Bug 94495 - Crash when navigating to styles and formatting sidebar tab after properties fill type selector has focus
Summary: Crash when navigating to styles and formatting sidebar tab after properties f...
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
5.0.0.0.alpha0+ Master
Hardware: Other All
: high major
Assignee: Not Assigned
URL:
Whiteboard: target:5.1.0 target:5.0.3
Keywords: bibisected, haveBacktrace, regression
Depends on:
Blocks: VclPtr
  Show dependency treegraph
 
Reported: 2015-09-24 19:13 UTC by tmacalp
Modified: 2016-10-25 19:20 UTC (History)
3 users (show)

See Also:
Crash report or crash signature:


Attachments
Backtrace of crash on Windows 5.0.2 (9.71 KB, text/plain)
2015-09-28 08:57 UTC, Buovjaga
Details

Note You need to log in before you can comment on or make changes to this bug.
Description tmacalp 2015-09-24 19:13:54 UTC
Description:
There is a crash that happens when selecting the styles and formatting tab when you have a frame's fill type field selected in the sidebar.

Steps to reproduce:
1. New writer document
2. Insert Frame, OK
3. Open "Properties" sidebar tab
4. Select Fill type, and change to either "None" or "Color"
5. Select "Styles and Formatting" sidebar tab

Expected:
The "Styles and Formatting" tab should be selected without incident.

Actual:
LibreOffice crashes.

Notes:
I've tested this as broken in LO 5.0.0.5 and is still broken in LO 5.0.2.2 using 64bit Fedora 21.  It appears to be fixed in the master nightlies, since the sidebar layout has been completely changed.  It also does not seem to affect LO 4.4.5.2

This bug falls somewhere between my 44 and 50 bibisect repos, so I wasn't able to bibisect, but someone else might have better luck.
Comment 1 Buovjaga 2015-09-28 08:52:32 UTC
Reproduced.

Win 7 Pro 64-bit, Version: 5.0.2.2 (x64)
Build ID: 37b43f919e4de5eeaca9b9755ed688758a8251fe
Locale: fi-FI (fi_FI)
Comment 2 Buovjaga 2015-09-28 08:57:41 UTC
Created attachment 119085 [details]
Backtrace of crash on Windows 5.0.2
Comment 3 Björn Michaelsen 2015-10-13 14:01:59 UTC
# bad: [dda106fd616b7c0b8dc2370f6f1184501b01a49e] source-hash-0db96caf0fcce09b87621c11b584a6d81cc7df86
# good: [5b9dd620df316345477f0b6e6c9ed8ada7b6c091] source-hash-2851ce5afd0f37764cbbc2c2a9a63c7adc844311
git bisect start 'latest' 'oldest'
# good: [0c30a2c797b249d0cd804cb71554946e2276b557] source-hash-45aaec8206182c16025cbcb20651ddbdf558b95d
git bisect good 0c30a2c797b249d0cd804cb71554946e2276b557
# good: [2ce02b2ce56f12b9fcb9efbd380596975a3a5686] source-hash-17d714eef491bda2512ba8012e5b3067ca19a5be
git bisect good 2ce02b2ce56f12b9fcb9efbd380596975a3a5686
# skip: [40875247f0002056effdf6d2fbe43627691cd86c] source-hash-93f0b14458a618ad575cd446680e5c4aa7d87bdc
git bisect skip 40875247f0002056effdf6d2fbe43627691cd86c
# bad: [23d29911b7002c6b820ef5be279f24be7551c2a3] source-hash-78deb81c55266d37e35ff97fbb5b4086245d8ff2
git bisect bad 23d29911b7002c6b820ef5be279f24be7551c2a3
# skip: [387a3afe8d4249d84bc01b55b6006c2c746953c0] source-hash-78f3ae65543ac8e64da167c5347372b1656542d0
git bisect skip 387a3afe8d4249d84bc01b55b6006c2c746953c0
# bad: [24bdd26f7d2a07b44e5d27957a92b43d3cb9a466] source-hash-af764d0b8171d87d5457604467afe9b16426d41d
git bisect bad 24bdd26f7d2a07b44e5d27957a92b43d3cb9a466
# skip: [46ef1962e747dd94a3f9db8498c1d15f49773225] source-hash-d4a12421f2b0aafe97f8ab78017261969c36ae0e
git bisect skip 46ef1962e747dd94a3f9db8498c1d15f49773225
# bad: [a00f72c482fdd5f5fa838d491b98f971d8424b93] source-hash-520400e8faf8e7346d16f34babb6258033673e12
git bisect bad a00f72c482fdd5f5fa838d491b98f971d8424b93
# bad: [5a783781c14d3baf7c3208fb7ac0934b7410ef95] source-hash-6e78bf76f3a10b43475e1bd801bdcbb9ce62f668
git bisect bad 5a783781c14d3baf7c3208fb7ac0934b7410ef95
# skip: [4edf8e30bf0cdb25abacbb9af0c548bbd3b771c0] source-hash-468e60717ff3de76051b2e6568ef101a16ca8721
git bisect skip 4edf8e30bf0cdb25abacbb9af0c548bbd3b771c0
# skip: [1a495e67bc3750a3b2fe2401b54d0d0046c1b45b] source-hash-f7bed502ff0dc43f5a24f8e35c5573bdd76eed65
git bisect skip 1a495e67bc3750a3b2fe2401b54d0d0046c1b45b
# skip: [bbb3ae2e6eeef3514af60c536bbb2b7f4ba74437] source-hash-fccf76ee8c026d86225b75b0c1522578df858b60
git bisect skip bbb3ae2e6eeef3514af60c536bbb2b7f4ba74437
# bad: [225bc85f50dc5af13c878cf4407c5d970f7dc692] source-hash-5d7af14e3224e784a3c1cc6b0fcd23889c3d8ed1
git bisect bad 225bc85f50dc5af13c878cf4407c5d970f7dc692
# skip: [34d0d463e0f4a7f2b74bfcf4d7f29eb8268178ab] source-hash-2b1bd0fac8007adeefb91f6d505186221143fb4f
git bisect skip 34d0d463e0f4a7f2b74bfcf4d7f29eb8268178ab
# skip: [1fac35970a19b4c864e0108f1ff7921595c2d5a0] source-hash-ca35b597012154d655ed50e53d9d614098058ab0
git bisect skip 1fac35970a19b4c864e0108f1ff7921595c2d5a0
# bad: [28154f1e533cbe6591550e7bf55e22f5d8fc06bc] source-hash-cbaca2c1cea2a4a75e21b2b13d79f50858d7d186
git bisect bad 28154f1e533cbe6591550e7bf55e22f5d8fc06bc
# bad: [cad5bc84d3ecc7965982a6ae64a7a03eb7a3d514] source-hash-9bbfb78de44c93a19a7dc919f960e2ee17c17c4e
git bisect bad cad5bc84d3ecc7965982a6ae64a7a03eb7a3d514
# bad: [868489f9e012ea826bfafc45da40cae4658f62c6] source-hash-aa06ce15fdd68983001ef33d1931fbaf6b515282
git bisect bad 868489f9e012ea826bfafc45da40cae4658f62c6
# bad: [e3e3fd87cf05f30f67734d9dac953b518e3e65b3] source-hash-aa87af58b195af94ea5b9dcb01faf09e01e76e1b
git bisect bad e3e3fd87cf05f30f67734d9dac953b518e3e65b3
# bad: [e3e3fd87cf05f30f67734d9dac953b518e3e65b3] source-hash-aa87af58b195af94ea5b9dcb01faf09e01e76e1b
git bisect bad e3e3fd87cf05f30f67734d9dac953b518e3e65b3
# good: [53871cea909a0b86726f189bcfdab2890ffcf9e9] source-hash-a31991c4188e91326941fbe510ce70129d1ccde8
git bisect good 53871cea909a0b86726f189bcfdab2890ffcf9e9
# skip: [442746c7621790af396a8b6b39c0ccebab02916c] source-hash-aef1826d9ca318a1359a2116e7f146e993413234
git bisect skip 442746c7621790af396a8b6b39c0ccebab02916c


So this was fine up until just before the VclPtr merge (a31991c4188e91326941fbe510ce70129d1ccde8 -> good). The VclPtr merge broke this so horribly that one doesnt even get to step 3 as step 2 crashes already. This other bug covering was fixed in aa87af58b195af94ea5b9dcb01faf09e01e76e1b, thus all commits in between are "skip". From aa87af58b195af94ea5b9dcb01faf09e01e76e1b to 50max tag latest the bug is present and reproducable as described: going past step 2, but crashing on step 5.

So even if there were other VclPtr bugs overshadowing this bug, it was clearly cause by VclPtr.
Comment 4 Björn Michaelsen 2015-10-15 09:53:17 UTC
Not reproducable on todays master it seems.
Comment 5 Buovjaga 2015-10-15 10:25:36 UTC
Yep, no crash here.

Win 7 Pro 64-bit Version: 5.1.0.0.alpha1+
Build ID: 4b55c28940d741e53648115a9cfb58f2d6db38a5
TinderBox: Win-x86@62-merge-TDF, Branch:MASTER, Time: 2015-10-15_06:14:50
Locale: en-US (fi_FI)
Comment 6 Michael Meeks 2015-10-15 12:06:33 UTC
A fairly normal (sadly) focus notification problem during dispose; patch in gerrit here - that should improve a number of similar post-dispose accesses around the place: https://gerrit.libreoffice.org/19387

Thanks !
Comment 7 Commit Notification 2015-10-15 12:08:25 UTC
Michael Meeks committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=4421bb8eb51868cfd2d122e198382e605b370ef2

tdf#94495 - protect lstbox usage post-dispose, and fix ItemWin focus.

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 8 Commit Notification 2015-10-15 16:25:23 UTC
Michael Meeks committed a patch related to this issue.
It has been pushed to "libreoffice-5-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=87f3db9b4873e9db6e6b2e04146fbe4a3835b7f7&h=libreoffice-5-0

tdf#94495 - protect lstbox usage post-dispose, and fix ItemWin focus.

It will be available in 5.0.4.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 9 Commit Notification 2015-10-20 12:38:59 UTC
Michael Meeks committed a patch related to this issue.
It has been pushed to "libreoffice-5-0-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=3184baf770d56e212e0b0699fe7a12dff9985c8e&h=libreoffice-5-0-3

tdf#94495 - protect lstbox usage post-dispose, and fix ItemWin focus.

It will be available in 5.0.3.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 10 Robinson Tryon (qubit) 2015-12-17 10:33:16 UTC Comment hidden (obsolete)