Bug Hunting Session
Bug 91672 - Crash in base report - right click in page header section
Summary: Crash in base report - right click in page header section
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Base (show other bugs)
Version:
(earliest affected)
5.0.0.0.alpha0+ Master
Hardware: Other Linux (All)
: medium critical
Assignee: Caolán McNamara
URL:
Whiteboard: target:5.1.0 target:5.0.0.0.beta2
Keywords: bibisected, haveBacktrace, regression
Depends on:
Blocks: VclPtr
  Show dependency treegraph
 
Reported: 2015-05-27 17:16 UTC by raal
Modified: 2016-10-25 19:17 UTC (History)
7 users (show)

See Also:
Crash report or crash signature:


Attachments
Linux backtrace (4.06 KB, text/plain)
2015-05-28 17:08 UTC, Matthew Francis
Details

Note You need to log in before you can comment on or make changes to this bug.
Description raal 2015-05-27 17:16:32 UTC
Base
new file
reports -  new report in design mode
delete Detail section (right click Delete Page header/footer)
right click in page header section (in white area)
left click outside of context menu (context menu disappear)
right click  in page header section (in white area)
error message with "!", click OK
Crash
Comment 1 raal 2015-05-27 17:16:56 UTC
Version: 5.1.0.0.alpha1+
Build ID: b9630867d17c01ec41f6461b1e96288f3932248c
TinderBox: Linux-rpm_deb-x86_64@46-TDF, Branch:master, Time: 2015-05-25_00:46:48
Comment 2 DavidO 2015-05-28 14:48:11 UTC
Backtrace:

http://paste.openstack.org/show/242354/
Comment 3 DavidO 2015-05-28 15:09:23 UTC
Comparing the deletion to LO 4.1.6.2, it looks like erroneously the repost section is deleted and not header and footer.
Comment 4 Matthew Francis 2015-05-28 17:00:02 UTC
Unfortunately whatever caused this is masked by a long (separate) VclPtr related breakage

It's somewhere in aef1826d9ca318a1359a2116e7f146e993413234^1..7a7a908263fc5761e963606d063bf1154112b87f (1084 commits)
Comment 5 Matthew Francis 2015-05-28 17:08:33 UTC
Created attachment 116108 [details]
Linux backtrace

Copied backtrace into attachment
Comment 6 DavidO 2015-05-28 19:24:22 UTC
Just verified, that this commit still works: [1].

[1] 352c40dd5ce715f6ae654b8dedf2fc2145275a1d
Comment 7 Michael Meeks 2015-05-29 12:56:59 UTC
Interesting the '!' I get is a fatal UNO error thrown to here:

#6  0x00007f142559263c in Application::ShowNativeErrorBox (sTitle="LibreOfficeDev 5.0 - Fatal Error", sMessage="") at /data/opt/libreoffice/master/vcl/source/app/svapp.cxx:1537
#7  0x00007f142c0539da in desktop::(anonymous namespace)::FatalError (sMessage="") at /data/opt/libreoffice/master/desktop/source/app/app.cxx:437
#8  0x00007f142c0582a9 in desktop::Desktop::Main (this=0x7fffb6d8b5c0) at /data/opt/libreoffice/master/desktop/source/app/app.cxx:1621
#9  0x00007f1425597a09 in ImplSVMain () at /data/opt/libreoffice/master/vcl/source/app/svmain.cxx:162

(gdb) p exUNO
$1 = (const com::sun::star::uno::Exception &) @0x33873d0: {Message = "", Context = empty uno::Reference}

Will poke in a bit.
Comment 8 Michael Meeks 2015-05-29 17:25:12 UTC
the last __cxx_throw before this had a trace of:

Breakpoint 1, 0x00007ffff6b519c0 in __cxa_throw () from /usr/lib64/libstdc++.so.6
#0  0x00007ffff6b519c0 in __cxa_throw () from /usr/lib64/libstdc++.so.6
#1  0x00007fffba5bf2c7 in SvxDrawPage::getCount (this=0x1aa8ad0) at /data/opt/libreoffice/master/svx/source/unodraw/unopage.cxx:334
#2  0x00007fffa1bf63c8 in reportdesign::OSection::getCount (this=0x183a8a0) at /data/opt/libreoffice/master/reportdesign/source/core/api/Section.cxx:468
#3  0x00007fffa173c997 in rptui::OReportController::GetState (this=0x1b108e0, _nId=12615) at /data/opt/libreoffice/master/reportdesign/source/ui/report/ReportController.cxx:517
#4  0x00007fffb71b16cc in dbaui::OGenericUnoController::isCommandChecked (this=0x1b108e0, _nCommandId=12615) at /data/opt/libreoffice/master/dbaccess/source/ui/browser/genericcontroller.cxx:1430
#5  0x00007fffa176fc84 in rptui::lcl_insertMenuItemImages (rContextMenu=..., rController=..., _xReportDefinition=uno::Reference to (reportdesign::OReportDefinition *) 0x19fec40, _rFrame=uno::Reference to ((anonymous namespace)::Frame *) 0x1b68798) at /data/opt/libreoffice/master/reportdesign/source/ui/report/ReportSection.cxx:469
#6  0x00007fffa176fac0 in rptui::lcl_insertMenuItemImages (rContextMenu=..., rController=..., _xReportDefinition=uno::Reference to (reportdesign::OReportDefinition *) 0x19fec40, _rFrame=uno::Reference to ((anonymous namespace)::Frame *) 0x1b68798) at /data/opt/libreoffice/master/reportdesign/source/ui/report/ReportSection.cxx:452
#7  0x00007fffa176fe94 in rptui::OReportSection::Command (this=0x1a1ebe0, _rCEvt=...) at /data/opt/libreoffice/master/reportdesign/source/ui/report/ReportSection.cxx:485
#8  0x00007ffff096a4ca in ImplCallCommand (pChild=0x1a1ebe0, nEvt=ContextMenu, pData=0x0, bMouse=true, pPos=0x7fffffffc5a0) at /data/opt/libreoffice/master/vcl/source/window/winproc.cxx:226
#9  0x00007ffff096c45e in ImplHandleMouseEvent (pWindow=0x1b8f010, nSVEvent=MOUSEBUTTONDOWN, bMouseLeave=false, nX=386, nY=193, nMsgTime=1998538276, nCode=4, nMode=NONE) at /data/opt/libreoffice/master/vcl/source/window/winproc.cxx:821
#10 0x00007ffff0972c77 in ImplHandleSalMouseButtonDown (pWindow=0x1b8f010, pEvent=0x7fffffffcb10) at /data/opt/libreoffice/master/vcl/source/window/winproc.cxx:2085
#11 0x00007ffff097141d in ImplWindowFrameProc (_pWindow=0x1b8f010, nEvent=3, pEvent=0x7fffffffcb10) at /data/opt/libreoffice/master/vcl/source/window/winproc.cxx:2411
#12 0x00007fffe3053d50 in SalFrame::CallCallback (this=0x17feb80, nEvent=3, pEvent=0x7fffffffcb10) at /data/opt/libreoffice/master/vcl/inc/salframe.hxx:244
#13 0x00007fffe304fc5c in GtkSalFrame::signalButton (pEvent=0x1a00480, frame=0x17feb80) at /data/opt/libreoffice/master/vcl/unx/gtk/window/gtksalframe.cxx:3293
#14 0x00007fffe2a829f5 in ?? () from /usr/lib64/libgtk-x11-2.0.so.0

which I can only assume is un-caught.
Comment 9 Michael Meeks 2015-05-29 19:51:40 UTC
Interestingly; the OReportSection that the Command is called on shows no sign of being disposed:

Breakpoint 2, rptui::OReportSection::Command (this=0x18e1e80, _rCEvt=...) at /data/opt/libreoffice/master/reportdesign/source/ui/report/ReportSection.cxx:477
477	    Window::Command(_rCEvt);
(gdb) p *this
$7 = (rptui::OReportSection) {<vcl::Window> = {<OutputDevice> = {_vptr.OutputDevice = 0x7fffa2a14c50 <vtable for rptui::OReportSection+16>, mnRefCnt = 22, mpGraphics = 0x218f5a0, mpPrevGraphics = {m_rInnerRef = empty rtl::Reference}, mpNextGraphics = {m_rInnerRef = rtl::Reference to 0x2109e80}, mpMetaFile = 0x0, mpFontEntry = 0x0, mpFontCache = 0x12d08a0, mpFontCollection = 0x12d3600, mpGetDevFontList = 0x0, mpGetDevSizeList = 0x0, mpOutDevStateStack = 0x18e2150, mpOutDevData = 0x18e21d0, mpUnoGraphicsList = 0x0, mpPDFWriter = 0x0, mpExtOutDevData = 0x0, mpAlphaVDev = {m_rInnerRef = empty rtl::Reference}, mnOutOffOrigX = 0, mnOutOffLogicX = 0, mnOutOffOrigY = 0, mnOutOffLogicY = 0, mnOutOffX = 125, mnOutOffY = 138, mnOutWidth = 816, mnOutHeight = 113, mnDPIX = 96, mnDPIY = 96, mnDPIScaleFactor = 1, mnTextOffX = 0, mnTextOffY = 0, mnEmphasisAscent = 0, mnEmphasisDescent = 0, mnDrawMode = Default, mnTextLayoutMode = TEXT_LAYOUT_DEFAULT, maMapRes = {mnMapOfsX = 0, mnMapOfsY = 0, mnMapScNumX = 1, mnMapScNumY = 1, mnMapScDenomX = 2540, mnMapScDenomY = 2540, mfOffsetX = 0, mfOffsetY = 0, mfScaleX = 0.0003937007874015748, mfScaleY = 0.0003937007874015748}, maThresRes = {mnThresLogToPixX = 48038396025285284, mnThresLogToPixY = 48038396025285284, mnThresPixToLogX = 1815624416703696, mnThresPixToLogY = 1815624416703696}, meOutDevType = OUTDEV_WINDOW, meOutDevViewType = OUTDEV_VIEWTYPE_DONTKNOW, maRegion = {mpB2DPolyPolygon = std::shared_ptr (empty) 0x0, mpPolyPolygon = std::shared_ptr (empty) 0x0, mpRegionBand = std::shared_ptr (empty) 0x0, mbIsNull = true}, maLineColor = rgb(0, 0, 0), maFillColor = rgb(255, 255, 255), maFont = {mpImplFont = 0x18e3bd0}, maTextColor = rgb(49, 55, 57), maTextLineColor = rgba(255, 255, 255, 255), maOverlineColor = rgba(255, 255, 255, 255), meTextAlign = ALIGN_TOP, meRasterOp = ROP_OVERPAINT, maBackground = {mpImplWallpaper = 0x18e3cd0}, mxSettings = std::unique_ptr<AllSettings> containing 0x18e08e0, maMapMode = {mpImplMapMode = 0x7ffff172b140 <MapMode::ImplMapMode::ImplGetStaticMapMode(MapUnit)::aStaticImplMapModeAry>}, maRefPoint = Point = {x = 0, y = 0}, mnAntialiasing = NONE, meTextLanguage = 0, mbMap = true, mbMapIsDefault = true, mbClipRegion = false, mbBackground = true, mbOutput = true, mbDevOutput = true, mbOutputClipped = false, mbLineColor = true, mbFillColor = true, mbInitLineColor = true, mbInitFillColor = true, mbInitFont = true, mbInitTextColor = true, mbInitClipRegion = true, mbClipRegionSet = true, mbKerning = false, mbNewFont = true, mbTextLines = false, mbTextBackground = false, mbTextSpecial = false, mbRefPoint = false, mbEnableRTL = false, mbDisposed = false}, <Resource> = {m_pResMgr = 0x0}, mpWindowImpl = 0x18e3780}, 

So - presumably some other badness ensures that the related

sal_Int32 SAL_CALL SvxDrawPage::getCount()
    throw( uno::RuntimeException, std::exception )
{
    SolarMutexGuard aGuard;

    if( (mpModel == 0) || (mpPage == 0) )
        throw lang::DisposedException();

exception gets thrown ...
Comment 10 Commit Notification 2015-06-08 14:21:28 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=43cc6fa1fa704ff53e56e8fe34e673c6733c9b4e

Resolves: tdf#91672 Crash in base report - right click in page header section

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 11 Commit Notification 2015-06-08 14:23:04 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-5-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=2bd7e85de0fefe83d1891592dd0b1647a817307e&h=libreoffice-5-0

Resolves: tdf#91672 Crash in base report - right click in page header section

It will be available in 5.0.0.0.beta2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 12 Robinson Tryon (qubit) 2015-12-17 09:12:53 UTC Comment hidden (obsolete)