Bug 138512

Summary: CRASH: Changing vertical alignment (GTK3)
Product: LibreOffice Reporter: Xisco Faulí <xiscofauli>
Component: WriterAssignee: Caolán McNamara <caolan.mcnamara>
Status: RESOLVED FIXED    
Severity: normal CC: bakos.attilakaroly, libreoffice, serval2412, telesto, xiscofauli
Priority: medium Keywords: bibisected, bisected
Version: 7.2.0.0.alpha0+   
Hardware: All   
OS: All   
See Also: https://bugs.documentfoundation.org/show_bug.cgi?id=137546
Whiteboard: target:7.2.0 target:7.6.0 target:7.5.4
Crash report or crash signature: Regression By:
Bug Depends on:    
Bug Blocks: 103182, 133092    
Attachments: sample file
bt with debug symbols (gtk3)

Description Xisco Faulí 2020-11-26 12:47:40 UTC
Created attachment 167587 [details]
sample file

Steps to reproduce:
1. Open attached document
2. Select the shape
3. Change align to bottom
4. Change align to top
5. Click somewhere else

-> Crash

Reproduced in

Version: 7.1.0.0.beta1+
Build ID: f3e7e5a6aa4d3eafb584f5d22c1a31bb0a3dd496
CPU threads: 4; OS: Linux 5.7; UI render: default; VCL: x11
Locale: en-US (en_US.UTF-8); UI: en-US
Calc: threaded
Comment 1 Xisco Faulí 2020-11-26 12:49:23 UTC
Regression introduced by:

https://cgit.freedesktop.org/libreoffice/core/commit/?id=3347d71b23595919e167bd49932675e77cbbdbbb

author	Attila Bakos (NISZ) <bakos.attilakaroly@nisz.hu>	2020-11-03 15:05:00 +0100
committer	László Németh <nemeth@numbertext.org>	2020-11-24 11:31:40 +0100
commit 3347d71b23595919e167bd49932675e77cbbdbbb (patch)
tree 7ce27660cd544db00b8d84fdc67e27d01f66cbec
parent 47bb1e449f8dd1668c4e50ab7df980f4e3de8319 (diff)
tdf#137546 sw: fix text position at textbox alignment

Bisected with: bibisect-linux64-7.1

Adding Cc: to Attila Bakos
Comment 2 Julien Nabet 2020-11-28 11:35:07 UTC
Created attachment 167636 [details]
bt with debug symbols (gtk3)

On pc Debian x86-64 with master sources updated today + gtk3, I could reproduce the crash.
I also noticed that:
- no radio button was selected after first alignment changing
- I don't reproduce the crash with gen rendering
Comment 3 Julien Nabet 2020-11-28 11:56:13 UTC
With this patch, I don't reproduce the crash with gtk3:
diff --git a/sw/source/core/access/accmap.cxx b/sw/source/core/access/accmap.cxx
index 8f3543dcd4df..e4e33ab26bdb 100644
--- a/sw/source/core/access/accmap.cxx
+++ b/sw/source/core/access/accmap.cxx
@@ -2749,7 +2749,7 @@ void SwAccessibleMap::InvalidateCursorPosition( const SwFrame *pFrame )
 
     for (SwAccessibleParagraph* pAccPara : m_setParaRemove)
     {
-        if(pAccPara && pAccPara->getSelectedAccessibleChildCount() == 0 && pAccPara->getSelectedText().getLength() == 0)
+        if(pAccPara && pAccPara->GetFrame() && pAccPara->getSelectedAccessibleChildCount() == 0 && pAccPara->getSelectedText().getLength() == 0)
         {
             if(pAccPara->SetSelectedState(false))
             {

but don't know if it's the right way to fix this.
Comment 4 Attila Bakos (NISZ) 2020-12-02 10:18:50 UTC
Hi there. I cannot reproduce this crash in:

Version: 7.1.0.0.beta1+ (x64)
Build ID: f3e7e5a6aa4d3eafb584f5d22c1a31bb0a3dd496
CPU threads: 8; OS: Windows 10.0 Build 19042; UI render: default; VCL: win
Locale: hu-HU (hu_HU); UI: en-US
Calc: CL

This might be a platform-dependent bug, or i am so clumsy...
Comment 5 Attila Bakos (NISZ) 2020-12-28 09:56:05 UTC
(In reply to Attila Bakos (NISZ) from comment #4)
> Hi there. I cannot reproduce this crash in:
> 
> Version: 7.1.0.0.beta1+ (x64)
> Build ID: f3e7e5a6aa4d3eafb584f5d22c1a31bb0a3dd496
> CPU threads: 8; OS: Windows 10.0 Build 19042; UI render: default; VCL: win
> Locale: hu-HU (hu_HU); UI: en-US
> Calc: CL
> 
> This might be a platform-dependent bug, or i am so clumsy...

As I guess, it can be reproduced with:

Version: 7.2.0.0.alpha0+
Build ID: c3175687ed793c6a99eaf17a2e3e48b5d7891be7
CPU threads: 4; OS: Linux 5.4; UI render: default; VCL: gtk3
Locale: hu-HU (hu_HU.UTF-8); UI: en-US
Calc: threaded

but not with:

Version: 7.2.0.0.alpha0+
Build ID: c3175687ed793c6a99eaf17a2e3e48b5d7891be7
CPU threads: 4; OS: Linux 5.4; UI render: default; VCL: x11
Locale: hu-HU (hu_HU.UTF-8); UI: en-US
Calc: threaded
Comment 6 Commit Notification 2021-02-04 12:46:15 UTC
Attila Bakos (NISZ) committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/54302a574a98d6fc071472f1fa64adaf70864a26

tdf#138512 sw: fix crash on textbox alignment

It will be available in 7.2.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 7 Commit Notification 2021-02-10 12:38:28 UTC
Xisco Fauli committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/26ee85d5ecf97745cc6e0a773eac654e2d573040

Revert "tdf#138512 sw: fix crash on textbox alignment"

It will be available in 7.2.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 8 Attila Bakos (NISZ) 2021-02-11 13:52:06 UTC
Not really understand, what was the point of adding me to cc:

-As I mentioned in few comments before this bug could be reproduced only with gtk3, however that change what the code-pointer shows, does not touch that, this change only revealed the problem not caused that.

-In spite of this, I have reverted my commit what have been chosen by the bibisect, but it seems this was not useful - see reopening.

So, because the above written, this is not a regression by me. -> removing myself from cc.
Comment 9 Caolán McNamara 2023-05-09 13:18:01 UTC
lets not crash anyway, comment #3 looks basically good enough to me
Comment 10 Commit Notification 2023-05-09 18:42:55 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/5e99e5d734f19fe7299a3e390b23a93db971e013

Resolves: tdf#138512 don't crash on removing already Disposed a11y context

It will be available in 7.6.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 11 Caolán McNamara 2023-05-09 18:43:49 UTC
done in trunk, backport to 7-5 in gerrit
Comment 12 Commit Notification 2023-05-10 09:23:17 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-7-5":

https://git.libreoffice.org/core/commit/594aac44a5e06ef8ecc5ab0b30a3620191a5b936

Resolves: tdf#138512 don't crash on removing already Disposed a11y context

It will be available in 7.5.4.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.