Issue 109009 - crash when closing calc with tooltip active
Summary: crash when closing calc with tooltip active
Alias: None
Product: Calc
Classification: Application
Component: code (show other issues)
Version: OOo 3.2 RC5
Hardware: All All
: P3 Trivial (vote)
Target Milestone: ---
Assignee: kla
QA Contact: issues@sc
: 109920 (view as issue list)
Depends on:
Reported: 2010-02-06 12:20 UTC by caolanm
Modified: 2013-08-07 15:14 UTC (History)
3 users (show)

See Also:
Issue Type: PATCH
Latest Confirmation in: ---
Developer Difficulty: ---

here's a fix (4.03 KB, patch)
2010-02-06 12:21 UTC, caolanm
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this issue.
Description caolanm 2010-02-06 12:20:34 UTC
start calc
click in input bar
type =SUM(
tool tip appears of SUM(->number 1; ...
now click on close window
and discard on dialog
(tooltip should still be visible at this stage)
Comment 1 caolanm 2010-02-06 12:21:01 UTC
valgrind trace:

==14947== Thread 1:
==14947== Invalid read of size 8
==14947==    at 0x7BB4055: Window::CallEventListeners(unsigned long, void*)
==14947==    by 0x7BB4E9E: Window::ImplResetReallyVisible() (window.cxx:1548)
==14947==    by 0x7BB4F2B: Window::ImplResetReallyVisible() (window.cxx:1564)
==14947==    by 0x7BC13C8: Window::Show(unsigned char, unsigned short)
==14947==    by 0x7BC1015: Window::Show(unsigned char, unsigned short)
==14947==    by 0x7A04F6C: Help::HideTip(unsigned long) (window.hxx:748)
==14947==    by 0x1B4B2DE1: ScInputHandler::HideTipBelow() (inputhdl.cxx:697)
==14947==    by 0x1B4B5849: ScInputHandler::NotifyChange(ScInputHdlState const*,
unsigned char, ScTabViewShell*, unsigned char) (inputhdl.cxx:3474)
==14947==    by 0x1B5634BE: ScTabViewShell::Deactivate(unsigned char)
==14947==    by 0x5F5F595: SfxShell::DoDeactivate_Impl(SfxViewFrame*, unsigned
char) (shell.cxx:729)
==14947==    by 0x5F485DF: SfxDispatcher::DoDeactivate_Impl(unsigned char,
SfxViewFrame*) (dispatch.cxx:911)
==14947==    by 0x5F1F0C1: SfxViewFrame::DoDeactivate(unsigned char,
SfxViewFrame*) (viewfrm.cxx:1412)
==14947==    by 0x5D99FD0: SfxApplication::SetViewFrame_Impl(SfxViewFrame*)
==14947==    by 0x5F2C8F6: SfxTopViewFrame::Close() (topfrm.cxx:1164)
==14947==    by 0x5F12FB5: SfxFrame::DoClose_Impl() (frame.cxx:210)
==14947==    by 0x5F34FE3: SfxBaseController::dispose() (sfxbasecontroller.cxx:1178)
==14947==    by 0x184E1FBF: ??? (in
==14947==    by 0x184DD95F: ??? (in
==14947==    by 0x184BD15C: ??? (in
==14947==    by 0x184BF115: ??? (in
==14947==    by 0x184AF446: ??? (in
==14947==    by 0x184AF94B: ??? (in
==14947==    by 0x7C26829: vcl::EventPoster::LinkStubDoEvent_Impl(void*, void*)
==14947==    by 0x7BCD4DC: ImplWindowFrameProc(Window*, SalFrame*, unsigned
short, void const*) (link.hxx:142)
==14947==    by 0x11247917: SalDisplay::DispatchInternalEvent() (salframe.hxx:288)
==14947==    by 0x10F31F9F: GtkXLib::userEventFn(void*) (gtkdata.cxx:770)
==14947==    by 0x39C0A39E4F: g_main_context_dispatch (in
==14947==    by 0x39C0A3DBF7: ??? (in /lib64/
==14947==    by 0x39C0A3DDDB: g_main_context_iteration (in
==14947==    by 0x10F3210C: GtkXLib::Yield(bool, bool) (gtkdata.cxx:825)
==14947==    by 0x7A0D40D: Application::Yield(bool) (svapp.cxx:502)
==14947==    by 0x7A0D476: Application::Execute() (svapp.cxx:461)
==14947==    by 0x5028155: ??? (in
==14947==    by 0x7A123E8: ImplSVMain() (svmain.cxx:186)
==14947==    by 0x7A124D4: SVMain() (svmain.cxx:227)
==14947==    by 0x505991B: soffice_main (in
==14947==    by 0x4010EA: main (in /usr/lib64/openoffice.org3/program/soffice.bin)
==14947==  Address 0x1815cb98 is 2,456 bytes inside a block of size 2,624 free'd
==14947==    at 0x4A04D72: free (vg_replace_malloc.c:325)
==14947==    by 0x5DC6843: SfxChildWindow::~SfxChildWindow() (childwin.cxx:213)
==14947==    by 0x1B4BF5E2: ScInputWindowWrapper::~ScInputWindowWrapper()
==14947==    by 0x5DC7388: SfxChildWindow::Destroy() (childwin.cxx:203)
==14947==    by 0x5DFF274: SfxWorkWindow::DeleteControllers_Impl() (workwin.cxx:753)
==14947==    by 0x5F12F9F: SfxFrame::DoClose_Impl() (frame.cxx:207)
==14947==    by 0x5F34FE3: SfxBaseController::dispose() (sfxbasecontroller.cxx:1178)
Comment 2 caolanm 2010-02-06 12:21:34 UTC
Created attachment 67673 [details]
here's a fix
Comment 3 caolanm 2010-02-06 12:22:52 UTC
callbacks try and popdown the tooltip, but the tooltip's parent has already been
destroyed. Patch works around this by popping down the tooltip when the parent
is destroyed (or hidden to be even more safe)
Comment 4 philipp.lohmann 2010-03-18 14:06:50 UTC
confirmed; however the window destructor normally destroys an active help window
(see window.cxx:4427 ImplDestroyHelpWindow). Only in this case it doesn't; is
this some special kind of window ?
Comment 5 philipp.lohmann 2010-03-18 14:42:39 UTC
Ah, these are tip windows of which one can have more than one (quaint). That
means there is no active help window to delete, just a child window.
Comment 6 philipp.lohmann 2010-03-18 14:49:33 UTC
reassign try 2
Comment 7 niklas.nebel 2010-04-26 18:30:48 UTC
I added the patch to CWS "calc53". A HideTipBelow call was missing next to the
existing HideTip call in ScInputHandler::EnterHandler, and that alone fixes the
exact case as described. For safety, I added the event listener stuff anyway, to
be less dependent on the sequence of calls.
Comment 8 niklas.nebel 2010-04-29 17:25:02 UTC
reassigning to QA for verification
Comment 9 kla 2010-05-11 10:44:52 UTC
Seen ok in CWS calc53 -> verified
Comment 10 caolanm 2010-05-31 21:11:58 UTC
closing, integrated DEV300_m80
Comment 11 2011-04-11 14:55:58 UTC
*** Issue 109920 has been marked as a duplicate of this issue. ***