Bug Hunting Session
Bug 91702 - Assertion `mnRefCnt>0' failed" at include/vcl/outdev.hxx:342
Summary: Assertion `mnRefCnt>0' failed" at include/vcl/outdev.hxx:342
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: BASIC (show other bugs)
Version:
(earliest affected)
5.1.0.0.alpha0+ Master
Hardware: Other All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard: target:5.1.0 target:5.0.0.0.beta2
Keywords: regression
Depends on:
Blocks: VclPtr
  Show dependency treegraph
 
Reported: 2015-05-28 17:30 UTC by Terrence Enger
Modified: 2016-10-25 19:24 UTC (History)
2 users (show)

See Also:
Crash report or crash signature:


Attachments
console output with backtrace without symbols (14.33 KB, text/plain)
2015-05-28 17:30 UTC, Terrence Enger
Details
document with macro (9.03 KB, application/vnd.oasis.opendocument.text)
2015-05-28 18:44 UTC, Terrence Enger
Details
bt with debug symbols (15.96 KB, text/plain)
2015-05-28 19:45 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Terrence Enger 2015-05-28 17:30:46 UTC
Created attachment 116109 [details]
console output with backtrace without symbols

I have seen this happen in versions ...
    Version: 5.1.0.0.alpha1+
    Build ID: be01d68420086fc36ecf26b5f597ba7c6b29b369
    Locale: en-CA (en_CA.UTF-8)
and ...
    Version: 5.1.0.0.alpha1+
    Build ID: 487880b6882ec01c1b4679eae60bec484272a86b
    TinderBox: Win-x86@39, Branch:master, Time: 2015-05-28_04:59:56
    Locale: en-CA (en_CA)

STR

(0) Ensure that your macro security level in LibreOffice is no higher
    than Medium.

(1) Download file example.odt attached to the bug report, and open it
    from the command line.

(2) If the program presents dialog "LibreOfficeDev - Security Warning"
    asking if you want to enable macros in this document, click
    <Enable Macros>.

(3) The program displays window "example.odt - LibreOffice Dev Writer
    ...".  The document has no content.

(4) Take menu options Tools > Macros > "Run Macro...".  The program
    presents dialog "Macro Selector".

(5) In the pane Library, expand example.odt > Standard > and click on
    Module1.  In the pane "Macro Name", the program lists macros crash
    and Main; crash is selected.

(6) Click <Run>.  The program presents dialog "LibreOfficeDev 5.1"
    with message "8.6".

(7) Click <Cancel>.  Crash.
Comment 1 Terrence Enger 2015-05-28 17:44:27 UTC
I see that the problem is absent in the daily dbgutil bibsect version
from 2014-11-28 ...
    Version: 4.5.0.0.alpha0+
    Build ID: 8f031861f590ba914321816657a003375d93ef5d
    Locale: en_CA

Setting "regression" and "bibisectRequest".
Comment 2 Michael Meeks 2015-05-28 18:30:36 UTC
no need to bibisect; that assertion is a vclptr issue - I'll take it - thanks ! =)
Comment 3 Michael Meeks 2015-05-28 18:32:42 UTC
I'm missing example.odt - can you attach ? =)
Comment 4 Terrence Enger 2015-05-28 18:44:23 UTC
Created attachment 116112 [details]
document with macro

As promised in step (1) of bug description.  Talk about overlooking
the obvious!
Comment 5 Julien Nabet 2015-05-28 19:45:45 UTC
Created attachment 116113 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated yesterday (be01d68420086fc36ecf26b5f597ba7c6b29b369), I could reproduce this.

I attached bt with symbols.
Comment 6 Michael Meeks 2015-05-28 20:30:55 UTC
Pushed a fix to gerrit; will merge tomorrow if it builds:

https://gerrit.libreoffice.org/15954

Thanks for the report !
Comment 7 Commit Notification 2015-05-29 12:17:12 UTC
Michael Meeks committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=ba81e5c6bd420b41a84ade6ccd774011a8089f7f

tdf#91702 - fix stack-based MessBox allocation.

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 8 Julien Nabet 2015-05-29 20:52:33 UTC
On pc Debian x86-64 with master sources updated today (d24b7de8f5fa51d9d96249459034e7b3b64583b5), I don't reproduce this.
=>VERIFIED
Comment 9 Terrence Enger 2015-05-30 14:28:04 UTC
And I too see the fix on Linux in LibreOffice version
    Version: 5.1.0.0.alpha1+
    Build ID: 661791da72ec2ddddbba3552279e239f13df1c4f
    Locale: en-CA (en_CA.UTF-8)
and on Vista in LibreOffice version
    Version: 5.1.0.0.alpha1+
    Build ID: 6a626955eb8b803fa58a58baafaa2a06ab4761f2
    TinderBox: Win-x86@39, Branch:master, Time: 2015-05-30_07:46:48
    Locale: en-CA (en_CA)

Setting version 5.1.0.0 alpha0 master, now that it is available.
Comment 10 Commit Notification 2015-06-04 15:56:04 UTC
Michael Meeks committed a patch related to this issue.
It has been pushed to "libreoffice-5-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=07074e0e072f33fe8954eded5cd2495822f5f0e4&h=libreoffice-5-0

tdf#91702 - fix stack-based MessBox allocation.

It will be available in 5.0.0.0.beta2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.