Bug Hunting Session
Bug 99089 - libreoffice crashes when I select a different job number on the spreadsheet
Summary: libreoffice crashes when I select a different job number on the spreadsheet
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: BASIC (show other bugs)
Version:
(earliest affected)
4.5.0.0.alpha0+ Master
Hardware: All All
: high normal
Assignee: Julien Nabet
URL:
Whiteboard: target:5.2.0 target:5.1.3
Keywords: haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2016-04-04 21:53 UTC by tim
Modified: 2016-10-25 19:08 UTC (History)
3 users (show)

See Also:
Crash report or crash signature:


Attachments
a jobsheet spreadsheet, which causes the crashing (32.03 KB, application/octet-stream)
2016-04-04 21:57 UTC, tim
Details
bt with debug symbols (14.15 KB, text/plain)
2016-04-10 07:06 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description tim 2016-04-04 21:53:08 UTC
User-Agent:       Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Build Identifier: LibreOffice 5.1.0.3

The crash appears to be related to the macros I have written in the spreadsheet, such that libreoffice closes itself after having loaded for about 5 seconds, (without pressing anything) I get an "Inadmissible data type. Overflow" error and then if I pick a different job number from the dropdown I get an "unknown SEH error" and libreoffice closes.

Reproducible: Always

Steps to Reproduce:
1.open spreadsheet and wait about 5 seconds
2.first error appears
3. on the edit form select a different job number.
Actual Results:  
 libreoffice crashes.

Expected Results:  
the other job number information should be displayed.

[Information automatically included from LibreOffice]
Locale: en-US
Module: SpreadsheetDocument
[Information guessed from browser]
OS: Windows (All)
OS is 64bit: yes


Reset User Profile?No
Comment 1 tim 2016-04-04 21:57:23 UTC
Created attachment 124075 [details]
a jobsheet spreadsheet, which causes the crashing

this file is the test file that demonstrates the issue.
Comment 2 raal 2016-04-05 12:58:56 UTC
I can confirm crash with Version: 5.2.0.0.alpha0+ and Version: 4.5.0.0.alpha0+; win7 

At 4.0 I get the same first error, after change nr. of jobs I get "BASIC runtime error. : Property or method not found: selectedValue.", but LO doesn't crash, regression.

Tim, did this macro worked in previous version?
Comment 3 tim 2016-04-06 14:02:21 UTC
This macro is under development ie. it is not yet complete. before the most recent changes is did not cause a crash of libreoffice calc. (scalc)

Changing the job number is supposed to read the values from the main data sheet and put them in the edit form. I was getting an error with a val(somefunctionhere) statement, assumedly because the function returned a null if the cell queried was empty. I changed it to return a blank string instead ("") but for some reason the whole scalc program crashes, so it is rather hard to try and debug. I do have an earlier version from a few days before which does not crash, and doesn't have the changes, but I will need to implement the changes, and I can't see why scalc should crash.

it also crashes on linux (slackware) version 4.4.0.3
Comment 4 Julien Nabet 2016-04-10 07:06:39 UTC
Created attachment 124225 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today, I could reproduce this.
I attached a bt with symbols.

I also noticed these logs:
warn:legacy.osl:20045:1:xmloff/source/core/xmlerror.cxx:178: An error or a warning has occurred during XML import/export!
Error-Id: 0x20040003
    Flags: 2 ERROR
    Class: 4 API
    Number: 3
Parameters:
    0: CharEscapement
Exception-Message: UNKNOWN_PROPERTY
Position:
    Public Identifier: 
    System Identifier: file:///home/julien/compile-libreoffice/bugs/99089_jobsheet/jobsheet.ods
    Row, Column: 2,94886

warn:legacy.osl:20045:1:xmloff/source/core/xmlerror.cxx:178: An error or a warning has occurred during XML import/export!
Error-Id: 0x20040003
    Flags: 2 ERROR
    Class: 4 API
    Number: 3
Parameters:
    0: CharEscapementHeight
Exception-Message: UNKNOWN_PROPERTY
Position:
    Public Identifier: 
    System Identifier: file:///home/julien/compile-libreoffice/bugs/99089_jobsheet/jobsheet.ods
    Row, Column: 2,94886

warn:legacy.osl:20045:1:svx/source/svdraw/svdouno.cxx:528: SdrUnoObj::GetUnoControl: This object is not displayed in that particular view!
warn:legacy.osl:20045:1:svx/source/accessibility/AccessibleControlShape.cxx:580: AccessibleControlShape::getAccessibleChild: index mismatch!
warn:legacy.osl:20045:1:svx/source/accessibility/AccessibleControlShape.cxx:660: AccessibleControlShape::disposing: this should never happen!
Comment 5 Julien Nabet 2016-04-10 07:45:44 UTC
I submitted a patch on gerrit here for master sources (future 5.2.0):
https://gerrit.libreoffice.org/#/c/23956/
Comment 6 Commit Notification 2016-04-10 08:21:00 UTC
Julien Nabet committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=43109b751bf5fd36318de56b2fb686acc724673f

tdf#99089: avoid some crashes in Basic

It will be available in 5.2.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 7 tim 2016-04-12 13:22:20 UTC
I've tested on the nightly (windows 7 64bit) libo-master~2016-04-11_23.06.26_LibriOfficeDev_5.2.0.0.alpha0_Win_x86.msi and it still crashes as soon as you select a different job from the dropdown list control.
Comment 8 Commit Notification 2016-04-13 07:13:32 UTC
Julien Nabet committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=5304b948781e1f8a1bf5249a260db738e4113079

Related tdf#99089: avoid second crash

It will be available in 5.2.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 9 tim 2016-04-15 10:03:50 UTC
that second patch seems to have done the job. scalc no longer crashes with this test case. (win 7 64bit)
many thanks Julien for the fix. I look forward to it appearing in lo 5.2.0
Comment 10 Julien Nabet 2016-04-15 10:36:30 UTC
Thank you Tim for your feedback.
Hope the result is still correct too. Don't hesitate to tell me if there's a side effect for some cases.
Anyway, I submitted in 1 patch on gerrit a backport on 5.1 branch of the 2 patches, see https://gerrit.libreoffice.org/#/c/23957/

BTW, with my debug build (which gives slower responsiveness from LO), I noticed the parse was quicker with the fix.
Comment 11 Julien Nabet 2016-04-15 10:37:32 UTC
And to answer your question, the fix will be on 5.2.0 (that's why it appears as "target" field).
Comment 12 Commit Notification 2016-04-18 09:47:16 UTC
Julien Nabet committed a patch related to this issue.
It has been pushed to "libreoffice-5-1":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=0e19e4e17f5761d071768a11e16eb9d82d792cf4&h=libreoffice-5-1

tdf#99089: avoid some crashes in Basic

It will be available in 5.1.3.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 13 tim 2016-04-18 14:34:49 UTC
great, glad to see it will come out in 5.1.3 that is less time to wait :-)