Created attachment 70013 [details] Doc who crashes LO after using the Edit contour dialog Problem description: After changing the “contour” (right click on the image in the document and choose “wrap” and then “Edit Contour”, just change a bit the contour and save an close the contour dialog. Then run the sytemdialog macro (who just change from system dialogs to LO dialogs) Normaly (noy always) the LO will crash Platform (if different from the browser): Browser: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11
Confirmed on LO 3.6.3.2 Windows Vista 32bit. To reproduce: 1. Open attached document 2. Right click on the image; Wrap->Edit contour 3. Move the "markers" around quite drastically. e.g. move the bottom one up to the middle and the right marker to the middle. 3. Click the 'tick' in the top left corner. 4. Press the 'Run systemdialog macro' button. (make sure that macros are turned on) LO will crash. Note that the first few times I tried this, it didn't crash. Perhaps because I didn't make drastic enough changes when I did 'edit contour'. I can reproduce it every time now though.
Not the way of changing the contour is important, its sort of the number off times you do the action, but after a first crash, it seems to crash alway's after ?
Created attachment 70822 [details] Bug 57079 - WinDbg session Confirmed with: LO 4.0.0.0.alpha1+ Build ID: own W7 debug build (dec8fe97d9f48d59b6bb0f98faded0f6aa8397df) Windows 7 Professional SP1 64 bit Java build 1.6.0_33-b03 Attached full WinDbg session.
Version 4.0.1.2. Contour Editor also crashes LO immediately when clicking to finish after using either the Rectangle, Ellipse, or Polygon tool to set a contour.
Crash in Version 4.0.1.2 (Build ID: 84102822e3d61eb989ddd325abf1ac077904985) on Windows 7 I always get a crash. this happens as soon as I double click to end polygon editing. The document recovery works flawlessly but the wrap is not edited.
I mark this bug as Critical Medium [1]: Critical: Crash Medium: as far I can't see any other related bugs which mention this crash or many people in CC, this bug does not affect MANY users. (please see flowchart). Thanks for your understanding, Joren [1] https://wiki.documentfoundation.org/images/0/06/Prioritizing_Bugs_Flowchart.jpg
Joren, I must confirm that "Contour" becomes useless due to crach when "double clicking" Changed status to High because this bug prefend us to go to 4.0 ! (100 users) OO 4.0 do not suffer from this bug !
there are clearly 2 different bugs here. the crash in comment #4 is also filed as bug 62965. i think i found the commit that introduced that one, see other bug. please keep this bug to what is in the description. the crash in the description is around in every version since OOo 3.2.1 ... OOo 3.1.1 does not seem to crash so i guess it's a regression.
Comment on attachment 70822 [details] Bug 57079 - WinDbg session sadly this windbg trace is useless, just shows some random place where it crashes subsequently...
apparently the SvxSuperContourDlg registers an event handler that is called on configuration changes... but it somehow isn't unregistered when the dialog is closed ==21999== Invalid read of size 2 ==21999== at 0x86CDCB4: ToolBox::SetOutStyle(unsigned short) (toolbox2.cxx:1791) ==21999== by 0x225E44B6: SvxSuperContourDlg::MiscHdl(void*) (_contdlg.cxx:806) ==21999== by 0x6D2DE86: SvtMiscOptions_Impl::CallListeners() (link.hxx:143) ==21999== by 0x7F48B0A: utl::ConfigChangeListener_Impl::changesOccurred(com::sun::star::util::ChangesEvent const&) (configitem.cxx:208) ==21999== by 0x16BA7705: configmgr::Broadcaster::send() (broadcaster.cxx:198) ==21999== by 0x16BDBC78: configmgr::RootAccess::commitChanges() (rootaccess.cxx:197) ==21999== Address 0x26ba7b4c is 1,964 bytes inside a block of size 4,680 free'd ==21999== at 0x4A073CC: operator delete(void*) (vg_replace_malloc.c:480) ==21999== by 0x6228869: SfxChildWindow::~SfxChildWindow() (childwin.cxx:201) ==21999== by 0x225E4596: SvxContourDlgChildWindow::~SvxContourDlgChildWindow() (contdlg.hxx:45) ==21999== by 0x6229140: SfxChildWindow::Destroy() (childwin.cxx:193) ==21999== by 0x6277B27: SfxWorkWindow::RemoveChildWin_Impl(SfxChildWin_Impl*) (workwin.cxx:1622) ==21999== by 0x6278EA6: SfxWorkWindow::ToggleChildWindow_Impl(unsigned short, unsigned char) (workwin.cxx:2072) ==21999== by 0x21236144: SwBaseShell::Execute(SfxRequest&) (basesh.cxx:956) ==21999== by 0x62A76CC: SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, unsigned char) (shell.hxx:199) ==21999== by 0x62AF9CC: SfxDispatcher::Execute(unsigned short, unsigned short, SfxPoolItem const*, ...) (dispatch.cxx:1208) ==21999== by 0x62D61AE: SfxFloatingWindow::Close() (basedlgs.cxx:562) ==21999== by 0x225E0F78: SvxSuperContourDlg::Close() (_contdlg.cxx:337) ==21999== by 0x871D9CD: DelayedCloseEventLink(void*, void*) (winproc.cxx:1918)
fixed on master
Michael Stahl committed a patch related to this issue. It has been pushed to "master": http://cgit.freedesktop.org/libreoffice/core/commit/?id=fc63700181ab0f42eab5f98328074fe1682344f8 fdo#57079: SvxSuperContourDlg: unregister configuration listener The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
setting version back as per comment 8 by mst (this wasnt introduced in 3.6, but is much older)
thanks you made our day , on monday we move to 4.03
Michael Stahl committed a patch related to this issue. It has been pushed to "libreoffice-4-0": http://cgit.freedesktop.org/libreoffice/core/commit/?id=253871bca7d5f8085424bf920eb781596dc0371e&h=libreoffice-4-0 fdo#57079: SvxSuperContourDlg: unregister configuration listener It will be available in LibreOffice 4.0.4. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Michael Stahl committed a patch related to this issue. It has been pushed to "libreoffice-3-6": http://cgit.freedesktop.org/libreoffice/core/commit/?id=c04dc880044ca84b80bb13ac900de84ceae2a561&h=libreoffice-3-6 fdo#57079: SvxSuperContourDlg: unregister configuration listener It will be available in LibreOffice 3.6.7. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Verified on 4.0.4.2.