From 2493308dbaba41f5cf4f967f36983a047f6b2fbf Mon Sep 17 00:00:00 2001 From: Michael Stahl Date: Tue, 8 Oct 2013 18:07:05 +0200 Subject: [PATCH] rhbz#1001768 rhbz#1016022 - Resolves: rhbz#1001768: fix various a11y deadlocks and crashes - Resolves: rhbz#1016022 fix cut from impress and paste to writer --- ...-69384-fix-impress-writer-copy-paste.patch | 114 ++++++++++++ ...Listener-disposing-delay-notificatio.patch | 173 ++++++++++++++++++ ...id-deadlock-in-OAccessibleContextHel.patch | 37 ++++ libreoffice.spec | 12 +- 4 files changed, 335 insertions(+), 1 deletion(-) create mode 100644 0001-fdo-69384-fix-impress-writer-copy-paste.patch create mode 100644 0001-rhbz-1001768-AtkListener-disposing-delay-notificatio.patch create mode 100644 0001-rhbz-1001768-avoid-deadlock-in-OAccessibleContextHel.patch diff --git a/0001-fdo-69384-fix-impress-writer-copy-paste.patch b/0001-fdo-69384-fix-impress-writer-copy-paste.patch new file mode 100644 index 0000000..c5cf579 --- /dev/null +++ b/0001-fdo-69384-fix-impress-writer-copy-paste.patch @@ -0,0 +1,114 @@ +From a3fa048790b6e0928be3ff8bcd102813e0bcedb3 Mon Sep 17 00:00:00 2001 +From: Miklos Vajna +Date: Fri, 4 Oct 2013 11:02:59 +0200 +Subject: [PATCH] fdo#69384 fix impress -> writer copy&paste + +Regression from 2ade07126971b79c92f729fae5709f2e2e2b495c (fdo#62044 RTF +import: don't overwrite existing styles when pasting, 2013-06-04), +during paste, if existing style was found, then the intention was to +skip that style, but instead we tried to create one. + +(cherry picked from commit 5ebe826caf75e8d00656b3333385bf0bbc05cb27) + +Conflicts: + writerfilter/source/dmapper/StyleSheetTable.cxx + +Change-Id: I83adaf9fe6b8a578fa60c21b9463fabde7707d7e +Reviewed-on: https://gerrit.libreoffice.org/6126 +Reviewed-by: Michael Stahl +Tested-by: Michael Stahl +--- + sw/qa/extras/rtfimport/data/fdo69384-paste.rtf | 17 +++++++++++++++++ + sw/qa/extras/rtfimport/rtfimport.cxx | 14 ++++++++++++++ + writerfilter/source/dmapper/StyleSheetTable.cxx | 11 +++++++++-- + 3 files changed, 40 insertions(+), 2 deletions(-) + create mode 100644 sw/qa/extras/rtfimport/data/fdo69384-paste.rtf + +diff --git a/sw/qa/extras/rtfimport/data/fdo69384-paste.rtf b/sw/qa/extras/rtfimport/data/fdo69384-paste.rtf +new file mode 100644 +index 0000000..cbdca5b +--- /dev/null ++++ b/sw/qa/extras/rtfimport/data/fdo69384-paste.rtf +@@ -0,0 +1,17 @@ ++{\rtf\ansi ++{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\fprq2\fcharset0 Segoe UI;}{\f2\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset0 Arial;}{\f4\fprq2\fcharset0 Droid Sans Fallback;}} ++{\colortbl\red255\green255\blue255;;} ++{\stylesheet ++{\s1\fi0\li0\ri0\sb0\sa0\sl200\slmult0\cf0\f3\fs36\b0\ulnone\strike0\i0\outl0\shad0\kerning1\f4\f2\fs36\fs36\b0\b0\i0\i0\accnone\olnone\snext1 Default;} ++{\s2\fi0\li0\ri0\sb0\sa0\sl200\slmult0\cf0\f3\fs36\b0\ulnone\strike0\i0\outl0\shad0\kerning1\f4\f2\fs36\fs36\b0\b0\i0\i0\accnone\olnone\sbasedon1\snext2 Object with arrow;} ++{\s3\fi0\li0\ri0\sb0\sa0\sl200\slmult0\cf0\f3\fs36\b0\ulnone\strike0\i0\outl0\shad0\kerning1\f4\f2\fs36\fs36\b0\b0\i0\i0\accnone\olnone\sbasedon1\snext3 Object with shadow;} ++{\s4\fi0\li0\ri0\sb0\sa0\sl200\slmult0\cf0\f3\fs36\b0\ulnone\strike0\i0\outl0\shad0\kerning1\f4\f2\fs36\fs36\b0\b0\i0\i0\accnone\olnone\sbasedon1\snext4 Object without fill;} ++{\s5\fi0\li0\ri0\sb0\sa0\sl200\slmult0\cf0\f3\fs36\b0\ulnone\strike0\i0\outl0\shad0\kerning1\f4\f2\fs36\fs36\b0\b0\i0\i0\accnone\olnone\sbasedon1\snext5 Object with no fill and no line;} ++{\s6\fi0\li0\ri0\sb0\sa0\sl200\slmult0\cf0\f3\fs36\b0\ulnone\strike0\i0\outl0\shad0\kerning1\f4\f2\fs36\fs36\b0\b0\i0\i0\accnone\olnone\sbasedon1\snext6 Text;} ++{\s7\fi0\li0\ri0\sb0\sa0\sl200\slmult0\cf0\f3\fs32\b0\ulnone\strike0\i0\outl0\shad0\kerning1\f4\f2\fs36\fs36\b0\b0\i0\i0\accnone\olnone\sbasedon1\snext7 Text body;} ++{\s8\fi0\li0\ri0\sb0\sa0\sl200\slmult0\ql\cf0\f3\fs36\b0\ulnone\strike0\i0\outl0\shad0\kerning1\f4\f2\fs36\fs36\b0\b0\i0\i0\accnone\olnone\sbasedon1\snext8 Text body justified;}} ++{\*\EditEnginePoolDefaults\ltrpar\fi0\li0\ri0\fi0\li0\ri0\sb0\sa0\sl0\slmult0\ql\cf0\f0\fs48\b0\ulnone\strike0\i0\outl0\shad0\kerning0\expndtw0\f1\f2\fs48\fs48\b0\b0\i0\i0\accnone\olnone} ++\deftab709 ++{ ++\s27\fi0\li0\ri0\qc\cf0\f3\fs64\b0\ulnone\strike0\i0\outl0\shad0\kerning1\f4\f2\fs64\fs64\b0\b0\i0\i0\accnone\olnone {\f3\fs64\b0\i0 sss}\par\pard\plain ++}} +diff --git a/sw/qa/extras/rtfimport/rtfimport.cxx b/sw/qa/extras/rtfimport/rtfimport.cxx +index 8508909..e79d282 100644 +--- a/sw/qa/extras/rtfimport/rtfimport.cxx ++++ b/sw/qa/extras/rtfimport/rtfimport.cxx +@@ -159,6 +159,7 @@ public: + void testFdo44715(); + void testFdo68076(); + void testFdo68291(); ++ void testFdo69384(); + + CPPUNIT_TEST_SUITE(Test); + #if !defined(MACOSX) && !defined(WNT) +@@ -302,6 +303,7 @@ void Test::run() + {"fdo44715.rtf", &Test::testFdo44715}, + {"fdo68076.rtf", &Test::testFdo68076}, + {"fdo68291.odt", &Test::testFdo68291}, ++ {"hello.rtf", &Test::testFdo69384}, + }; + header(); + for (unsigned int i = 0; i < SAL_N_ELEMENTS(aMethods); ++i) +@@ -1464,6 +1466,18 @@ void Test::testFdo68291() + CPPUNIT_ASSERT_EQUAL(OUString(), getProperty(getParagraph(1), "PageDescName")); + } + ++void Test::testFdo69384() ++{ ++ uno::Reference xTextDocument(mxComponent, uno::UNO_QUERY); ++ uno::Reference xText(xTextDocument->getText(), uno::UNO_QUERY); ++ uno::Reference xEnd = xText->getEnd(); ++ paste("fdo69384-paste.rtf", xEnd); ++ ++ // Import got interrupted in the middle of style sheet table import, ++ // resuling in missing styles and text. ++ getStyles("ParagraphStyles")->getByName("Text body justified"); ++} ++ + CPPUNIT_TEST_SUITE_REGISTRATION(Test); + + CPPUNIT_PLUGIN_IMPLEMENT(); +diff --git a/writerfilter/source/dmapper/StyleSheetTable.cxx b/writerfilter/source/dmapper/StyleSheetTable.cxx +index 8352b1b..61ff0ba 100644 +--- a/writerfilter/source/dmapper/StyleSheetTable.cxx ++++ b/writerfilter/source/dmapper/StyleSheetTable.cxx +@@ -724,9 +724,16 @@ void StyleSheetTable::ApplyStyleSheets( FontTablePtr rFontTable ) + uno::Reference< container::XNameContainer > xStyles = bParaStyle ? xParaStyles : xCharStyles; + uno::Reference< style::XStyle > xStyle; + OUString sConvertedStyleName = ConvertStyleName( pEntry->sStyleName ); +- // When pasting, don't update existing styles. +- if(xStyles->hasByName( sConvertedStyleName ) && m_pImpl->m_bIsNewDoc) ++ if(xStyles->hasByName( sConvertedStyleName )) ++ { ++ // When pasting, don't update existing styles. ++ if (!m_pImpl->m_bIsNewDoc) ++ { ++ ++aIt; ++ continue; ++ } + xStyles->getByName( sConvertedStyleName ) >>= xStyle; ++ } + else + { + bInsert = true; +-- +1.8.3.1 + diff --git a/0001-rhbz-1001768-AtkListener-disposing-delay-notificatio.patch b/0001-rhbz-1001768-AtkListener-disposing-delay-notificatio.patch new file mode 100644 index 0000000..cf9d90e --- /dev/null +++ b/0001-rhbz-1001768-AtkListener-disposing-delay-notificatio.patch @@ -0,0 +1,173 @@ +From c7ca663e1a839781589dfd6a49d8540dde2b12cc Mon Sep 17 00:00:00 2001 +From: Michael Meeks +Date: Wed, 2 Oct 2013 23:03:38 +0200 +Subject: [PATCH] rhbz#1001768: AtkListener::disposing(): delay notification + +Frame #10 in libatk-bridge.so calls atk_misc_threads_enter(), +and having a look at the RHEL 6.5 at-spi package in +./at-spi-1.28.1/atk-bridge/bridge.c there is always the same call +pattern: + + bridge_threads_leave (); + [one function call] + bridge_threads_enter (); + +... so the bridge_threads_leave() has called the VCL gtk-plug function +GtkHookedYieldMutex::ThreadsLeave() which releases the SolarMutex. + +This is of course not a good idea while there is a Window being deleted, +and is the reason why the same Window is being deleted in thread 1 and +thread 2: + +31 0x00000fff94a5fc00 in Window::~Window (this=0xfff702b2d30, +__in_chrg=) at +/usr/src/debug/libreoffice-4.0.4.2/vcl/source/window/window.cxx:4272 + +16 0x00000fff94a5fc00 in Window::~Window (this=0xfff702b2d30, +__in_chrg=) at +/usr/src/debug/libreoffice-4.0.4.2/vcl/source/window/window.cxx:4272 + +Try to avoid the problem by delaying the +atk_object_notify_state_change() that will release SolarMutex until idle, +when deletion of the Window is finished. + +Thread 2 (Thread 0xfff4cbcf110 (LWP 17011)): +2 0x0000008013c6e718 in .pthread_mutex_lock () from /lib64/libc.so.6 +3 0x000000801576e4fc in osl_acquireMutex (Mutex=) at /usr/src/debug/libreoffice-4.0.4.2/sal/osl/unx/mutex.c:114 +4 0x00000fff963a7908 in acquire (this=) at /usr/src/debug/libreoffice-4.0.4.2/solver/unxlngppc64.pro/inc/osl/mutex.hxx:58 +5 ClearableGuard (this=) at /usr/src/debug/libreoffice-4.0.4.2/solver/unxlngppc64.pro/inc/osl/mutex.hxx:177 +6 cppu::WeakAggComponentImplHelperBase::dispose (this=) at /usr/src/debug/libreoffice-4.0.4.2/cppuhelper/source/implbase.cxx:392 +7 0x00000fff5f1b3444 in comphelper::disposeComponent (_rxComp=) at /usr/src/debug/libreoffice-4.0.4.2/solver/unxlngppc64.pro/inc/comphelper/types.hxx:114 +8 0x00000fff5f273ba8 in VCLXAccessibleToolBox::implReleaseToolboxItem (this=, _rMapPos=, _bNotifyRemoval=, _bDispose=) at /usr/src/debug/libreoffice-4.0.4.2/accessibility/source/standard/vclxaccessibletoolbox.cxx:326 +9 0x00000fff5f2747e4 in VCLXAccessibleToolBox::ProcessWindowEvent (this=0xfff5f8b8fe0, rVclWindowEvent=...) at /usr/src/debug/libreoffice-4.0.4.2/accessibility/source/standard/vclxaccessibletoolbox.cxx:612 +10 0x00000fff951e4ad4 in VCLXAccessibleComponent::WindowEventListener (this=0xfff5f8b8fe0, pEvent=0xfff4cbcc950) at /usr/src/debug/libreoffice-4.0.4.2/toolkit/source/awt/vclxaccessiblecomponent.cxx:136 +11 0x00000fff951e4b20 in VCLXAccessibleComponent::LinkStubWindowEventListener (pThis=, pCaller=) at /usr/src/debug/libreoffice-4.0.4.2/toolkit/source/awt/vclxaccessiblecomponent.cxx:121 +12 0x00000fff946dd420 in Call (this=0xfff702b32a0, pEvent=0xfff4cbcc950) at /usr/src/debug/libreoffice-4.0.4.2/solver/unxlngppc64.pro/inc/tools/link.hxx:123 +13 VclEventListeners::Call (this=0xfff702b32a0, pEvent=0xfff4cbcc950) at /usr/src/debug/libreoffice-4.0.4.2/vcl/source/app/vclevent.cxx:66 +14 0x00000fff94a4bab0 in Window::CallEventListeners (this=0xfff702b2d30, nEvent=, pData=) at /usr/src/debug/libreoffice-4.0.4.2/vcl/source/window/window.cxx:5272 +15 0x00000fff94a4bc80 in Window::ImplCallEventListeners (this=, nEvent=, pData=) at /usr/src/debug/libreoffice-4.0.4.2/vcl/source/window/window.cxx:5255 +16 0x00000fff94a5fc00 in Window::~Window (this=0xfff702b2d30, __in_chrg=) at /usr/src/debug/libreoffice-4.0.4.2/vcl/source/window/window.cxx:4272 +17 0x00000fff94a61138 in Window::~Window (this=, __in_chrg=) at /usr/src/debug/libreoffice-4.0.4.2/vcl/source/window/window.cxx:4683 +18 0x00000fff951efcf0 in VCLXDevice::DestroyOutputDevice (this=0xfff6801f010) at /usr/src/debug/libreoffice-4.0.4.2/toolkit/source/awt/vclxdevice.cxx:56 +19 0x00000fff952347a8 in VCLXWindow::dispose (this=0xfff6801f010) at /usr/src/debug/libreoffice-4.0.4.2/toolkit/source/awt/vclxwindow.cxx:957 +20 0x00000fff953c5f28 in UnoWrapper::WindowDestroyed (this=, pWindow=0xfff70115a80) at /usr/src/debug/libreoffice-4.0.4.2/toolkit/source/helper/unowrapper.cxx:263 +21 0x00000fff94a60130 in Window::~Window (this=0xfff70115a80, __in_chrg=) at /usr/src/debug/libreoffice-4.0.4.2/vcl/source/window/window.cxx:4334 +22 0x00000fff949cc8b4 in DockingAreaWindow::~DockingAreaWindow (this=0xfff70115a80, __in_chrg=) at /usr/src/debug/libreoffice-4.0.4.2/vcl/source/window/dockingarea.cxx:96 +23 0x00000fff949cc918 in DockingAreaWindow::~DockingAreaWindow (this=, __in_chrg=) at /usr/src/debug/libreoffice-4.0.4.2/vcl/source/window/dockingarea.cxx:96 +24 0x00000fff951efcf0 in VCLXDevice::DestroyOutputDevice (this=0xfff6801c310) at /usr/src/debug/libreoffice-4.0.4.2/toolkit/source/awt/vclxdevice.cxx:56 +25 0x00000fff952347a8 in VCLXWindow::dispose (this=0xfff6801c310) at /usr/src/debug/libreoffice-4.0.4.2/toolkit/source/awt/vclxwindow.cxx:957 +26 0x00000fff953c5f28 in UnoWrapper::WindowDestroyed (this=, pWindow=0xfff7001a320) at /usr/src/debug/libreoffice-4.0.4.2/toolkit/source/helper/unowrapper.cxx:263 +27 0x00000fff94a60130 in Window::~Window (this=0xfff7001a320, __in_chrg=) at /usr/src/debug/libreoffice-4.0.4.2/vcl/source/window/window.cxx:4334 +28 0x00000fff94a1f7fc in SystemWindow::~SystemWindow (this=0xfff7001a320, __in_chrg=) at /usr/src/debug/libreoffice-4.0.4.2/vcl/source/window/syswin.cxx:89 +29 0x00000fff94a6c744 in WorkWindow::~WorkWindow (this=, __in_chrg=) at /usr/src/debug/libreoffice-4.0.4.2/vcl/source/window/wrkwin.cxx:150 +30 0x00000fff94a6c7e8 in WorkWindow::~WorkWindow (this=, __in_chrg=) at /usr/src/debug/libreoffice-4.0.4.2/vcl/source/window/wrkwin.cxx:150 +31 0x00000fff951efcf0 in VCLXDevice::DestroyOutputDevice (this=0xfff8c486f48) at /usr/src/debug/libreoffice-4.0.4.2/toolkit/source/awt/vclxdevice.cxx:56 +32 0x00000fff952347a8 in VCLXWindow::dispose (this=0xfff8c486f48) at /usr/src/debug/libreoffice-4.0.4.2/toolkit/source/awt/vclxwindow.cxx:957 +33 0x00000fff88258ec0 in framework::Frame::impl_disposeContainerWindow (this=, xWindow=...) at /usr/src/debug/libreoffice-4.0.4.2/framework/source/services/frame.cxx:2689 +34 0x00000fff8826d71c in framework::Frame::dispose (this=0xfff8c308a08) at /usr/src/debug/libreoffice-4.0.4.2/framework/source/services/frame.cxx:1887 +35 0x00000fff88263018 in framework::Frame::close (this=0xfff8c308a08, bDeliverOwnerShip=) at /usr/src/debug/libreoffice-4.0.4.2/framework/source/services/frame.cxx:1650 +36 0x00000fff88255908 in framework::Desktop::impl_closeFrames (this=, bAllowUI=) at /usr/src/debug/libreoffice-4.0.4.2/framework/source/services/desktop.cxx:1928 +37 0x00000fff88256120 in framework::Desktop::terminate (this=0xfff8b3de388) at /usr/src/debug/libreoffice-4.0.4.2/framework/source/services/desktop.cxx:292 + +Thread 1 (Thread 0xfff930e82a0 (LWP 16956)): +2 0x0000008013c6e718 in .pthread_mutex_lock () from /lib64/libc.so.6 +3 0x000000801576e4fc in osl_acquireMutex (Mutex=) at /usr/src/debug/libreoffice-4.0.4.2/sal/osl/unx/mutex.c:114 +4 0x00000fff946cd114 in vcl::SolarMutexObject::acquire (this=) at /usr/src/debug/libreoffice-4.0.4.2/vcl/source/app/solarmutex.cxx:35 +5 0x00000fff94a6ecb8 in SalYieldMutex::acquire (this=) at /usr/src/debug/libreoffice-4.0.4.2/vcl/generic/app/geninst.cxx:49 +6 0x00000fff8c24cb90 in GtkHookedYieldMutex::acquire (this=) at /usr/src/debug/libreoffice-4.0.4.2/vcl/unx/gtk/app/gtkinst.cxx:91 +7 0x00000fff8c24cd2c in GtkHookedYieldMutex::ThreadsEnter (this=) at /usr/src/debug/libreoffice-4.0.4.2/vcl/unx/gtk/app/gtkinst.cxx:64 +8 0x00000fff8b6dfabc in ?? () from /usr/lib64/gtk-2.0/modules/libgail.so +9 0x00000fff8b9f333c in .atk_misc_threads_enter () from /usr/lib64/libatk-1.0.so.0 +10 0x00000fff8c1d534c in ?? () from /usr/lib64/gtk-2.0/modules/libatk-bridge.so +11 0x00000fff8c1d65fc in ?? () from /usr/lib64/gtk-2.0/modules/libatk-bridge.so +12 0x00000fff936af4e0 in ?? () from /lib64/libgobject-2.0.so.0 +13 0x00000fff936b13d0 in .g_signal_emit_valist () from /lib64/libgobject-2.0.so.0 +14 0x00000fff936b18f8 in .g_signal_emit () from /lib64/libgobject-2.0.so.0 +15 0x00000fff8b9e5f3c in .atk_object_notify_state_change () from /usr/lib64/libatk-1.0.so.0 +16 0x00000fff8c23083c in AtkListener::disposing (this=0xfff5f98dbc8) at /usr/src/debug/libreoffice-4.0.4.2/vcl/unx/gtk/a11y/atklistener.cxx:81 +17 0x00000fff963aee2c in cppu::OInterfaceContainerHelper::disposeAndClear (this=, rEvt=...) at /usr/src/debug/libreoffice-4.0.4.2/cppuhelper/source/interfacecontainer.cxx:316 +18 0x00000fff9659d944 in comphelper::AccessibleEventNotifier::revokeClientNotifyDisposing (_nClient=, _rxEventSource=...) at /usr/src/debug/libreoffice-4.0.4.2/comphelper/source/misc/accessibleeventnotifier.cxx:162 +19 0x00000fff9659b20c in comphelper::OAccessibleContextHelper::disposing (this=0xfff5f8bb7e0) at /usr/src/debug/libreoffice-4.0.4.2/comphelper/source/misc/accessiblecontexthelper.cxx:130 +20 0x00000fff5f275898 in VCLXAccessibleToolBoxItem::disposing (this=) at /usr/src/debug/libreoffice-4.0.4.2/accessibility/source/standard/vclxaccessibletoolboxitem.cxx:265 +21 0x00000fff963a79fc in cppu::WeakAggComponentImplHelperBase::dispose (this=0xfff5f8bb7e0) at /usr/src/debug/libreoffice-4.0.4.2/cppuhelper/source/implbase.cxx:404 +22 0x00000fff5f1b3444 in comphelper::disposeComponent (_rxComp=) at /usr/src/debug/libreoffice-4.0.4.2/solver/unxlngppc64.pro/inc/comphelper/types.hxx:114 +23 0x00000fff5f273ba8 in VCLXAccessibleToolBox::implReleaseToolboxItem (this=, _rMapPos=, _bNotifyRemoval=, _bDispose=) at /usr/src/debug/libreoffice-4.0.4.2/accessibility/source/standard/vclxaccessibletoolbox.cxx:326 +24 0x00000fff5f2747e4 in VCLXAccessibleToolBox::ProcessWindowEvent (this=0xfff5f8b8fe0, rVclWindowEvent=...) at /usr/src/debug/libreoffice-4.0.4.2/accessibility/source/standard/vclxaccessibletoolbox.cxx:612 +25 0x00000fff951e4ad4 in VCLXAccessibleComponent::WindowEventListener (this=0xfff5f8b8fe0, pEvent=0xfffdc31f990) at /usr/src/debug/libreoffice-4.0.4.2/toolkit/source/awt/vclxaccessiblecomponent.cxx:136 +26 0x00000fff951e4b20 in VCLXAccessibleComponent::LinkStubWindowEventListener (pThis=, pCaller=) at /usr/src/debug/libreoffice-4.0.4.2/toolkit/source/awt/vclxaccessiblecomponent.cxx:121 +27 0x00000fff946dd420 in Call (this=0xfff702b32a0, pEvent=0xfffdc31f990) at /usr/src/debug/libreoffice-4.0.4.2/solver/unxlngppc64.pro/inc/tools/link.hxx:123 +28 VclEventListeners::Call (this=0xfff702b32a0, pEvent=0xfffdc31f990) at /usr/src/debug/libreoffice-4.0.4.2/vcl/source/app/vclevent.cxx:66 +29 0x00000fff94a4bab0 in Window::CallEventListeners (this=0xfff702b2d30, nEvent=, pData=) at /usr/src/debug/libreoffice-4.0.4.2/vcl/source/window/window.cxx:5272 +30 0x00000fff94a4bc80 in Window::ImplCallEventListeners (this=, nEvent=, pData=) at /usr/src/debug/libreoffice-4.0.4.2/vcl/source/window/window.cxx:5255 +31 0x00000fff94a5fc00 in Window::~Window (this=0xfff702b2d30, __in_chrg=) at /usr/src/debug/libreoffice-4.0.4.2/vcl/source/window/window.cxx:4272 +32 0x00000fff949d41c4 in DockingWindow::~DockingWindow (this=0xfff702b2d30, __in_chrg=) at /usr/src/debug/libreoffice-4.0.4.2/vcl/source/window/dockwin.cxx:473 +33 0x00000fff94a35944 in ToolBox::~ToolBox (this=0xfff702b2d30, __in_chrg=) at /usr/src/debug/libreoffice-4.0.4.2/vcl/source/window/toolbox.cxx:1698 +34 0x00000fff88343e40 in framework::ToolBar::~ToolBar (this=, __in_chrg=) at /usr/src/debug/libreoffice-4.0.4.2/framework/source/uielement/toolbar.cxx:35 +35 0x00000fff88343e88 in framework::ToolBar::~ToolBar (this=0xfff702b2d30, __in_chrg=) at /usr/src/debug/libreoffice-4.0.4.2/framework/source/uielement/toolbar.cxx:35 +36 0x00000fff94a66a00 in ~LazyDeletor (this=0xfff40007720, __in_chrg=) at /usr/src/debug/libreoffice-4.0.4.2/solver/unxlngppc64.pro/inc/vcl/lazydelete.hxx:162 +37 vcl::LazyDeletor::~LazyDeletor (this=0xfff40007720, __in_chrg=) at /usr/src/debug/libreoffice-4.0.4.2/solver/unxlngppc64.pro/inc/vcl/lazydelete.hxx:164 +38 0x00000fff94998868 in vcl::LazyDelete::flush () at /usr/src/debug/libreoffice-4.0.4.2/vcl/source/helper/lazydelete.cxx:54 +39 0x00000fff946d2294 in ImplYield (i_bAllEvents=) at /usr/src/debug/libreoffice-4.0.4.2/vcl/source/app/svapp.cxx:434 +40 Application::Yield (i_bAllEvents=) at /usr/src/debug/libreoffice-4.0.4.2/vcl/source/app/svapp.cxx:463 +41 0x00000fff946d22f8 in Application::Execute () at /usr/src/debug/libreoffice-4.0.4.2/vcl/source/app/svapp.cxx:408 + +Change-Id: Ic742442dd6ffeba59655c2e66df8dbabc906f061 +(cherry picked from commit c3ef735fd5d8866c8ce28b89744150e733087427) +Signed-off-by: Michael Stahl +--- + vcl/unx/gtk/a11y/atklistener.cxx | 25 ++++++++++++++++++++----- + 1 file changed, 20 insertions(+), 5 deletions(-) + +diff --git a/vcl/unx/gtk/a11y/atklistener.cxx b/vcl/unx/gtk/a11y/atklistener.cxx +index f4d02ce..2ff3f0c 100644 +--- a/vcl/unx/gtk/a11y/atklistener.cxx ++++ b/vcl/unx/gtk/a11y/atklistener.cxx +@@ -33,6 +33,7 @@ + + #include "atklistener.hxx" + #include "atkwrapper.hxx" ++#include "vcl/svapp.hxx" + + #include + #include +@@ -66,6 +67,23 @@ AtkStateType mapState( const uno::Any &rAny ) + + /*****************************************************************************/ + ++extern "C" { ++ // rhbz#1001768 - down to horrific problems releasing the solar mutex ++ // while destroying a Window - which occurs inside these notifications. ++ static gint ++ idle_defunc_state_change( AtkObject *atk_obj ) ++ { ++ SolarMutexGuard aGuard; ++ ++ // This is an equivalent to a state change to DEFUNC(T). ++ atk_object_notify_state_change( atk_obj, ATK_STATE_DEFUNCT, TRUE ); ++ if( atk_get_focus_object() == atk_obj ) ++ atk_focus_tracker_notify( NULL ); ++ g_object_unref( G_OBJECT( atk_obj ) ); ++ return FALSE; ++ } ++} ++ + // XEventListener implementation + void AtkListener::disposing( const lang::EventObject& ) throw (uno::RuntimeException) + { +@@ -77,11 +95,8 @@ void AtkListener::disposing( const lang::EventObject& ) throw (uno::RuntimeExcep + // global mutex + atk_object_wrapper_dispose( mpWrapper ); + +- // This is an equivalent to a state change to DEFUNC(T). +- atk_object_notify_state_change( atk_obj, ATK_STATE_DEFUNCT, TRUE ); +- +- if( atk_get_focus_object() == atk_obj ) +- atk_focus_tracker_notify( NULL ); ++ g_idle_add( (GSourceFunc) idle_defunc_state_change, ++ g_object_ref( G_OBJECT( atk_obj ) ) ); + + // Release the wrapper object so that it can vanish .. + g_object_unref( mpWrapper ); +-- +1.8.3.1 + diff --git a/0001-rhbz-1001768-avoid-deadlock-in-OAccessibleContextHel.patch b/0001-rhbz-1001768-avoid-deadlock-in-OAccessibleContextHel.patch new file mode 100644 index 0000000..d0b824e --- /dev/null +++ b/0001-rhbz-1001768-avoid-deadlock-in-OAccessibleContextHel.patch @@ -0,0 +1,37 @@ +From facd4bb410ce6b5f6d74f836affc7553babb05cf Mon Sep 17 00:00:00 2001 +From: Michael Stahl +Date: Wed, 2 Oct 2013 23:00:09 +0200 +Subject: [PATCH] rhbz#1001768: avoid deadlock in + OAccessibleContextHelper::disposing() + +De facto this class is locked by SolarMutex, which is what the +OExternalLockGuard actually locks; +do not lock m_Mutex because it may cause deadlock. + +Change-Id: I88b226d73dbef9a5803347b0ac3191bec2ba4515 +(cherry picked from commit 4100e3b6204fc304cc7b60b9d7ff2af75118b805) +Reviewed-on: https://gerrit.libreoffice.org/6114 +Tested-by: Michael Meeks +Reviewed-by: Michael Meeks +--- + comphelper/source/misc/accessiblecontexthelper.cxx | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/comphelper/source/misc/accessiblecontexthelper.cxx b/comphelper/source/misc/accessiblecontexthelper.cxx +index b3169fd..bb9047d 100644 +--- a/comphelper/source/misc/accessiblecontexthelper.cxx ++++ b/comphelper/source/misc/accessiblecontexthelper.cxx +@@ -123,7 +123,9 @@ namespace comphelper + //--------------------------------------------------------------------- + void SAL_CALL OAccessibleContextHelper::disposing() + { +- ::osl::ClearableMutexGuard aGuard( GetMutex() ); ++ // rhbz#1001768: de facto this class is locked by SolarMutex; ++ // do not lock m_Mutex because it may cause deadlock ++ OMutexGuard aGuard( getExternalLock() ); + + if ( m_pImpl->getClientId( ) ) + { +-- +1.8.3.1 + diff --git a/libreoffice.spec b/libreoffice.spec index 6e01106..164ad98 100644 --- a/libreoffice.spec +++ b/libreoffice.spec @@ -43,7 +43,7 @@ Summary: Free Software Productivity Suite Name: libreoffice Epoch: 1 Version: %{libo_version}.3 -Release: 3%{?libo_prerelease}%{?dist} +Release: 4%{?libo_prerelease}%{?dist} License: (MPLv1.1 or LGPLv3+) and LGPLv3 and LGPLv2+ and BSD and (MPLv1.1 or GPLv2 or LGPLv2 or Netscape) and Public Domain and ASL 2.0 and Artistic and MPLv2.0 Group: Applications/Productivity URL: http://www.libreoffice.org/default/ @@ -263,6 +263,9 @@ Patch22: 0001-rhbz-1014010-Missing-dependencies-in-isBootstrapType.patch Patch23: 0001-Resolves-rhbz-1013844-fdo-47482-encrypted-OOo-1.0-do.patch Patch24: 0001-Resolves-rhbz-1015281-crash-on-clicking-custom-anima.patch Patch25: 0001-Resolves-rhbz-996162-apparent-NULL-bullet-font.patch +Patch26: 0001-rhbz-1001768-avoid-deadlock-in-OAccessibleContextHel.patch +Patch27: 0001-rhbz-1001768-AtkListener-disposing-delay-notificatio.patch +Patch28: 0001-fdo-69384-fix-impress-writer-copy-paste.patch %define instdir %{_libdir} %define baseinstdir %{instdir}/libreoffice @@ -1020,6 +1023,9 @@ mv -f redhat.soc extras/source/palettes/standard.soc %patch23 -p1 -b .rhbz-1013844-fdo-47482-encrypted-OOo-1.0-do.patch %patch24 -p1 -b .rhbz-1015281-crash-on-clicking-custom-anima.patch %patch25 -p1 -b .rhbz-996162-apparent-NULL-bullet-font.patch +%patch26 -p1 -b .rhbz-1001768-avoid-deadlock-in-OAccessibleContextHel.patch +%patch27 -p1 -b .rhbz-1001768-AtkListener-disposing-delay-notificatio.patch +%patch28 -p1 -b .fdo-69384-fix-impress-writer-copy-paste.patch # TODO: check this # these are horribly incomplete--empty translations and copied english @@ -2110,6 +2116,10 @@ update-desktop-database %{_datadir}/applications &> /dev/null || : %endif %changelog +* Mon Oct 07 2013 Caolán McNamara - 1:4.1.2.3-4.UNBUILT +- Resolves: rhbz#1001768: fix various a11y deadlocks and crashes +- Resolves: rhbz#1016022 fix cut from impress and paste to writer + * Mon Oct 07 2013 Caolán McNamara - 1:4.1.2.3-3 - Resolves: rhbz#1015281 crash on clicking custom animation - Resolves: rhbz#996162 crash with no bullet font