Bug 91789 - UI: Crash on exit after format header
Summary: UI: Crash on exit after format header
Status: RESOLVED WORKSFORME
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
5.0.1.2 release
Hardware: All All
: highest critical
Assignee: Not Assigned
URL:
Whiteboard:
Keywords: bibisected, needUITest, regression
: 94364 94637 (view as bug list)
Depends on:
Blocks:
 
Reported: 2015-06-01 09:56 UTC by Gordo
Modified: 2018-02-01 17:49 UTC (History)
7 users (show)

See Also:
Crash report or crash signature:

Attachments
backtrace (17.18 KB, text/plain)
2015-06-01 09:56 UTC, Gordo 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Gordo 2015-06-01 09:56:50 UTC 
Created attachment 116215 [details]
backtrace

1. New Text Document.
2. Click on header part of document to get blue popover and click on it.
3. Click on blue popover again and Format Header.
4. Cancel Page dialogue.
5. Exit application.
Result:
Crash.

Or
1. New Text Document.
2. Right click on document → Page.
3. In Header tab, check “Header on” and OK.
4. Right click on document → Page.
5. Cancel Page dialogue.
6. Exit application.
Result:
Crash.

Windows Vista 64
Version: 5.1.0.0.alpha1+
Build ID: cba920edf88bef06a6689e7847c5789dd3ee67b7
TinderBox: Win-x86@39, Branch:master, Time: 2015-06-01_04:22:29
Comment 1 raal 2015-06-02 13:32:38 UTC 
I can confirm crash with Version: 5.1.0.0.alpha1+
Build ID: cba920edf88bef06a6689e7847c5789dd3ee67b7
TinderBox: Win-x86@39, Branch:master, Time: 2015-06-01_04:22:29
Comment 2 Cor Nouws 2015-09-26 10:06:10 UTC 
*** Bug 94364 has been marked as a duplicate of this bug. ***
Comment 3 Cor Nouws 2015-09-26 10:08:42 UTC 
1. Format > Page … Header
2. Turn Header of or set Same on first and next pages (see duplicate issue)
3. OK
4. File > Close  .. choose Disgard 
  .. Crash
Comment 4 Cor Nouws 2015-09-30 11:23:21 UTC 
*** Bug 94637 has been marked as a duplicate of this bug. ***
Comment 5 Björn Michaelsen 2015-10-13 10:14:59 UTC 
# bad: [dda106fd616b7c0b8dc2370f6f1184501b01a49e] source-hash-0db96caf0fcce09b87621c11b584a6d81cc7df86
# good: [5b9dd620df316345477f0b6e6c9ed8ada7b6c091] source-hash-2851ce5afd0f37764cbbc2c2a9a63c7adc844311
git bisect start 'latest' 'oldest'
# good: [0c30a2c797b249d0cd804cb71554946e2276b557] source-hash-45aaec8206182c16025cbcb20651ddbdf558b95d
git bisect good 0c30a2c797b249d0cd804cb71554946e2276b557
# bad: [2ce02b2ce56f12b9fcb9efbd380596975a3a5686] source-hash-17d714eef491bda2512ba8012e5b3067ca19a5be
git bisect bad 2ce02b2ce56f12b9fcb9efbd380596975a3a5686
# bad: [e4deb8a42948865b7b23d447c1547033cb54535b] source-hash-ce46c98dbeb3364684843daa5b269c74fce2af64
git bisect bad e4deb8a42948865b7b23d447c1547033cb54535b
# good: [15e8b5cc6b4784fecd63b2a5a04ac086b3e9fc01] source-hash-26b500afcaed704db7a300836f466517c309ee77
git bisect good 15e8b5cc6b4784fecd63b2a5a04ac086b3e9fc01
# bad: [73235831b07a9812413e0b0f5d0ba24b89206933] source-hash-6934ad423afd43d4d5c3788d0c020164309aaffa
git bisect bad 73235831b07a9812413e0b0f5d0ba24b89206933
# good: [dfc554b5db5524f4a3c4b0c9c74fceffb4b72308] source-hash-d4267231754c1e6b03c7723a6fecc46750e7c780
git bisect good dfc554b5db5524f4a3c4b0c9c74fceffb4b72308
# bad: [ef2fab55f93993a74ca27fddb3a18cf9164a1932] source-hash-144ab285566afa18790356b5497573290ee710bf
git bisect bad ef2fab55f93993a74ca27fddb3a18cf9164a1932
# bad: [43807575eac7b39e7d7b33113ecf26060bc93ca5] source-hash-bf56e080cc092cacc779add9dfc7e7df291eef41
git bisect bad 43807575eac7b39e7d7b33113ecf26060bc93ca5
# good: [0c92c0589cce2ec956b2a8a44cd6fcc12853262d] source-hash-29492f2901ba80aba5da35a4b1780b14ff090878
git bisect good 0c92c0589cce2ec956b2a8a44cd6fcc12853262d
# bad: [68f4758bd5ec36ed8753b0f12098d34d37d52ca5] source-hash-5229726b4d4e7d76f410d221f8f8cd8abcfd5a19
git bisect bad 68f4758bd5ec36ed8753b0f12098d34d37d52ca5
# bad: [41e8b42d520cb2aa2dcff3bf3a87b0bcadada6b5] source-hash-f7424ed710e54bb2437a28380b03ed7c26290edc
git bisect bad 41e8b42d520cb2aa2dcff3bf3a87b0bcadada6b5
# good: [1568d523eb6569db6206e9d633f2c352e2105b1d] source-hash-a21948bddfefa8554fb2d468616ec1bfda128e9d
git bisect good 1568d523eb6569db6206e9d633f2c352e2105b1d
# good: [fae0e8583cf7a430582973a2209cbd27a98321df] source-hash-e3167924fd28c8b854f23139dbf49f53e6282ef7
git bisect good fae0e8583cf7a430582973a2209cbd27a98321df
# first bad commit: [41e8b42d520cb2aa2dcff3bf3a87b0bcadada6b5] source-hash-f7424ed710e54bb2437a28380b03ed7c26290edc

Thus seems to be caused by:
commit f7424ed710e54bb2437a28380b03ed7c26290edc
Author: Zolnai Tamás <zolnaitamas2000@gmail.com>
Date:   Sun Mar 15 13:29:53 2015 +0100

    SfxTabDialog: avoid changing const input parameter
    
    * SfxTabDialog constructor has a const pointer parameter
    pointing  to the input set and also the corresponding member
    is a const pointer which indicated that set is not changed by
    the dialog, but this is not true, const is casted away and
    the input set is changed.
    * So use a copy of the input set instead, pointed by
    a non-const member, so we can spare some const cast and
    misunderstandings.
    * GetRefreshedSet not behaves as a getter method, but changes
    the input set instead, so redeclare it accordingly.
    
    Change-Id: Ic63f9ae68c50e65d4498b20f597547c1c075b94e
Comment 6 Björn Michaelsen 2015-10-15 13:29:31 UTC 
Not reproducable on todays master with gtk3 backend.
Comment 7 Björn Michaelsen 2015-10-15 16:56:43 UTC 
Crashes with a the 5.1 debug bibisect repo through the whole range though:
0x00007ffff334a2d2 in std::_Hashtable<SfxPoolItem*, std::pair<SfxPoolItem* const, unsigned int>, std::allocator<SfxPoolItem*>, std::__detail::_Select1st, std::equal_to<SfxPoolItem*>, std::hash<SfxPoolItem*>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, false, true> >::_M_bucket_index(SfxPoolItem* const&, unsigned long) const ()
   from /home/bjoern/bibisect/lo-linux-dbgutil-daily/opt/program/libsvllo.so
(gdb) bt
#0  0x00007ffff334a2d2 in std::_Hashtable<SfxPoolItem*, std::pair<SfxPoolItem* const, unsigned int>, std::allocator<SfxPoolItem*>, std::__detail::_Select1st, std::equal_to<SfxPoolItem*>, std::hash<SfxPoolItem*>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, false, true> >::_M_bucket_index(SfxPoolItem* const&, unsigned long) const
    () from /home/bjoern/bibisect/lo-linux-dbgutil-daily/opt/program/libsvllo.so
#1  0x00007ffff3347602 in std::_Hashtable<SfxPoolItem*, std::pair<SfxPoolItem* const, unsigned int>, std::allocator<SfxPoolItem*>, std::__detail::_Select1st, std::equal_to<SfxPoolItem*>, std::hash<SfxPoolItem*>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, false, true> >::find(SfxPoolItem* const&) ()
   from /home/bjoern/bibisect/lo-linux-dbgutil-daily/opt/program/libsvllo.so
#2  0x00007ffff3344957 in std::__cxx1998::unordered_map<SfxPoolItem*, unsigned int, std::hash<SfxPoolItem*>, std::equal_to<SfxPoolItem*>, std::allocator<SfxPoolItem*> >::find(SfxPoolItem* const&) ()
   from /home/bjoern/bibisect/lo-linux-dbgutil-daily/opt/program/libsvllo.so
#3  0x00007ffff33412ad in std::__debug::unordered_map<SfxPoolItem*, unsigned int, std::hash<SfxPoolItem*>, std::equal_to<SfxPoolItem*>, std::allocator<SfxPoolItem*> >::find(SfxPoolItem* const&) ()
   from /home/bjoern/bibisect/lo-linux-dbgutil-daily/opt/program/libsvllo.so
#4  0x00007ffff333d014 in SfxItemPool::Remove(SfxPoolItem const&) ()
   from /home/bjoern/bibisect/lo-linux-dbgutil-daily/opt/program/libsvllo.so
#5  0x00007ffff3363d5f in SfxItemSet::~SfxItemSet() ()
   from /home/bjoern/bibisect/lo-linux-dbgutil-daily/opt/program/libsvllo.so
#6  0x00007fffb29dd8fc in SwAttrSet::~SwAttrSet() ()
   from /home/bjoern/bibisect/lo-linux-dbgutil-daily/opt/program/../program/libswlo.so
#7  0x00007fffb29da7c5 in SwFmt::~SwFmt() ()
   from /home/bjoern/bibisect/lo-linux-dbgutil-daily/opt/program/../program/libswlo.so
#8  0x00007fffb2e0be55 in SwFrmFmt::~SwFrmFmt() ()
   from /home/bjoern/bibisect/lo-linux-dbgutil-daily/opt/program/../program/libswlo.so
#9  0x00007fffb2e0be8a in SwFrmFmt::~SwFrmFmt() ()
   from /home/bjoern/bibisect/lo-linux-dbgutil-daily/opt/program/../program/libswlo.so
#10 0x00007fffb2e027ba in ?? ()
   from /home/bjoern/bibisect/lo-linux-dbgutil-daily/opt/program/../program/libswlo.so
#11 0x00007fffb2e03c57 in SwFmtHeader::~SwFmtHeader() ()
   from /home/bjoern/bibisect/lo-linux-dbgutil-daily/opt/program/../program/libswlo.so
#12 0x00007fffb2e03cac in SwFmtHeader::~SwFmtHeader() ()
   from /home/bjoern/bibisect/lo-linux-dbgutil-daily/opt/program/../program/libswlo.so
#13 0x00007ffff333b5db in SfxItemPool::Delete() ()
   from /home/bjoern/bibisect/lo-linux-dbgutil-daily/opt/program/libsvllo.so
#14 0x00007ffff333a668 in SfxItemPool::~SfxItemPool() ()
   from /home/bjoern/bibisect/lo-linux-dbgutil-daily/opt/program/libsvllo.so
#15 0x00007fffb29deece in ?? ()
   from /home/bjoern/bibisect/lo-linux-dbgutil-daily/opt/program/../program/libswlo.so
#16 0x00007fffb29deefe in ?? ()
   from /home/bjoern/bibisect/lo-linux-dbgutil-daily/opt/program/../program/libswlo.so
#17 0x00007ffff333a94a in SfxItemPool::Free(SfxItemPool*) ()
   from /home/bjoern/bibisect/lo-linux-dbgutil-daily/opt/program/libsvllo.so
#18 0x00007fffb2b4bb68 in SwDoc::~SwDoc() ()
   from /home/bjoern/bibisect/lo-linux-dbgutil-daily/opt/program/../program/libswlo.so
#19 0x00007fffb2b4bea8 in SwDoc::~SwDoc() ()
Comment 8 Ari Latvala 2015-10-30 07:41:03 UTC 
Just reproduced the crash on RHEL 6.7 64-bit LibreOffice 5.0.2.2 with the steps defined on the original bug report.
Comment 9 jani 2015-12-04 11:21:03 UTC 
Tested with current master on Linux and Windows, where it works.

If you want to verify this bug, please use master newer than 1/12/2015.
Comment 10 Robinson Tryon (qubit) 2015-12-15 11:03:17 UTC 
Migrating Whiteboard tags to Keywords: (bibisected)
[NinjaEdit]