Bug 63680 - EDITING: CRASH when click on contents or entering a line of text
Summary: EDITING: CRASH when click on contents or entering a line of text
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
4.1.0.0.alpha0+ Master
Hardware: Other Windows (All)
: medium critical
Assignee: Miklos Vajna
URL:
Whiteboard: target:4.1.0
Keywords: regression
: 63678 63767 (view as bug list)
Depends on:
Blocks: mab4.1
  Show dependency treegraph
 
Reported: 2013-04-18 10:49 UTC by Rainer Bielefeld Retired
Modified: 2013-12-16 00:57 UTC (History)
8 users (show)

See Also:
Crash report or crash signature:


Attachments
Process Monitor stack trace log - zip compressed (840.60 KB, application/zip)
2013-04-20 20:51 UTC, V Stuart Foote
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Rainer Bielefeld Retired 2013-04-18 10:49:02 UTC
Steps how to reproduce [Reproducible] with parallel Dev-installation of  "Version 4.1.0.0.alpha0+ (Build ID: 0b4315077a6827798e1d2bdae73298365ba9a01) TinderBox: Win-x86@6, Branch:master, Pull Time:  2013-04-18_04:00:51" ENGLISH UI / German Locale on German WIN7 Home Premium (64bit) with LODev/4 Masters User Profile:

1. Launch LibO
2. Create new empty Writer Document from LibO Start Center
   > Caret flashes at top left position
3. type "xx"
4. Mouseclick between both typed characters
   CRASH


Additional info
---------------
Was not a problem with "with parallel Dev-installation of  "Version 4.1.0.0.alpha0+ (Build ID: 049ce78144650d92eb6bd73292868f73d37c901) TinderBox: Win-x86@6, Branch:master, Pull Time: 2013-03-29_23:59:42" ENGLISH UI / German Locale on German WIN7 Home Premium (64bit) with LODev/4 Masters User Profile ", so REGRESSION
Comment 1 Rainer Bielefeld Retired 2013-04-18 11:20:58 UTC
No crashes during some tests in Calc and Draw.
Comment 2 Rainer Bielefeld Retired 2013-04-18 11:21:57 UTC
*** Bug 63678 has been marked as a duplicate of this bug. ***
Comment 3 Jean-Baptiste Faure 2013-04-18 20:09:43 UTC
I do not reproduce on Ubuntu 12.04 x86-64 with my own build:
Version: 4.1.0.0.alpha0+ Build ID: 3d6424a752902bba513102834966868f609d91e
which is more recent. MS-Windows only problem ?

Best regards. JBF
Comment 4 V Stuart Foote 2013-04-20 20:51:55 UTC
Created attachment 78282 [details]
Process Monitor stack trace log - zip compressed

Have same behavior with this daily build on Windows 7 Ultimate, w/SP1 us-English 1033. Crash occurs on mouse click, or after typing a dozen characters or so.

Have crashes with a command line msiexec /A administrative installation, and also with a full msiexec installation with a WRITE_REGISTRY=1 value with all other soffice (LibreOffice and Apache OpenOffice removed). JRE 1.6.45 present but not enabled for sessions.

Have attached a Process Monitor log and stack trace of the installation with Windows registry. It is clipped from launch of LibreOffice, opening Writer, crash of Writer and start of recovery. 

Review stack trace using Process Monitor -- http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx
Comment 5 V Stuart Foote 2013-04-20 21:31:45 UTC
The follow-on TB 6 Windows build also crashing in Writer

Build Info
tinderbox: administrator: Tinderbox <l.lunak@suse.cz>
tinderbox: buildname: Win-x86@6
tinderbox: tree: MASTER
tinderbox: pull time 2013-04-18 23:11:53
tinderbox: git sha1s
core:fa72fc3eddbfabb82193452a4ba993b11d1584da
Comment 6 V Stuart Foote 2013-04-20 22:07:06 UTC
So working backward through the daily builds, the TB 6--2013-04-17 17:14:03 build throws a 1935 installer error:

MSI (s) (E0:C4) [16:43:00:224]: Note: 1: 1935 2: {73262DA0-9E92-E443-6C74-8F2BD63FC77B} 3: 0x80070005 4: IAssemblyCacheItem 5: Commit 6: policy.1.0.cli_cppuhelper,publicKeyToken="ce2cb7e279207b9e",version="22.0.0.0",culture="neutral",processorArchitecture="x86" 
DEBUG: Error 2835:  The control ErrorIcon was not found on dialog SetupError
Internal Error 2835. ErrorIcon, SetupError

Error 1935.An error occurred during the installation of assembly 'policy.1.0.cli_cppuhelper,publicKeyToken="ce2cb7e279207b9e",version="22.0.0.0",culture="neutral",processorArchitecture="x86"'. Please refer to Help and Support for more information. HRESULT: 0x80070005. assembly interface: IAssemblyCacheItem, function: Commit, component: {73262DA0-9E92-E443-6C74-8F2BD63FC77B}

MSI (s) (E0:C4) [16:43:57:694]: Product: LibreOfficeDev 4.1.0.0.alpha0 -- Error 1935.An error occurred during the installation of assembly 'policy.1.0.cli_cppuhelper,publicKeyToken="ce2cb7e279207b9e",version="22.0.0.0",culture="neutral",processorArchitecture="x86"'. Please refer to Help and Support for more information. HRESULT: 0x80070005. assembly interface: IAssemblyCacheItem, function: Commit, component: {73262DA0-9E92-E443-6C74-8F2BD63FC77B}

Think we saw Windows build issue similar to this with FDO bug 55290
Comment 7 V Stuart Foote 2013-04-20 22:55:17 UTC
The 2013-04-08 daily build Writer looks to function correctly without crash from cursor movement or text entry...

Build Info
tinderbox: administrator: Tinderbox <l.lunak@suse.cz>
tinderbox: buildname: Win-x86@6
tinderbox: tree: MASTER
tinderbox: pull time 2013-04-08 05:35:47
tinderbox: git sha1s
core:73cc9fc42cfa524a9965f58092f3a004de3a6b87
Comment 8 V Stuart Foote 2013-04-21 22:12:12 UTC
2013-04-21 build of Master remains afflicted...

Build Info
tinderbox: administrator: Tinderbox <l.lunak@suse.cz>
tinderbox: buildname: Win-x86@6
tinderbox: tree: MASTER
tinderbox: pull time 2013-04-21 13:18:12
tinderbox: git sha1s
core:288c8b9d59024897e88b55b9001f9922998d1302
Comment 9 V Stuart Foote 2013-04-22 16:44:59 UTC
another TB 6 build cycle of Master with Writer unusable

tinderbox: buildname: Win-x86@6
tinderbox: tree: MASTER
tinderbox: pull time 2013-04-22 09:21:49
tinderbox: git sha1s
core:b9cc769926fa2558b8e76181b0cc850347410a09

Last usable TB Windows build of master was 8 April.

I know TB 6 aren't debug symbol builds, but was hoping to pin down the start point of the crash. So anyone with suggestions to help teasing out the aborting dll and start of LO recovery?

Any need for additional Process Monitor .PML stack traces?
Comment 10 Florian Reisinger 2013-04-23 06:58:46 UTC
Maybe related? https://bugs.freedesktop.org/show_bug.cgi?id=63767
Comment 11 V Stuart Foote 2013-04-23 09:59:01 UTC
@Florian,

Yes I believe related. The attachment 58474 [details]--t.doc--does not crash on the 2013-04-08 TB 6 build of master. Nor does the attachment 69600 [details]--TOC.doc--crash, and the hyperlinks of the TOC correctly function.

The attachment 68822 [details]--2011.10.20.doc--a Word 97-2003 document based on "normal.dotm" with Macros disabled does crash--no surprise.

If they open correctly for you if you load the 2013-04-08 build, then I'd mark bug 63767 a duplicate of this.
Comment 12 V Stuart Foote 2013-04-23 12:32:56 UTC
see some related discussion in QA mail list thread: http://nabble.documentfoundation.org/fdo-63680-Windows-builds-of-Master-Writer-crashing-tp4051683.html
Comment 13 Florian Reisinger 2013-04-23 13:33:10 UTC
Still with

Version: 4.1.0.0.alpha0+
Build ID: 6536d0eb4f56e64c9b74b358642e3ee1e39353e
TinderBox: Win-x86@6, Branch:master, Time: 2013-04-23_04:48:50
Comment 14 V Stuart Foote 2013-04-25 23:13:37 UTC
Another bust...

tinderbox: buildname: Win-x86@6
tinderbox: tree: MASTER
tinderbox: pull time 2013-04-25 18:39:59
tinderbox: git sha1s
core:4fc8209e91e3cefb3163e17d0cd97fad78165a0c

It is only with Writer, other components seem unaffected. Simple typing or a mouse cursor action into text is immediate crasher.

I've worked through a whole crash cycle in debugger (Process Monitor w/dbghelp.dll and MSVC 2010 Smybols), but with no debug symbols against the LO Dev Windows build, while I can see it crash and calls to the Windows Error handler, no details of the LibreOffice call that is dumping.

Any chance of flipping a switch to do a debug build of TB 6 for a cycle or two? And then posting the .pdb symbols along with the Dev build?
Comment 15 Michael Meeks 2013-04-26 07:02:45 UTC
Fridrich - where did we get to with the debug/symbol server ? :-)

Stuart - thanks for the great debugging !
Comment 16 V Stuart Foote 2013-04-26 13:40:01 UTC
@urmas in https://bugs.freedesktop.org/show_bug.cgi?id=63767#c7
caught this stack trace with symbols

<snip>
In Windows, the master build crashes with every document trying to dereference NULL pointer:

sal3.dll!rtl_uString_assign()
????	
swlo.dll!SwTable::SetTabCols()
swlo.dll!cppu::WeakImplHelper2<com::sun::star::linguistic2::XLinguServiceEventListener,com::sun::star::frame::XTerminateListener>::getImplementationId()
swlo.dll!SwTxtNode::GetMinMaxSize()
swlo.dll!SwTxtNode::GetMinMaxSize()
swlo.dll!SwTxtNode::GetMinMaxSize()
swlo.dll!SwTable::SetTabCols()	
swlo.dll!SwTxtNode::IsAutoCompleteWordDirty()
swlo.dll!SwTxtNode::TransliterateText()
swlo.dll!SwPosFlyFrm::~SwPosFlyFrm()
swlo.dll!SwPosFlyFrm::~SwPosFlyFrm()
swlo.dll!SwPosFlyFrm::~SwPosFlyFrm()
swlo.dll!ViewShell::LayoutIdle()
</snip>
Comment 17 Commit Notification 2013-04-28 14:28:57 UTC
Miklos Vajna committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=1fd3167695aaebb050df53acd91f2e1625e8305a

fdo#63680 SwTxtCursor::GetCrsrOfst: don't pass reference to a temporary



The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 18 Miklos Vajna 2013-04-28 14:31:37 UTC
FWIW, problem can be reproduced when building without --enable-debug or --enable-dbgutil, using MSVC. Just rebuilding sw with debug=t makes the problem go away, however ENABLE_SYMBOLS=y still reproduced the problem.

Can't reproduce on 4.0, so closing without a backport.
Comment 19 V Stuart Foote 2013-04-28 14:54:49 UTC
*** Bug 63767 has been marked as a duplicate of this bug. ***
Comment 20 V Stuart Foote 2013-04-29 06:16:08 UTC
Confirming functional patch of Writer for the TB 6 build of Master.

tinderbox: buildname: Win-x86@6
tinderbox: tree: MASTER
tinderbox: pull time 2013-04-29 04:16:17
tinderbox: git sha1s
core:e986d3e396174096abb46075bf7488677b9a35f9

We can get back to QA work.

Thanks Arnaud and Miklos!