Bug 1160975

Summary:

[abrt] gnumeric: format_match(): gnumeric-1.12.18 killed by SIGSEGV

Product:

[Fedora] Fedora

Reporter:

Luke Hutchison <luke.hutch>

Component:

gnumeric

Assignee:

Huzaifa S. Sidhpurwala <huzaifas>

Status:

CLOSED EOL

QA Contact:

Fedora Extras Quality Assurance <extras-qa>

Severity:

unspecified

Docs Contact:

Priority:

unspecified

Version:

CC:

belegdol, huzaifas, terra

Target Milestone:

---

Target Release:

---

Hardware:

x86_64

OS:

Unspecified

URL:

https://retrace.fedoraproject.org/faf/reports/bthash/d8f30e9af95afc036507ea359b0aece4cd6fc2f1

Whiteboard:

abrt_hash:659f38023427a1e89a73e71e9b5b1fcd291e669f

Fixed In Version:

Doc Type:

Bug Fix

Doc Text:

Story Points:

---

Clone Of:

Environment:

Last Closed:

2015-06-30 01:11:56 UTC

Type:

---

Regression:

---

Mount Type:

---

Documentation:

---

CRM:

Verified Versions:

Category:

---

oVirt Team:

---

RHEL 7.3 requirements from Atomic Host:

Cloudforms Team:

---

Target Upstream Version:

Embargoed:

Attachments:

Description	Flags
File: backtrace	none
File: cgroup	none
File: core_backtrace	none
File: dso_list	none
File: environ	none
File: exploitable	none
File: limits	none
File: maps	none
File: open_fds	none
File: proc_pid_status	none
File: var_log_messages	none

Description Luke Hutchison 2014-11-06 04:23:17 UTC

Version-Release number of selected component:
gnumeric-1.12.18-1.fc20

Additional info:
reporter:       libreport-2.2.3
backtrace_rating: 4
cmdline:        gnumeric
crash_function: format_match
executable:     /usr/bin/gnumeric-1.12.18
kernel:         3.16.3-200.fc20.x86_64
runlevel:       N 5
type:           CCpp
uid:            1000

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 format_match at number-match.c:1195
 #1 text_to_cell_region at gui-clipboard.c:161
 #2 text_content_received at gui-clipboard.c:229
 #3 selection_received at gtkclipboard.c:942
 #7 g_signal_emit_by_name at gsignal.c:3426
 #8 gtk_selection_retrieval_report at gtkselection.c:2986
 #9 _gtk_selection_property_notify at gtkselection.c:2874
 #10 _gtk_marshal_BOOLEAN__BOXEDv at gtkmarshalers.c:130
 #11 _g_closure_invoke_va at gclosure.c:840
 #14 gtk_widget_event_internal at gtkwidget.c:7168

Comment 1 Luke Hutchison 2014-11-06 04:23:20 UTC

Created attachment 954302 [details]
File: backtrace

Comment 2 Luke Hutchison 2014-11-06 04:23:20 UTC

Created attachment 954303 [details]
File: cgroup

Comment 3 Luke Hutchison 2014-11-06 04:23:21 UTC

Created attachment 954304 [details]
File: core_backtrace

Comment 4 Luke Hutchison 2014-11-06 04:23:22 UTC

Created attachment 954305 [details]
File: dso_list

Comment 5 Luke Hutchison 2014-11-06 04:23:22 UTC

Created attachment 954306 [details]
File: environ

Comment 6 Luke Hutchison 2014-11-06 04:23:23 UTC

Created attachment 954307 [details]
File: exploitable

Comment 7 Luke Hutchison 2014-11-06 04:23:24 UTC

Created attachment 954308 [details]
File: limits

Comment 8 Luke Hutchison 2014-11-06 04:23:24 UTC

Created attachment 954309 [details]
File: maps

Comment 9 Luke Hutchison 2014-11-06 04:23:25 UTC

Created attachment 954310 [details]
File: open_fds

Comment 10 Luke Hutchison 2014-11-06 04:23:25 UTC

Created attachment 954311 [details]
File: proc_pid_status

Comment 11 Luke Hutchison 2014-11-06 04:23:26 UTC

Created attachment 954312 [details]
File: var_log_messages

Comment 12 Julian Sikorski 2014-11-09 09:33:57 UTC

What were you doing when the crash occurred?

Comment 13 Luke Hutchison 2014-11-09 09:53:36 UTC

I was pasting TSV data into Gnumeric (double-precision floating point numbers, 20-200 columns, I don't remember exactly, possibly with some "NaN" values too).

I have been getting the crash in bug #1131725 frequently too when I paste TSV data, maybe they are related?

Comment 14 M Welinder 2014-11-10 02:41:10 UTC

I am unsure why this happens, but the crash ought to be fixed by this
patch.

https://git.gnome.org/browse/gnumeric/commit/?id=fd1659dd9fd944fe4a28980b144407351d4cbbb0

It would be helpful if someone could run with GNM_DEBUG=clipboard and
trigger this.  That should produce some debug spew.

As for whether it is related to bug #1131725, no idea.

Comment 15 Luke Hutchison 2014-11-14 03:14:11 UTC

I don't know if this is the same crash, but running with GNM_DEBUG=clipboard and then pasting wide TSV data to cause a crash yields:

$ GNM_DEBUG=clipboard gnumeric
Clipboard target 0 is TIMESTAMP
Clipboard target 1 is TARGETS
Clipboard target 2 is MULTIPLE
Clipboard target 3 is SAVE_TARGETS
Clipboard target 4 is text/rtf
Clipboard target 5 is TEXT/RTF
Clipboard target 6 is application/rtf
Clipboard target 7 is UTF8_STRING
Clipboard target 8 is COMPOUND_TEXT
Clipboard target 9 is STRING
Received 13060260 bytes of text for target UTF8_STRING
       0 | 32 34 2e 39 33 35 30 36 34 39 33 35 30 36 34 39 | 24.9350649350649
      10 | 33 36 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | 36.0.0.0.0.0.0.0
      20 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
      30 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
      40 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
      50 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
      60 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
      70 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
      80 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
      90 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
      a0 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
      b0 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
      c0 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
      d0 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
      e0 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
      f0 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     100 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     110 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     120 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     130 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     140 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     150 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     160 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     170 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     180 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     190 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     1a0 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     1b0 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     1c0 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     1d0 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     1e0 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     1f0 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     200 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     210 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     220 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     230 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     240 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     250 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     260 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     270 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     280 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     290 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     2a0 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     2b0 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     2c0 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     2d0 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     2e0 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     2f0 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     300 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     310 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     320 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     330 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     340 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     350 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     360 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     370 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     380 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     390 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     3a0 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     3b0 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     3c0 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     3d0 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     3e0 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
     3f0 | 2e 30 09 30 2e 30 09 30 2e 30 09 30 2e 30 09 30 | .0.0.0.0.0.0.0.0
...

(gnumeric:20761): Gdk-ERROR **: The program 'gnumeric' received an X Window System error.
This probably reflects a bug in the program.
The error was 'BadAlloc (insufficient resources for operation)'.
  (Details: serial 15881 error_code 11 request_code 130 (MIT-SHM) minor_code 5)
  (Note to programmers: normally, X errors are reported asynchronously;
   that is, you will receive the error a while after causing it.
   To debug your program, run it with the GDK_SYNCHRONIZE environment
   variable to change this behavior. You can then get a meaningful
   backtrace from your debugger if you break on the gdk_x_error() function.)
Trace/breakpoint trap (core dumped)

Comment 16 M Welinder 2014-11-14 13:35:02 UTC

Re 15: probably not the same crash.

Comment 17 Julian Sikorski 2014-11-19 04:28:36 UTC

Does the scratch build from bug 1131725 fix this problem too by any chance?

Comment 18 Luke Hutchison 2014-11-19 06:07:23 UTC

Unfortunately I didn't save the clipboard contents that caused this crash, and I don't know how to duplicate this -- sorry :/

Are the line numbers in the backtrace helpful in determining what went wrong?

Comment 19 Fedora End Of Life 2015-05-29 13:13:51 UTC

This message is a reminder that Fedora 20 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 20. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as EOL if it remains open with a Fedora  'version'
of '20'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 20 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 20 Fedora End Of Life 2015-06-30 01:11:56 UTC

Fedora 20 changed to end-of-life (EOL) status on 2015-06-23. Fedora 20 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.