Issue 124629 - css::ui::dialogs::Wizard crashes
Summary: css::ui::dialogs::Wizard crashes
Alias: None
Product: General
Classification: Code
Component: code (show other issues)
Version: 3.3.0 or older (OOo)
Hardware: All All
: P3 Normal (vote)
Target Milestone: 4.2.0
Assignee: Ariel Constenla-Haile
QA Contact:
Keywords: crash
Depends on:
Reported: 2014-04-08 12:47 UTC by Ariel Constenla-Haile
Modified: 2017-05-20 10:35 UTC (History)
0 users

See Also:
Issue Type: DEFECT
Latest Confirmation in: 4.1.0-dev
Developer Difficulty: ---

Zip file with a sample code (4.82 KB, application/zip)
2014-04-08 12:47 UTC, Ariel Constenla-Haile
no flags Details
GDB backtrace (6.97 KB, text/plain)
2014-04-08 13:14 UTC, Ariel Constenla-Haile
no flags Details

Note You need to log in before you can comment on or make changes to this issue.
Description Ariel Constenla-Haile 2014-04-08 12:47:26 UTC
Created attachment 83133 [details]
Zip file with a sample code

- Unzip the attached example and build it with the SDK
- execute it with the target

A Writer document and a Draw document will be created, the wizard will be executed with any of this document's container window as parent.

- On the Wizard press "Next" button until reaching the end of the wizard, then press "Finish" button

The client application exits without error

- Close the two document
- OpenOffice crashes:

Application Error

Fatal exception: Signal 6
/opt/openoffice4/program/soffice: line 121:  7496 Aborted                 "$sd_prog/$sd_binary" "$@"
Comment 1 Ariel Constenla-Haile 2014-04-08 13:14:43 UTC
Created attachment 83134 [details]
GDB backtrace

The backtrace shows clearly what's happening:

- the code that creates the wizard dialog owns it, this means that when the client application releases its reference to it, the wizard dialog (a C++ UNO object, lifetime controller by reference count) should die

- but that's not the case. There is another object holding a reference to the UNO dialog (svt::uno::Wizard): its VCL dialog (svt::uno::WizardShell).

The VCL dialog is constructed with a reference to the UNO dialog, this prevents the UNO dialog from being deleted when the client code released its references.

In the normal case, when the UNO dialog dies, it deletes the VCL dialog, but as its VCL dialog holds a reference to it, the VCL dialog is first deleted by the vcl::LazyDeletor.

In this case, when the VCL dialog dies, its reference to the UNO dialog is deleted, and the UNO dialog starts to die.

Here the cyclic bug: when the UNO dialog is being deleted it deletes the VCL dialog, but this is already in its destructor.
Comment 2 SVN Robot 2014-04-10 15:36:30 UTC
"arielch" committed SVN revision 1586340 into trunk:
i124629 - UNO Wizard - avoid crash by removing unneeded reference
Comment 3 Ariel Constenla-Haile 2014-04-10 22:07:27 UTC
The commit from revision 1586340 solves the crash described in this bug.
The implementation has other bugs, that will be reported apart.
Setting this as fixed.