Bug 93860 - crash after marking a table and moving the mouse wheel
Summary: crash after marking a table and moving the mouse wheel
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
5.0.1.2 release
Hardware: x86-64 (AMD64) All
: high major
Assignee: Not Assigned
URL:
Whiteboard: target:5.1.0
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2015-09-02 15:03 UTC by Jaime T
Modified: 2016-10-25 19:19 UTC (History)
5 users (show)

See Also:
Crash report or crash signature:


Attachments
The document that crashes (44.58 KB, application/vnd.oasis.opendocument.text)
2015-09-03 07:11 UTC, Jaime T
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Jaime T 2015-09-02 15:03:32 UTC
Editing a document created using the Qt libraries. I select a table, move the mouse wheel, and crash. It happens always, tested also in Windows 7.

In linux, run under gdb, the backtrace (repeated twice) is:

#0  0x00007fffce7f2eb5 in SwTextShell::GetAttrState (this=0x26bce90, 
    rSet=SfxItemSet of pool 0x1a086a0 with parent 0x0 and Which ranges: [(10028, 10031), (63, 63), (10043, 10043), (10950, 10951), (10956, 10957), (20403, 20405), (20411, 20412)] = {...}) at /build/libreoffice-Ke3JzN/libreoffice-5.0.1~rc2/sw/source/uibase/shells/txtattr.cxx:623
#1  0x00007ffff52a9a0e in CallState (
    rSet=SfxItemSet of pool 0x1a086a0 with parent 0x0 and Which ranges: [(10028, 10031), (63, 63), (10043, 10043), (10950, 10951), (10956, 10957), (20403, 20405), (20411, 20412)] = {...}, pFunc=<optimized out>, this=<optimized out>) at /build/libreoffice-Ke3JzN/libreoffice-5.0.1~rc2/include/sfx2/shell.hxx:212
#2  SfxDispatcher::_FillState (this=this@entry=0x1f41c40, rSvr=..., 
    rState=SfxItemSet of pool 0x1a086a0 with parent 0x0 and Which ranges: [(10028, 10031), (63, 63), (10043, 10043), (10950, 10951), (10956, 10957), (20403, 20405), (20411, 20412)] = {...}, pRealSlot=0x7fffceda8ba0 <aSwTextShellSlots_Impl+2496>) at /build/libreoffice-Ke3JzN/libreoffice-5.0.1~rc2/sfx2/source/control/dispatch.cxx:1818
#3  0x00007ffff52a7308 in SfxBindings::Update_Impl (this=this@entry=0x1c67720, pCache=0x222ba50)
    at /build/libreoffice-Ke3JzN/libreoffice-5.0.1~rc2/sfx2/source/control/bindings.cxx:422
#4  0x00007ffff52a7918 in SfxBindings::NextJob_Impl (this=0x1c67720, pTimer=<optimized out>)
    at /build/libreoffice-Ke3JzN/libreoffice-5.0.1~rc2/sfx2/source/control/bindings.cxx:1621
#5  0x00007ffff636be7f in ImplSchedulerData::Invoke (this=0x21bca90) at /build/libreoffice-Ke3JzN/libreoffice-5.0.1~rc2/vcl/source/app/scheduler.cxx:38
#6  0x00007ffff636bfef in Scheduler::ProcessTaskScheduling (bTimer=<optimized out>) at /build/libreoffice-Ke3JzN/libreoffice-5.0.1~rc2/vcl/source/app/scheduler.cxx:127
#7  0x00007fffe1692490 in KDEXLib::qt_static_metacall (_o=0x6e1cf0, _c=<optimized out>, _id=<optimized out>, _a=0x24b8630)
    at /build/libreoffice-Ke3JzN/libreoffice-5.0.1~rc2/workdir/CustomTarget/vcl/unx/kde4/KDEXLib.moc:85
#8  0x00007fffdf422c1e in QObject::event(QEvent*) () from /usr/lib/x86_64-linux-gnu/libQtCore.so.4
#9  0x00007fffdf93be2c in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib/x86_64-linux-gnu/libQtGui.so.4
#10 0x00007fffdf9424a0 in QApplication::notify(QObject*, QEvent*) () from /usr/lib/x86_64-linux-gnu/libQtGui.so.4
#11 0x00007fffe0b07cca in KApplication::notify(QObject*, QEvent*) () from /usr/lib/libkdeui.so.5
#12 0x00007fffdf40a4dd in QCoreApplication::notifyInternal(QObject*, QEvent*) () from /usr/lib/x86_64-linux-gnu/libQtCore.so.4
#13 0x00007fffdf40db3d in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) () from /usr/lib/x86_64-linux-gnu/libQtCore.so.4
#14 0x00007fffdf437f83 in ?? () from /usr/lib/x86_64-linux-gnu/libQtCore.so.4
#15 0x00007fffe7c15e04 in g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#16 0x00007fffe7c16048 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#17 0x00007fffe7c160ec in g_main_context_iteration () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#18 0x00007fffdf4377a1 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/x86_64-linux-gnu/libQtCore.so.4
#19 0x00007fffdf9ddbe6 in ?? () from /usr/lib/x86_64-linux-gnu/libQtGui.so.4
#20 0x00007fffe169045d in KDEXLib::processYield (this=this@entry=0x6e1cf0, bWait=bWait@entry=true, bHandleAllCurrentEvents=bHandleAllCurrentEvents@entry=false)
    at /build/libreoffice-Ke3JzN/libreoffice-5.0.1~rc2/vcl/unx/kde4/KDEXLib.cxx:320
#21 0x00007fffe1691f90 in KDEXLib::Yield (this=0x6e1cf0, bWait=<optimized out>, bHandleAllCurrentEvents=<optimized out>)
    at /build/libreoffice-Ke3JzN/libreoffice-5.0.1~rc2/vcl/unx/kde4/KDEXLib.cxx:299
#22 0x00007ffff6378ba3 in ImplYield (i_bAllEvents=false, i_bWait=true) at /build/libreoffice-Ke3JzN/libreoffice-5.0.1~rc2/vcl/source/app/svapp.cxx:353
#23 Application::Yield () at /build/libreoffice-Ke3JzN/libreoffice-5.0.1~rc2/vcl/source/app/svapp.cxx:382
#24 0x00007ffff6378c25 in Application::Execute () at /build/libreoffice-Ke3JzN/libreoffice-5.0.1~rc2/vcl/source/app/svapp.cxx:336
#25 0x00007ffff5508fa3 in desktop::Desktop::Main (this=0x7fffffffd820) at /build/libreoffice-Ke3JzN/libreoffice-5.0.1~rc2/desktop/source/app/app.cxx:1605
#26 0x00007ffff637dba1 in ImplSVMain () at /build/libreoffice-Ke3JzN/libreoffice-5.0.1~rc2/vcl/source/app/svmain.cxx:162
#27 0x00007ffff637dbe2 in SVMain () at /build/libreoffice-Ke3JzN/libreoffice-5.0.1~rc2/vcl/source/app/svmain.cxx:196
#28 0x00007ffff5526a8f in soffice_main () at /build/libreoffice-Ke3JzN/libreoffice-5.0.1~rc2/desktop/source/app/sofficemain.cxx:96
#29 0x00000000004006fb in sal_main () at /build/libreoffice-Ke3JzN/libreoffice-5.0.1~rc2/desktop/source/app/main.c:48
#30 main (argc=<optimized out>, argv=<optimized out>) at /build/libreoffice-Ke3JzN/libreoffice-5.0.1~rc2/desktop/source/app/main.c:47

I'm trying to remove all the sensible information from the file.
Comment 1 Jaime T 2015-09-03 07:11:40 UTC
Created attachment 118372 [details]
The document that crashes

In fact, I just need to select a column of the first table, and there you have the crash.

In windows, it shows a message box: SEH Exception: ACCESS VIOLATION.
Comment 2 Julien Nabet 2015-09-05 19:47:19 UTC
On pc Debian x86-64 with master sources updated yesterday, I could reproduce this.
Comment 3 Björn Michaelsen 2015-09-08 14:26:38 UTC
Couldnt reproduce on 4.2.8.2 on Ubuntu => regression
Comment 4 raal 2015-09-25 12:19:27 UTC
This seems to have begun at the below commit.
Adding Cc: to d.sikeler94@gmail.com ; Could you possibly take a look at this
one? Thanks

~/bibisect-win32-5.0   : f24d3b37c546ed6bb0480975353602fff123d16c is the first bad commit
commit f24d3b37c546ed6bb0480975353602fff123d16c
Author: Norbert Thiebaud <nthiebaud@gmail.com>
Date:   Mon May 11 19:54:13 2015 -0500

    source a143d7d14db9b12064391879822120260eda2702

    source a143d7d14db9b12064391879822120260eda2702

:040000 040000 165f663da236556528f789b1e793c8a02570bd36 7108713b307830a985787906c5a04b4b0f65e339 M      instdir

author	Daniel Sikeler <d.sikeler94@gmail.com>	2014-11-05 13:06:46 (GMT)
committer	Michael Stahl <mstahl@redhat.com>	2014-12-02 13:45:46 (GMT)
commit a143d7d14db9b12064391879822120260eda2702 (patch)
De-/Increase fontsize when multi-sized text


$ git bisect log
# bad: [575cd25f0560684895018d8fcfb1818dd4dd1c9b] source ab465b90f6c6da5595393a0ba73f33a1e71a2b65
# good: [f449493ae11ac76cc7396bddeaa624a60c565936] source 57d6b92b69a31260dea0d84fcd1fc5866ada7adb
git bisect start 'libreoffice-5-0-branch-point' 'oldest'
# bad: [da12357c491a0dce5acc0bd1f00c26f89d8f20e6] source c1b9402d49a7cd4bec383f28d397d9d89541f0e0
git bisect bad da12357c491a0dce5acc0bd1f00c26f89d8f20e6
# bad: [74d1ce30418f1228c11e865e8b6094f15293a528] source 9763b55eb946cf425220d26dab91bf220890b180
git bisect bad 74d1ce30418f1228c11e865e8b6094f15293a528
# bad: [801e6841079affa45389e59799681460ddabda17] source d13501f194b3a8095e283e0a3d65d1db02e70dad
git bisect bad 801e6841079affa45389e59799681460ddabda17
# skip: [7b46cdce1e17bdbd04f7ee6d56e1ff388c91321c] source 542120c30672144a6ad536909b7f4740d3a6112f
git bisect skip 7b46cdce1e17bdbd04f7ee6d56e1ff388c91321c
# skip: [2d272d36d60c37908a4a59f9b5c93d294c747fe5] source fd88318c21fbc7f6c3554e2fb524109a2aad5cf8
git bisect skip 2d272d36d60c37908a4a59f9b5c93d294c747fe5
# good: [5b1b1ce0d1f28318aa7bb5955bc36b17fed36ee5] source ffd18eed1fc5b56fecf83fbff3ce09face16bb7e
git bisect good 5b1b1ce0d1f28318aa7bb5955bc36b17fed36ee5
# bad: [f76faa078ebbcdba4e302637afd044f96f2e6c8f] source dd53ee608dd06ef4db95e36f6786a95df21517a0
git bisect bad f76faa078ebbcdba4e302637afd044f96f2e6c8f
# bad: [65d7d43551bb9419c1dc69f7bb5f7825d9252419] source 5f1de30c6373ae41480aad13e49876bfac8a2156
git bisect bad 65d7d43551bb9419c1dc69f7bb5f7825d9252419
# good: [34bd5934cc3366c128e70e258b3e94e7aee48a14] source 2dd7cc5b925d0b4c62553eeba9f6524ce7b6217b
git bisect good 34bd5934cc3366c128e70e258b3e94e7aee48a14
# bad: [66ec2199b68693d177b41ef9a0d8aae38b6ed159] source 5228c6742734b0936b2b468315e069fd6bcc1dac
git bisect bad 66ec2199b68693d177b41ef9a0d8aae38b6ed159
# good: [489c7825ca309bab476e44d8da71304c33e52a26] source 74659d0174a516d4ed5095e386f925de51121e76
git bisect good 489c7825ca309bab476e44d8da71304c33e52a26
# bad: [a7ea9a5a475f2e4c1ffe6409ccbf1f73354799c9] source 8eb37e74fff1806608563ee49489b8a1f71fc6b0
git bisect bad a7ea9a5a475f2e4c1ffe6409ccbf1f73354799c9
# good: [0783a91f15a3c382e35c3b2b31b73c686858ab90] source 0edcbd68529c54834ca85c2dc4abd8e4e69d39b4
git bisect good 0783a91f15a3c382e35c3b2b31b73c686858ab90
# good: [ae43559ca16bcaea64d816fe36dae196e1ba0978] source ababde703007557c59595d551efb118cf84a3911
git bisect good ae43559ca16bcaea64d816fe36dae196e1ba0978
# bad: [f24d3b37c546ed6bb0480975353602fff123d16c] source a143d7d14db9b12064391879822120260eda2702
git bisect bad f24d3b37c546ed6bb0480975353602fff123d16c
# first bad commit: [f24d3b37c546ed6bb0480975353602fff123d16c] source a143d7d14db9b12064391879822120260eda2702
Comment 5 Commit Notification 2015-10-06 05:44:50 UTC
Oliver Specht committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=4d4bc508f03db9fa0ddae0c6aaa52e586cbe1172

tdf#93860: crash in table selection fixed

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 6 Jaime T 2015-10-08 10:56:53 UTC
I am not able ro reproduce the crash with the daily builds and several tests documents.
Comment 7 Robinson Tryon (qubit) 2015-12-17 10:32:30 UTC Comment hidden (obsolete)