Issue 91683 - crash on delete cell with spell checker window opened
Summary: crash on delete cell with spell checker window opened
Alias: None
Product: Calc
Classification: Application
Component: editing (show other issues)
Version: OOo 2.4.1
Hardware: All All
: P2 Trivial with 2 votes (vote)
Target Milestone: ---
Assignee: oc
QA Contact: issues@sc
Depends on:
Reported: 2008-07-15 20:38 UTC by dprina
Modified: 2013-08-07 15:15 UTC (History)
2 users (show)

See Also:
Issue Type: DEFECT
Latest Confirmation in: ---
Developer Difficulty: ---

patch curing the symptom and preventing a crash, see comments inside (1.06 KB, patch)
2008-07-17 13:31 UTC, ooo
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this issue.
Description dprina 2008-07-15 20:38:15 UTC
To reproduce the bug:

0) Open OOoCalc

1) write in A1 cell the following:
house inv.

2) Tools -> Spellcheck ...
   This open the spell checker window
   The word inv. must be viewed as wrong by spell checker

3) select on A1 Cell (not the spell checker window) the string "inv." (do not
close the spell checker window)

4) press Del button (the button used to cancel the selected text)
   Del button is this: 
   Someone tell me that he have the crash with the backspace button and not 
   with the Del one

5) OOo crash

I have asked some people to check if they can reproduce this bug and:
* a lot of people with GNU/Linux and Windows can reproduce this bugs
* some people with GNU/Linux and Windows cannot reproduce this bug

More than ten people can reproduce the bug and less then five people cannot.

I have noted that if a person can reproduce the bug, then he can reproduce it on
each computer he have. But if a person cannot reproduce the bug, then he cannot
reproduce it on each computer he own.

Probably the bug depends on some options.

I have try to start OOo with a new user (default option), selecting or
deselecting options, using only English dictionary (normally I have also Italian
dictionary and Italian surname dictionary), etc ... but I have had always a crash

Comment 1 frank 2008-07-15 23:06:30 UTC
there did you get your Installation set from ?
Comment 2 Andrea Pescetti 2008-07-16 00:26:23 UTC
This is reproducible with OOo 2.4.1 (English and Italian) and OOo 3.0-beta2
(Italian). Always the official version provided by SUN.
Comment 3 oc 2008-07-16 08:12:25 UTC
reproduced in DEV300_m24
Comment 4 frank 2008-07-16 09:25:43 UTC
crashreport for SO8PU11 is rqr3q3
Comment 5 oc 2008-07-16 09:41:11 UTC
Spreadsheet only problem => reassigned to er
ReportID: rv2y4uc
Comment 6 thomas.lange 2008-07-16 09:55:49 UTC
The crashdebug job I meanwhile started returned the following result:

calling r:\windbg\kd.exe  -srcpath
o:\OOH680\src.m17;o:\OOH680\\inc.m17 -y
symsrv*sosymsrv.dll*C:\WINDOWS\TEMP\crashdata-3312-1216198754.pathes  -z
C:\WINDOWS\TEMP\crashdata-3312-1216198754_user.dmp -cf
C:\WINDOWS\TEMP\crashdata-3312-1216198754.starter | grep32 -d10000 -i "ChildEBP
ChildEBP RetAddr  
00ebf388 5dddee01 svx680mi!EditView::GetEditEngine( void )
[o:\ooh680\src.m17\svx\source\editeng\editview.cxx @ 206]
00ebf454 5dddfb4c sc680mi!ScEditShell::Execute(SfxRequest* rReq = 00eb1651
)+0x42 [o:\ooh680\src.m17\sc\source\ui\view\editsh.cxx @ 191]
00ebf460 613cbb39 sc680mi!SfxStubScEditShellExecute(SfxShell* pShell = 069e47c8
, SfxRequest* rReq = 00ebf894 )+0xe
[o:\ooh680\src.m17\sc\\inc\scslots.hxx @ 3408]
00ebf52c 613cd2bc sfx680mi!SfxDispatcher::Call_Impl(SfxShell* rShell = 069e47c8
, SfxSlot* rSlot = 5e292ae8 , SfxRequest* rReq = 00ebf894 , unsigned char
bRecord = 0x1 '')+0x3c5 [o:\ooh680\src.m17\sfx2\source\control\dispatch.cxx @ 338]
00ebf584 613c35c9 sfx680mi!SfxDispatcher::_Execute(SfxShell* rShell = 069e47c8 ,
SfxSlot* rSlot = 5e292ae8 , SfxRequest* rReq = 00ebf894 , unsigned short
eCallMode = 4)+0x1a5 [o:\ooh680\src.m17\sfx2\source\control\dispatch.cxx @ 1106]
00ebf640 61467a0d sfx680mi!SfxBindings::Execute_Impl(SfxRequest* aReq = 00ebf894
, SfxSlot* pSlot = 5e292ae8 , SfxShell* pShell = 069e47c8 )+0x419
[o:\ooh680\src.m17\sfx2\source\control\bindings.cxx @ 1731]
00ebf9b0 61465beb
sfx680mi!SfxDispatchController_Impl::dispatch(com::sun::star::util::URL* aURL =
069e8fa0 , com::sun::star::uno::Sequence* aArgs = 00ebfa4c ,
com::sun::star::uno::Reference* rListener = 00ebf9f4 )+0xbc0
[o:\ooh680\src.m17\sfx2\source\control\unoctitm.cxx @ 832]
00ebfa1c 609240b3
sfx680mi!SfxOfficeDispatch::dispatch(com::sun::star::util::URL* aURL = 069e8fa0
, com::sun::star::uno::Sequence* aArgs = 00ebfa4c )+0x107
[o:\ooh680\src.m17\sfx2\source\control\unoctitm.cxx @ 454]
00ebfa60 60924295 svt680mi!svt::AsyncAccelExec::impl_ts_asyncCallback(void*
__formal = 00000000 )+0x3c
[o:\ooh680\src.m17\svtools\source\misc\acceleratorexecute.cxx @ 471]
00ebfa6c 5f7a5975
svt680mi!svt::AsyncAccelExec::LinkStubimpl_ts_asyncCallback(void* pThis =
069e8f90 , void* pCaller = 00000000 )+0xe
[o:\ooh680\src.m17\svtools\source\misc\acceleratorexecute.cxx @ 464]
00ebfa7c 5f0c70e5 tl680mi!Link::Call(void* pCaller = 00000000 )+0x11
[o:\ooh680\src.m17\tools\inc\tools\link.hxx @ 158]

The code of that function looks like
EditEngine* EditView::GetEditEngine() const
	DBG_CHKTHIS( EditView, 0 );
	DBG_CHKOBJ( pImpEditView->pEditEngine, EditEngine, 0 );
	return pImpEditView->pEditEngine;

Thus I guess either the current EditEngine object is dead or the pImpEditView
pointer is.
Comment 7 ooo 2008-07-17 13:31:04 UTC
Created attachment 55183 [details]
patch curing the symptom and preventing a crash, see comments inside
Comment 8 ooo 2008-07-17 14:55:21 UTC
In cws late30bf01:

Comment 9 ooo 2008-07-17 18:26:26 UTC
Reassigning to QA for verification.

Note: to reproduce the old crash behavior after spell-check select the "inv."
text portion in the cell without clicking somewhere else before and no double
click and no F2 prior to selecting, then press Del (or any other edit action).
Btw, crash was in since at least OOo2.1 (which was the earliest release I tried).
Comment 10 oc 2008-07-21 12:14:49 UTC
verified in internal build cws_late30bf01
Remark: This fix disables the possibility to edit the cellcontent directly in
the cell => followup issue #i91914#
Comment 11 oc 2008-08-06 06:06:00 UTC
closed because fix available in builds OOO300_m1