Bug 92213 - Crash on adding image as background of shape
Summary: Crash on adding image as background of shape
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Impress (show other bugs)
Version:
(earliest affected)
5.1.0.0.alpha0+ Master
Hardware: Other All
: highest critical
Assignee: Jan Holesovsky
URL:
Whiteboard: target:5.1.0
Keywords: bibisectRequest, haveBacktrace, regression
Depends on:
Blocks: RenderContext
  Show dependency treegraph
 
Reported: 2015-06-20 16:53 UTC by Yousuf Philips (jay) (retired)
Modified: 2016-10-25 19:19 UTC (History)
6 users (show)

See Also:
Crash report or crash signature:
Regression By:


Attachments
backtrace (31.56 KB, text/plain)
2015-06-20 16:53 UTC, Yousuf Philips (jay) (retired)
Details
trace from a glogv breakpoint and a bit of debugging. (19.64 KB, text/plain)
2015-06-20 20:56 UTC, Michael Meeks
Details
console logs (20.51 KB, text/plain)
2015-06-21 08:45 UTC, Julien Nabet
Details
backtrace (47.01 KB, text/plain)
2015-08-19 02:16 UTC, Yousuf Philips (jay) (retired)
Details
backtrace from dbg build (35.07 KB, text/plain)
2015-08-27 00:35 UTC, Yousuf Philips (jay) (retired)
Details
backtrace (30.92 KB, text/plain)
2015-09-01 22:24 UTC, Yousuf Philips (jay) (retired)
Details
dbg backtrace (32.42 KB, text/plain)
2015-09-27 07:12 UTC, Yousuf Philips (jay) (retired)
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Yousuf Philips (jay) (retired) 2015-06-20 16:53:21 UTC
Created attachment 116682 [details]
backtrace

Steps:
1) Open Impress
2) Draw shape
3) right-click > Area
4) Select bitmap tab
5) Select water
6) Press okay to close dialog
7) Crash

Regression as this doesnt happen in 4.4 daily.

Version: 5.1.0.0.alpha1+
Build ID: 3ecef8cedb215e49237a11607197edc91639bfcd
TinderBox: Linux-rpm_deb-x86_64@46-TDF, Branch:master, Time: 2015-06-20_01:01:56
Comment 1 Buovjaga 2015-06-20 18:43:48 UTC
No repro.

Win 7 Pro 64-bit Version: 5.1.0.0.alpha1+
Build ID: 3ecef8cedb215e49237a11607197edc91639bfcd
TinderBox: Win-x86@62-merge-TDF, Branch:MASTER, Time: 2015-06-19_23:16:58
Locale: fi-FI (fi_FI)

Ubuntu 15.04 64-bit 
Version: 5.1.0.0.alpha1+
Build ID: 3ecef8cedb215e49237a11607197edc91639bfcd
TinderBox: Linux-rpm_deb-x86_64@46-TDF-dbg, Branch:master, Time: 2015-06-20_00:06:19
Locale: en-US (en_US.UTF-8)
Comment 2 Michael Meeks 2015-06-20 20:45:46 UTC
Can't reproduce a crash; but I do get at:

(soffice:30646): Gdk-WARNING **: gdkdrawable-x11.c:952 drawable is not a pixmap or window

which may be related.
Comment 3 Michael Meeks 2015-06-20 20:56:04 UTC
Created attachment 116685 [details]
trace from a glogv breakpoint and a bit of debugging.

Odd indeed; I guess something is uninitialized, already released or otherwise unexpected in the VirtualDevice's mpGraphics =)

#5  0x00007ffff0d1f893 in VirtualDevice::InnerImplSetOutputSizePixel (this=0x24982e0, rNewSize=Size = {...}, bErase=false, pBuffer=..., bTopDown=false) at /data/opt/libreoffice/master/vcl/source/gdi/virdev.cxx:339
339             pNewVirDev = pSVData->mpDefInst->CreateVirtualDevice( mpGraphics, nNewWidth, nNewHeight, mnBitCount );
Comment 4 Michael Meeks 2015-06-20 20:59:53 UTC
Hi Kendy; looks rather plausibly related to:
 b0cd381de11340de8e72020f774a64d3ade6bbd9

Initialize X11SalVirtualDevice with appropriate SalGraphics.

+    GtkSalGraphics *pGtkSalGraphics = dynamic_cast<GtkSalGraphics*>(pG);
+    assert(pGtkSalGraphics);
+    return CreateX11VirtualDevice(pG, nDX, nDY, nBitCount, pGd,
+            new GtkSalGraphics(pGtkSalGraphics->GetGtkFrame(), pGtkSalGraphics->GetGtkWidget()));

Seems like the GtkSalGraphics is not always associated with a parented frame, but sometimes another virtual device (?) or ... something ;-)

It'd be great if you could take a look.

Thanks !
Comment 5 Yousuf Philips (jay) (retired) 2015-06-21 03:02:52 UTC
This crashed for Rishabh and he asked me to confirm it and then i reported it. :D
Comment 6 Julien Nabet 2015-06-21 08:45:52 UTC
Created attachment 116699 [details]
console logs

On pc Debian x86-64 with master sources updated today, I don't reproduce the crash.
But console warnings logs have increased since some days.
Comment 7 Jan Holesovsky 2015-06-22 08:51:52 UTC
The original was fixed with 6bf39b2f4ea4e880d8414b04269405e6b48efe23 I believe, and then later reworked by Moggi in 12b73697ed5787a621910623d76a6e241b04bd1a, c4f63de0eebf8ba5c58e269c9a3763c42448424e, and 7b2e70f0c83dc333f3ad2e4584703c306269f466.

I'll see if I can reproduce the "drawable is not a pixmap or window" warnings; but they are not that rare from what I recall, could be totally unrelated.
Comment 8 László Németh 2015-06-22 14:30:28 UTC
I was able to reproduce the crash with libreoffice-5-0 (25a5cce5acea051a4dd1ba097d540c43e8de31a3)
on OpenSuSE 13.1 (x86_64), but with SAL_USE_VCLPLUGIN=gen, the problem doesn't occur.

The fresh libreoffice-5-0 build (99db209005634a7342d7043485cdbef5b510e199) doesn't crash.

I tried to bibisect the crash (via ssh -X), but I have got the following gtk library problem:

~/libreoffice-4-4/bibisect/lo-linux-dbgutil-daily> opt/program/soffice

** (soffice:4295): WARNING **: Couldn't connect to accessibility bus: Failed to connect to socket /tmp/dbus-BpdI55feet: Connection refused
/home/nemeth/libreoffice-4-4/bibisect/lo-linux-dbgutil-daily/opt/program/soffice.bin: symbol lookup error: /home/nemeth/libreoffice-4-4/bibisect/lo-linux-dbgutil-daily/opt/program/libvclplug_gtk3lo.so: undefined symbol: gtk_gesture_swipe_new
Comment 9 Thangamani 2015-08-18 21:58:23 UTC
I cannot reproduce this issue in 
Version: 5.0.0.5
Build ID: 1b1a90865e348b492231e1c451437d7a15bb262b

It does not crash.
Comment 10 Yousuf Philips (jay) (retired) 2015-08-19 02:16:22 UTC
Created attachment 118010 [details]
backtrace

Still happening, though it didnt happen as easily as it did when i first reported the bug, but after attempting it a few times and jumping between the gradients, hatching and bitmaps tabs a few times and pressing 'OK', it keeps on crashing.

Version: 5.0.2.0.0+
Build ID: aff9057c35827ec7a6219b1c752f7525db64cdca
TinderBox: Linux-rpm_deb-x86_64@46-TDF, Branch:libreoffice-5-0, Time: 2015-08-13_06:15:07
Locale: en-US (en_US.UTF-8)

Version: 5.1.0.0.alpha1+
Build ID: 5d6ef74eea5d73b8cd17f313ad87138d56dc76ce
TinderBox: Linux-rpm_deb-x86_64@70-TDF, Branch:master, Time: 2015-08-18_01:28:44
Locale: en-US (en_US.UTF-8)
Comment 11 Michael Meeks 2015-08-25 13:31:57 UTC
Backtrace looks like tdf#93102:

#1  0x00007ffff6033b6c in ToolBox::GetItemState(unsigned short) const () from /home/jay/Desktop/LibO_betas/LibreOfficeDev_5.1.0.0.alpha1_Linux_x86-64_deb/install/opt/libreofficedev5.1/program/libmergedlo.so
#2  0x00007ffff56a25cf in SvxSuperContourDlg::StateHdl(ContourWindow*) () from /home/jay/Desktop/LibO_betas/LibreOfficeDev_5.1.0.0.alpha1_Linux_x86-64_deb/install/opt/libreofficedev5.1/program/libmergedlo.so
#3  0x00007ffff56de52f in GraphCtrl::UpdateHdl(Idle*) () from /home/jay/Desktop/LibO_betas/LibreOfficeDev_5.1.0.0.alpha1_Linux_x86-64_deb/install/opt/libreofficedev5.1/program/libmergedlo.so
#4  0x00007ffff623f87f in ImplSchedulerData::Invoke() () from /home/jay/Desktop/LibO_betas/LibreOfficeDev_5.1.0.0.alpha1_Linux_x86-64_deb/install/opt/libreofficedev5.1/program/libmergedlo.so
#5  0x00007ffff623f9ef in Scheduler::ProcessTaskScheduling(bool) () from /home/jay/Desktop/LibO_betas/LibreOfficeDev_5.1.0.0.alpha1_Linux_x86-64_deb/install/opt/libreofficedev5.1/program/libmergedlo.so

But I added some more disposing goodness there. Can't reproduce this myself however. Is there any chance that you can install debuginfo for your system's gtk+ libraries, even if we don't have them for:

Thread 1 (Thread 0x7ffff7f9da40 (LWP 10895)):
#0  0x00007fffe29f0960 in gdk_x11_screen_get_screen_number () from /usr/lib/x86_64-linux-gnu/libgdk-x11-2.0.so.0
#1  0x00007fffe32b86cb in GtkSalGraphics::GtkSalGraphics(GtkSalFrame*, _GtkWidget*) () from /home/jay/Desktop/LibO_betas/LibreOfficeDev_5.0.0.0.alpha1_Linux_x86-64_deb/install/opt/libreofficedev5.0/program/libvclplug_gtklo.so

frame #1 - we should have them from the system for frame #0 =) I wonder what's up with the GdkX11Screen that's in-use there.

Thanks !
Comment 12 Commit Notification 2015-08-25 13:34:37 UTC
Michael Meeks committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=2f31a4c1e8c2bbe9e3e4dba6e24ce4d206831e3b

tdf#92213 - avoid potential crasher from unusual idle handler.

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 13 Yousuf Philips (jay) (retired) 2015-08-25 17:26:26 UTC
(In reply to Michael Meeks from comment #11)
> But I added some more disposing goodness there. Can't reproduce this myself
> however. Is there any chance that you can install debuginfo for your
> system's gtk+ libraries, even if we don't have them for:

Looked in my package manager and found libgtk-3-0-dbg, is that the package? I'm running LO in gtk2 mode though. Is it easier just to run the backtrace in the daily debug builds fine ( http://dev-builds.libreoffice.org/daily/master/Linux-rpm_deb-x86_64@70-TDF-dbg/current/ )?
Comment 14 Michael Meeks 2015-08-26 07:46:31 UTC
> Looked in my package manager and found libgtk-3-0-dbg, is that the package?
> I'm running LO in gtk2 mode though.

I'd expect something similar for the gtk2 packages =) but it looks sensible.

> Is it easier just to run the backtrace in the daily debug builds
> fine ( http://dev-builds.libreoffice.org/daily/master/Linux-rpm_deb-x86_64@70-TDF-dbg/current/ )?

Ah - yes; probably =) if you can reproduce there - thanks !
Comment 15 Yousuf Philips (jay) (retired) 2015-08-27 00:35:26 UTC
Created attachment 118208 [details]
backtrace from dbg build

It crashed. Hope it give you what you need.

Version: 5.1.0.0.alpha1+
Build ID: b2363e98af7b0281279617e43b8fec5b898b9120
TinderBox: Linux-rpm_deb-x86_64@70-TDF-dbg, Branch:master, Time: 2015-08-25_23:42:26
Locale: en-US (en_US.UTF-8)
Comment 16 Commit Notification 2015-08-27 07:34:36 UTC
Michael Meeks committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=1950127b1cf056bc5b7d594e6a2d54375f8504ab

tdf#92213 - don't crash fetching pixelctl a11y peer for un-parented window.

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 17 Michael Meeks 2015-08-27 07:35:33 UTC
The trace shows an obscure a11y crasher; it has a bogus assert and/or NULL ptr de-reference in the code where it should fail gracefully. Just pushed a fix to master; can you verify & propose it for -5-0 =) I guess the missing piece with your system is that you have a11y enabled - it'd be useful to mention that in bug reports.

/me hopes this bug can now stay closed =)

Thanks !
Comment 18 Yousuf Philips (jay) (retired) 2015-09-01 22:24:53 UTC
Created attachment 118319 [details]
backtrace

(In reply to Michael Meeks from comment #17)
> The trace shows an obscure a11y crasher; it has a bogus assert and/or NULL
> ptr de-reference in the code where it should fail gracefully. Just pushed a
> fix to master; can you verify & propose it for -5-0 =)

Unfortunately i wouldnt know how to do this. :D

> I guess the missing
> piece with your system is that you have a11y enabled - it'd be useful to
> mention that in bug reports.

I enabled a11y on my system but never actually used it, so it never came to mind when reporting the bug. :D

> /me hopes this bug can now stay closed =)

Unfortunately i doesnt seem to be fixed.

Version: 5.1.0.0.alpha1+
Build ID: 0c1d3f0c17296c113358228cf36596347fd045e3
TinderBox: Linux-rpm_deb-x86_64@70-TDF, Branch:master, Time: 2015-08-31_23:36:34
Locale: en-US (en_US.UTF-8)

Downloading the new daily dbg to get a better backtrace.
Comment 19 Yousuf Philips (jay) (retired) 2015-09-27 07:10:48 UTC
Still happening. Dbg build backtrace coming up.

Version: 5.1.0.0.alpha1+
Build ID: 18c196f0190d9920673cdd9a4dbc158f08959cfd
TinderBox: Linux-rpm_deb-x86_64@70-TDF, Branch:master, Time: 2015-09-26_00:38:50
Locale: en-US (en_US.UTF-8)
Comment 20 Yousuf Philips (jay) (retired) 2015-09-27 07:12:22 UTC
Created attachment 119066 [details]
dbg backtrace

Version: 5.1.0.0.alpha1+
Build ID: 2dea4d270806f47a324cb09c1db7751499930cf7
TinderBox: Linux-rpm_deb-x86_64@70-TDF-dbg, Branch:master, Time: 2015-09-19_04:51:40
Locale: en-US (en_US.UTF-8)

Console log
------------------
warn:ucb.ucp.gio:9733:1:ucb/source/ucp/gio/gio_content.cxx:401: ignoring GError "The specified location is not supported" for <vnd.sun.star.job:alias=UpdateCheck>
warn:legacy.osl:9733:1:vcl/source/gdi/image.cxx:392: ImageAryData::Load: failed to load image 'cmd/lc_changecasetolower.png'
warn:legacy.osl:9733:1:vcl/source/gdi/image.cxx:392: ImageAryData::Load: failed to load image 'cmd/lc_changecasetoupper.png'
warn:legacy.osl:9733:1:editeng/source/items/frmitems.cxx:476: unknown MemberId
warn:legacy.osl:9733:1:editeng/source/items/frmitems.cxx:476: unknown MemberId
warn:legacy.osl:9733:1:basegfx/source/polygon/b2dtrapezoid.cxx:655: Trapezoid decomposer in illegal state (!)
warn:legacy.osl:9733:1:basegfx/source/polygon/b2dtrapezoid.cxx:655: Trapezoid decomposer in illegal state (!)
warn:legacy.tools:9733:1:sfx2/source/control/statcach.cxx:404: setting state of dirty message

(soffice:9733): Gtk-CRITICAL **: IA__gtk_widget_get_screen: assertion 'GTK_IS_WIDGET (widget)' failed
Comment 21 Maxim Monastirsky 2015-10-01 18:46:35 UTC
Closing this one, as it's already discusses several different issues. The original backtrace is now discussed in Bug 93978.
Comment 22 Robinson Tryon (qubit) 2015-12-17 10:41:12 UTC Comment hidden (obsolete)