundation.org/UserProfile#Default_location or
> http://ask.libreoffice.org/en/question/903/where-are-the-libreoffice-data-
> profile-files/ ) and re-test?

Works after following these instructions. Please let me know if I can provide further info (e.g. the user profile) to help get to the root cause.
Comment 5 Julien Nabet 2015-05-23 00:05:06 UTC
If you have still the old profile, you can zip it and attach it by using this link:
https://bugs.documentfoundation.org/attachment.cgi?bugid=91416&action=enter

(Let's lower the priority meanwhile since it's ok with a new LO profile)
Comment 6 waldo000000 2015-05-23 09:14:01 UTC
Created attachment 115871 [details]
profile.tar.gz

Here's the backed up profile that seems to have caused the issue.
Comment 7 Julien Nabet 2015-05-23 11:17:08 UTC
Created attachment 115882 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated yesterday + LO profile provided by the reporter, I could reproduce the crash.
Comment 8 Julien Nabet 2015-05-23 11:45:56 UTC
Michael: 
noticing that pVirtDev were ScopedVclPtrInstance in all the other locations than editeng/source/editeng/impedit.hxx, I tried this patch:
diff --git a/editeng/source/editeng/impedit.hxx b/editeng/source/editeng/impedit.hxx
index c6186b9..4fdc3dd 100644
--- a/editeng/source/editeng/impedit.hxx
+++ b/editeng/source/editeng/impedit.hxx
@@ -422,7 +422,7 @@ private:
     SfxStyleSheetPool*  pStylePool;
     SfxItemPool*        pTextObjectPool;
 
-    VclPtr< VirtualDevice> pVirtDev;
+    ScopedVclPtrInstance< VirtualDevice> pVirtDev;
     VclPtr< OutputDevice > pRefDev;
 
     svtools::ColorConfig*   pColorConfig;
@@ -1068,9 +1068,6 @@ inline EditSelection ImpEditEngine::CreateSel( const ESelection& rSel )
 
 inline VirtualDevice* ImpEditEngine::GetVirtualDevice( const MapMode& rMapMode, DrawModeFlags nDrawMode )
 {
-    if ( !pVirtDev )
-        pVirtDev = new VirtualDevice;
-
     if ( ( pVirtDev->GetMapMode().GetMapUnit() != rMapMode.GetMapUnit() ) ||
          ( pVirtDev->GetMapMode().GetScaleX() != rMapMode.GetScaleX() ) ||
          ( pVirtDev->GetMapMode().GetScaleY() != rMapMode.GetScaleY() ) )
diff --git a/editeng/source/editeng/impedit2.cxx b/editeng/source/editeng/impedit2.cxx
index 7905893..81102ab 100644
--- a/editeng/source/editeng/impedit2.cxx
+++ b/editeng/source/editeng/impedit2.cxx
@@ -106,7 +106,6 @@ ImpEditEngine::ImpEditEngine( EditEngine* pEE, SfxItemPool* pItemPool ) :
 {
     pEditEngine         = pEE;
     pRefDev             = NULL;
-    pVirtDev            = NULL;
     pEmptyItemSet       = NULL;
     pActiveView         = NULL;
     pSpellInfo          = NULL;

I still got a crash but with a different bt.
Anyway, is this patch ok for VclPtr management?
Comment 9 Michael Meeks 2015-05-26 15:34:04 UTC
Interesting; there was another crash on edit that Markus fixed just the other day - which is an autocorrect foo. I've fixed up a number of VirtualDevice lifecycle issues - thanks Julien for that pointer; I think it's prolly best not to use the ScopedVclPtr for that here: ScopedVclPtr behaves somewhat oddly. Test build running here: https://gerrit.libreoffice.org/15913
Comment 10 Commit Notification 2015-05-26 16:48:39 UTC
Michael Meeks committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=f849d96463d967214bc063f6de912a082272c395

tdf#91416 - fix some incorrectly allocated VirtualDevices.

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 11 Commit Notification 2015-05-27 12:56:12 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=e3c1a394a00cef416a81b89b6d5c204891abb286

Resolves: tdf#91416 setting progress -> resize -> destroy formula context

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 12 Commit Notification 2015-05-27 12:58:50 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-5-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=3a34f96a16ad3063302670a57a1ed508302e3ffb&h=libreoffice-5-0

Resolves: tdf#91416 setting progress -> resize -> destroy formula context

It will be available in 5.0.0.0.beta2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 13 Commit Notification 2015-05-27 13:00:10 UTC
Michael Meeks committed a patch related to this issue.
It has been pushed to "libreoffice-5-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=f34c1e9ba7d831c42c89d3c59d501ce6cc858dbe&h=libreoffice-5-0

tdf#91416 - fix some incorrectly allocated VirtualDevices.

It will be available in 5.0.0.0.beta2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 14 Julien Nabet 2015-05-28 17:53:24 UTC
Confirmed it's ok with master sources updated yesterday (be01d68420086fc36ecf26b5f597ba7c6b29b369)

Thank you Michael (+Caolan)! :-)
Comment 15 Commit Notification 2015-06-15 09:57:59 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-4-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=15f70281384da36a41dc1cbe1b5d01d4704df636&h=libreoffice-4-4

Resolves: tdf#91416 setting progress -> resize -> destroy formula context

It will be available in 4.4.5.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.