Bug Hunting Session
Bug 92434 - When relation design dialog is open and then closed, libreoffice crashes
Summary: When relation design dialog is open and then closed, libreoffice crashes
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Base (show other bugs)
Version:
(earliest affected)
5.0.0.1 rc
Hardware: x86-64 (AMD64) All
: medium critical
Assignee: Michael Meeks
URL:
Whiteboard: target:5.1.0 target:5.0.0.3
Keywords: haveBacktrace
Depends on:
Blocks: VclPtr
  Show dependency treegraph
 
Reported: 2015-06-29 19:06 UTC by Dan Lewis
Modified: 2016-10-25 19:17 UTC (History)
6 users (show)

See Also:
Crash report or crash signature:


Attachments
hs_err_pid (142.40 KB, text/x-log)
2015-07-04 11:20 UTC, Julien Nabet
Details
bt with debug symbols (gtk3) (12.61 KB, text/plain)
2015-07-04 11:29 UTC, Julien Nabet
Details
bt with gtk version<3 (7.14 KB, text/plain)
2015-07-04 11:38 UTC, Julien Nabet
Details
bt with debug symbols (7.63 KB, text/plain)
2015-08-01 17:35 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Dan Lewis 2015-06-29 19:06:44 UTC
Steps to cause crash:
1. Open Base and open a relational database file.
2. Open the relation design dialog (Tools > Relationships).
3. Add a table.
4. Close the relation design dialog.
5. LibreOffice crashes!

Expected behavior: A popup window asking me if I want to save the changes.

Additional comments: This does not happen when 4.4.4.3 (Deb version for both x86 and x86_64) It doesn happen for both RC1 and RC2 for 5.0 for both Deb versions.
   Also, I have had it to happen on RC1 and RC2 when I just opened the relation design dialog and then closed it again.
Comment 1 Marc Kaulisch 2015-06-29 19:38:19 UTC
I can confirm a crash on Win8.1 with 5.0.0.2 64bit but mine is  a bit different 

Here Base crashes when I save the file after a change while in the relation design dialog
Comment 2 Julien Nabet 2015-06-29 19:53:47 UTC
On pc Debian x86-64 with master sources updated today, I could reproduce this.

Here are the console logs:
warn:legacy.osl:7864:1:vcl/source/window/window.cxx:271: Window ( N5dbaui18ORelationTableViewE ()) with live children destroyed:  N5dbaui20ORelationTableWindowE ()
Window ( N5dbaui18ORelationTableViewE ()) with live children destroyed:  N5dbaui20ORelationTableWindowE ()
Comment 3 Julien Nabet 2015-06-29 20:16:57 UTC
part of the bt:
#0  0x00002aaab1b4e1e4 in vcl::Window::dispose() (this=0x2f084c0) at /home/julien/compile-libreoffice/libreoffice/vcl/source/window/window.cxx:271
#1  0x00002aaacef7b452 in dbaui::OJoinTableView::dispose() (this=0x2f084c0)
    at /home/julien/compile-libreoffice/libreoffice/dbaccess/source/ui/querydesign/JoinTableView.cxx:201
#2  0x00002aaacf0113fc in dbaui::ORelationTableView::dispose() (this=0x2f084c0)
    at /home/julien/compile-libreoffice/libreoffice/dbaccess/source/ui/relationdesign/RelationTableView.cxx:84
#3  0x00002aaab1cae1be in OutputDevice::disposeOnce() (this=0x2f084c0) at /home/julien/compile-libreoffice/libreoffice/vcl/source/outdev/outdev.cxx:203
#4  0x00002aaacef78da9 in VclPtr<dbaui::OJoinTableView>::disposeAndClear() (this=0x305ded0) at /home/julien/compile-libreoffice/libreoffice/include/vcl/vclptr.hxx:215
#5  0x00002aaacef7879a in dbaui::OJoinDesignView::dispose() (this=0x305dc80)
    at /home/julien/compile-libreoffice/libreoffice/dbaccess/source/ui/querydesign/JoinDesignView.cxx:69
#6  0x00002aaab1cae1be in OutputDevice::disposeOnce() (this=0x305dc80) at /home/julien/compile-libreoffice/libreoffice/vcl/source/outdev/outdev.cxx:203
#7  0x00002aaab05502cf in VclPtr<OutputDevice>::disposeAndClear() (this=0x7fffffff3d50) at /home/julien/compile-libreoffice/libreoffice/include/vcl/vclptr.hxx:215
#8  0x00002aaab059cc6a in VCLXWindow::dispose() (this=0x3049360) at /home/julien/compile-libreoffice/libreoffice/toolkit/source/awt/vclxwindow.cxx:927
#9  0x00002aaac6c3993e in (anonymous namespace)::Frame::setComponent(com::sun::star::uno::Reference<com::sun::star::awt::XWindow> const&, com::sun::star::uno::Reference<com::sun::star::frame::XController> const&) (this=0x30c2c30, xComponentWindow=empty uno::Reference, xController=empty uno::Reference)
    at /home/julien/compile-libreoffice/libreoffice/framework/source/services/frame.cxx:1579
#10 0x00002aaac6c3a36d in (anonymous namespace)::Frame::close(sal_Bool) (this=0x30c2c30, bDeliverOwnership=0 '\000')
    at /home/julien/compile-libreoffice/libreoffice/framework/source/services/frame.cxx:1781
Comment 4 Robert Großkopf 2015-06-30 06:48:45 UTC
Have set the system to all. Happens for Debian, here for OpenSUSE 64bit rpm and also for Win 8.1 (comment 1).
Comment 5 Michael Meeks 2015-07-01 17:55:09 UTC
Looks like a pre-existing problem with erasing items from a vector while iterating over it, and also a missing disposeAndClear - testing a fix.
Comment 6 Michael Meeks 2015-07-01 20:15:30 UTC
Fixed Julien's issue, and also a rats nest of others - hmm; base needs significantly more testing I suspect - particularly with the new gtk3 / a11y foo enabled.

Pushed some fixes as:

remote:   https://gerrit.libreoffice.org/16671 tdf#92434 - fix iteration, and remember to disposeAndClear.
remote:   https://gerrit.libreoffice.org/16672 tdf#92434 - A series of hideous knock-on dbaccess crasher fixes.
Comment 7 Commit Notification 2015-07-02 09:25:08 UTC
Michael Meeks committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=356bc0f697299e5fb6156ce25dc69845eaa6f9e6

tdf#92434 - fix iteration, and remember to disposeAndClear.

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 8 Michael Meeks 2015-07-02 09:25:21 UTC
Please give it a whirl and see how the fixes bite you in a new master build.
Thanks ! =)
Comment 9 Commit Notification 2015-07-02 09:26:41 UTC
Michael Meeks committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=996b16dcb590ebf779f5d95caf15e9ab18036b07

tdf#92434 - A series of hideous knock-on dbaccess crasher fixes.

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 10 Commit Notification 2015-07-02 16:34:53 UTC
Michael Meeks committed a patch related to this issue.
It has been pushed to "libreoffice-5-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=f5721a9de60f614519be383fec2c97b2dd19b289&h=libreoffice-5-0

tdf#92434 - fix iteration, and remember to disposeAndClear.

It will be available in 5.0.0.3.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 11 Commit Notification 2015-07-02 16:37:31 UTC
Michael Meeks committed a patch related to this issue.
It has been pushed to "libreoffice-5-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=88b06253359dfa91242757ceb39d7276786a0587&h=libreoffice-5-0

tdf#92434 - A series of hideous knock-on dbaccess crasher fixes.

It will be available in 5.0.0.3.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 12 Julien Nabet 2015-07-04 11:14:16 UTC
On pc Debian x86-64 with master sources updated today, I could still reproduce this.
warn:legacy.osl:14964:1:vcl/source/window/window.cxx:281: Window ( N5dbaui18ORelationTableViewE()) with live children destroyed:  N5dbaui20ORelationTableWindowE()
Window ( N5dbaui18ORelationTableViewE()) with live children destroyed:  N5dbaui20ORelationTableWindowE()
Comment 13 Julien Nabet 2015-07-04 11:20:09 UTC
Created attachment 117042 [details]
hs_err_pid

Forgot to say last commit retrieved: 3c45bfb0cabf206f6217f1de9eb5cfa12b78e46f
Comment 14 Julien Nabet 2015-07-04 11:29:44 UTC
Created attachment 117044 [details]
bt with debug symbols (gtk3)
Comment 15 Julien Nabet 2015-07-04 11:38:55 UTC
Created attachment 117045 [details]
bt with gtk version<3

To retrieve it, I put a break on vcl/source/window/window.cxx line 281
Comment 16 Julien Nabet 2015-07-04 11:40:11 UTC
Michael: I retrieved some bts (with and without gtk3) on pc Debian x86-64 with master sources updated today, thought you might be interested in these.
Comment 17 Dan Lewis 2015-07-04 18:12:51 UTC
Version: 5.0.0.2.0+
Build ID: 64b4ed9de3852494416cdcb8c25d2e24fc4d0253
TinderBox: Linux-rpm_deb-x86_64@46-TDF, Branch:libreoffice-5-0, Time: 2015-07-03_09:08:51
Locale: en-US (en_US.UTF-8)

Run from terminal
Tools > Relationships
Add a table: table added
Add relationship: relationship added
Delete a relationship: relationship deleted
Save the dialog: dialog saved
Close dialog: dialog saved

Delete a table: program crashes
Terminal output: 
     pure virtual method called
     terminate called without an active exception

Observation: Most of the problems I had with this dialog before have been cleared. Perhaps the terminal output along with the back trace may point to the one bug still hiding somewhere
Comment 18 Commit Notification 2015-07-07 16:03:01 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=4bb2d015b332aa5e7623b4edba53f0503c64bbba

Related: tdf#92434 children cleared but parent hasn't completed dispose yet

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 19 Commit Notification 2015-07-07 18:30:57 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-5-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=bd1a27995a1444c8bc96fa09293bc2a47106bc67&h=libreoffice-5-0

Related: tdf#92434 children cleared but parent hasn't completed dispose yet

It will be available in 5.0.0.3.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 20 Michael Meeks 2015-07-09 13:50:07 UTC
I still get this from master at 5d19f90eb247275420a6774403cb77940ac6131b:

warn:legacy.osl:19474:1:vcl/source/window/window.cxx:281: Window ( N5dbaui18ORelationTableViewE()) with live children destroyed:  N5dbaui20ORelationTableWindowE() N5dbaui20ORelationTableWindowE()
Window ( N5dbaui18ORelationTableViewE()) with live children destroyed:  N5dbaui20ORelationTableWindowE() N5dbaui20ORelationTableWindowE()

Will have a poke at that =)
Comment 21 Michael Meeks 2015-07-09 15:02:18 UTC
Pushed to CI for now; if there are further bugs in this area please open a new issue =)

https://gerrit.libreoffice.org/16893 tdf#92434 - dispose the table contents.
Comment 22 Commit Notification 2015-07-09 15:50:16 UTC
Michael Meeks committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=b54f22302731784d7bd462bf2cef0621eea8b22a

tdf#92434 - dispose the table contents.

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 23 Commit Notification 2015-07-09 20:38:43 UTC
Michael Meeks committed a patch related to this issue.
It has been pushed to "libreoffice-5-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=8791cff003afc323601dd43289e642471ac26863&h=libreoffice-5-0

tdf#92434 - dispose the table contents.

It will be available in 5.0.0.3.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 24 Julien Nabet 2015-07-11 06:30:26 UTC
On pc Debian x86-64 with master sources updated today, I don't reproduce the crash.
I just noticed these on console:
warn:legacy.osl:5757:1:include/cppuhelper/interfacecontainer.h:479: object is disposed
warn:legacy.osl:5757:1:vcl/unx/gtk3/a11y/../../gtk/a11y/atklistener.cxx:144: OSL_ASSERT: m_aChildList[n].is()
but this is another story.

Thank you Michael! :-)
Comment 25 Michael Meeks 2015-07-13 09:16:59 UTC
Yeesss... the gtk3 / turning atk/a11y on by default decision of course makes everything less stable on Linux / master -> but then ... eventually we'll need to fix all our atk bugs too so =)

Thanks for verifying.
Comment 26 Dan Lewis 2015-07-23 21:27:52 UTC
Version: 5.0.1.0.0+
Build ID: 5df3725f81564a8380209881b6f2c48b2fe158b3
TinderBox: Linux-rpm_deb-x86@45-TDF, Branch:libreoffice-5-0, Time: 2015-07-22_17:20:20
Locale: en-US (en_US.UTF-8)

   Today, I checked the relational dialog problem again using the above build. When I tried to delete a table in it, the warning window appears as it should about deleting a table. When I click Yes, LibreOffice crashes. We still have a problems here.
Comment 27 Robert Großkopf 2015-07-26 15:48:33 UTC
Have tested this one.
Opened a database.
Opened Tools → Relationships
Deleted one table in the relationship
Whole LO crashes immediately.

My System: OpenSUSE 13.2 64bit rpm Linux,
LO Version: 5.0.0.4
Build-ID: cf112dc905650fb985306a7a03d2fe3fcc6c978f
Gebietsschema: de-DE (de_DE.UTF-8)
Comment 28 Dan Lewis 2015-07-27 15:29:14 UTC
Version: 5.1.0.0.alpha1+
Build ID: 74d4168f8830f7bbec6b784c3fb774296d9adafa
TinderBox: Linux-rpm_deb-x86@45-TDF, Branch:master, Time: 2015-07-22_06:06:19
Locale: en-US (en_US.UTF-8)

I used this build to test this bug on a relational database. When I tried to delete a table in the relation design dialog, I got the proper warning pop-up. But when I click Yes, LibreOffice crashes. (Ubuntu 14.04 32 bit)
Comment 29 Julien Nabet 2015-08-01 17:35:06 UTC
Created attachment 117587 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today (+gtk3), I could reproduce the crash when deleting the table.
Comment 30 Julien Nabet 2015-08-01 17:38:18 UTC
Michael: just wonder if we should make a new bugtracker for delete part.
Indeed, the original problem can't be reproduced now but, on the other side, we could say both actions are closely related.
Comment 31 Michael Meeks 2015-08-01 18:35:58 UTC
Hi Julien - yes - thanks that would be great; opening a new bug would be much appreciated in place of re-opening old ones for new issues =) (or having bugs with over-broad subjects). Thanks ! please do CC me etc.
Comment 32 Julien Nabet 2015-08-01 18:43:55 UTC
Thank you Michael for your feedback.
Following creation of tdf#93069, let's close this one.