Bug 87199

Summary: [a11y] merging cells crashes writer
Product: LibreOffice Reporter: Agiofws <agiofws>
Component: WriterAssignee: Michael Stahl <mst.fdo>
Status: REOPENED --- QA Contact:
Severity: major    
Priority: high CC: caolanm, mst.fdo, serval2412
Version: unspecifiedKeywords: have-backtrace
Hardware: x86-64 (AMD64)   
OS: Linux (All)   
Whiteboard: target:4.5.0 target:4.4.0.2 target:4.3.6
i915 platform: i915 features:
Attachments: gdb backtrace of crash in master dbgutil build
one possible fix

Description Agiofws 2014-12-10 18:09:39 UTC
this happens in 3.5.4.2 , 4.3.5.1 , 4.3.4.1 , 4.4 

this does not happen in Version: 4.3.3.2 Build ID: 430m0(Build:2)

to reproduce
1)open a new document
2)insert a table  
3)insert contents in the cells of a column
4)select the column 
5)and press the merge key
6)libre-writer crashes
Comment 1 Eike Rathke 2014-12-10 18:14:29 UTC
Crashes for me already when I merge just two cells with content (!), not even the entire column.
Comment 2 Eike Rathke 2014-12-10 18:41:49 UTC
Created attachment 110685 [details]
gdb backtrace of crash in master dbgutil build

As not all can reproduce it, crashing operation seems to be on an already deleted object instance, hence the result may depend on system and memory layout.
Comment 3 Eike Rathke 2014-12-10 18:46:53 UTC
May actually occur only if accessibility is activated, as SwAccessible... are involved.
Comment 4 Julien Nabet 2014-12-10 19:06:51 UTC
On pc Debian x86-64 with master sources updated today, I don't reproduce this. (new profile, accessibility enabled).
However, I noticed this on console logs:
** (soffice:448): WARNING **: Unknown event notification 35
Comment 5 Agiofws 2014-12-10 19:14:11 UTC
On linux 64bit debian i also get the above warning...
Comment 6 Caolán McNamara 2014-12-12 17:02:41 UTC
Created attachment 110790 [details] [review]
one possible fix

The attached works anyway.

Lower gets destroyed, upper still points to it and tries to access it from a11y code later on
Comment 7 Commit Notification 2014-12-15 13:49:04 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=f9eff2a402a4cd28d7dbfb6ce27cbf96b31e576f

Resolves: fdo#87199 deregister during destroy as lower of upper

It will be available in 4.5.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 8 Caolán McNamara 2014-12-15 13:49:59 UTC
Seems to work anyway, 4-4 review at https://gerrit.libreoffice.org/#/c/13482/

as far as I can tell this has been broken since at least 4.2 and probably always
Comment 9 Michael Stahl 2014-12-18 22:14:35 UTC
fixed on master
Comment 10 Commit Notification 2014-12-18 22:14:59 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=296e8b597c141b6b54cbf943871d6a6820c1779d

fdo#87199: sw: fix root cause of a11y crash when merging cells

It will be available in 4.5.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 11 Agiofws 2014-12-19 08:22:51 UTC
ok i think i've found out why this crashes...

If I'm in Gnome 3 with whatever window manager it uses by default...

1) I open libreoffice 
2) create some cells
3) insert content into a column
4) press merge cells and libre crashes

THE above process does not OCCUR if i use fluxbox for example... 

SO its got something to do with the GUI or the window manager... so anyone please confirm

The above was confirmed with libreoffice 4.4dev which was stated that the patch had fixed the bug....
Comment 12 Commit Notification 2014-12-19 13:11:49 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-4-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=00428a15f0e7346af5da80563197950cf6439297&h=libreoffice-4-4

fdo#87199: sw: fix root cause of a11y crash when merging cells

It will be available in 4.4.0.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 13 Commit Notification 2014-12-19 13:13:07 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-4-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=56d06e78ccdd8ae8c8e50a5b647272b4166f63cb&h=libreoffice-4-3

fdo#87199: sw: fix root cause of a11y crash when merging cells

It will be available in 4.3.6.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.