Bug 1215443

Summary: [abrt] libreoffice-core: operator==<const editeng::MisspellRange*, std::vector<editeng::MisspellRange> >(): soffice.bin killed by SIGSEGV
Product: [Fedora] Fedora Reporter: John Williams <web582>
Component: libreofficeAssignee: David Tardon <dtardon>
Status: CLOSED UPSTREAM QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 21CC: caolanm, dtardon, erack, greg.a.metcalfe, jan.public, ltinkl, mstahl, sbergman, web582
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
URL: https://retrace.fedoraproject.org/faf/reports/bthash/5a7a9903d83d5033cc1a5554dc6c840b8e619c88
Whiteboard: abrt_hash:65ca7da5292f8d92b8ce7f6db9540091efd2b51c
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-04-27 14:39:02 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: backtrace
none
File: cgroup
none
File: core_backtrace
none
File: dso_list
none
File: environ
none
File: exploitable
none
File: limits
none
File: maps
none
File: open_fds
none
File: proc_pid_status none

Description John Williams 2015-04-26 15:43:54 UTC 
Description of problem:
Editing a formula

Version-Release number of selected component:
libreoffice-core-4.3.6.2-9.fc21

Additional info:
reporter:       libreport-2.3.0
backtrace_rating: 4
cmdline:        /usr/lib64/libreoffice/program/soffice.bin --calc --splash-pipe=5
crash_function: operator==<const editeng::MisspellRange*, std::vector<editeng::MisspellRange> >
executable:     /usr/lib64/libreoffice/program/soffice.bin
kernel:         3.19.4-200.fc21.x86_64
runlevel:       N 5
type:           CCpp
uid:            1000
var_log_messages: [System Logs]:\n-- Logs begin at Tue 2015-01-13 13:49:19 GMT, end at Sun 2015-04-26 16:34:39 BST. --

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 operator==<const editeng::MisspellRange*, std::vector<editeng::MisspellRange> > at /usr/include/c++/4.9.2/bits/stl_iterator.h:818
 #1 empty at /usr/include/c++/4.9.2/bits/stl_vector.h:744
 #2 WrongList::empty at /usr/src/debug/libreoffice-4.3.6.2/editeng/source/editeng/edtspell.cxx:523
 #3 ImpEditEngine::Paint at /usr/src/debug/libreoffice-4.3.6.2/editeng/source/editeng/impedit3.cxx:3455
 #5 EditView::Paint at /usr/src/debug/libreoffice-4.3.6.2/editeng/source/editeng/editview.cxx:269
 #6 ScGridWindow::Draw at /usr/src/debug/libreoffice-4.3.6.2/sc/source/ui/view/gridwin4.cxx:846
 #7 ScGridWindow::Paint at /usr/src/debug/libreoffice-4.3.6.2/sc/source/ui/view/gridwin4.cxx:373
 #8 Window::ImplCallPaint at /usr/src/debug/libreoffice-4.3.6.2/vcl/source/window/window.cxx:1960
 #9 PaintHelper::~PaintHelper at /usr/src/debug/libreoffice-4.3.6.2/vcl/source/window/window.cxx:1909
 #10 Window::ImplCallPaint at /usr/src/debug/libreoffice-4.3.6.2/vcl/source/window/window.cxx:1962
Comment 1 John Williams 2015-04-26 15:43:58 UTC 
Created attachment 1019040 [details]
File: backtrace
Comment 2 John Williams 2015-04-26 15:43:59 UTC 
Created attachment 1019041 [details]
File: cgroup
Comment 3 John Williams 2015-04-26 15:44:00 UTC 
Created attachment 1019042 [details]
File: core_backtrace
Comment 4 John Williams 2015-04-26 15:44:02 UTC 
Created attachment 1019043 [details]
File: dso_list
Comment 5 John Williams 2015-04-26 15:44:03 UTC 
Created attachment 1019044 [details]
File: environ
Comment 6 John Williams 2015-04-26 15:44:05 UTC 
Created attachment 1019045 [details]
File: exploitable
Comment 7 John Williams 2015-04-26 15:44:06 UTC 
Created attachment 1019046 [details]
File: limits
Comment 8 John Williams 2015-04-26 15:44:09 UTC 
Created attachment 1019047 [details]
File: maps
Comment 9 John Williams 2015-04-26 15:44:10 UTC 
Created attachment 1019048 [details]
File: open_fds
Comment 10 John Williams 2015-04-26 15:44:12 UTC 
Created attachment 1019049 [details]
File: proc_pid_status
Comment 11 David Tardon 2015-04-27 14:35:12 UTC 
GetWrongList() can return null; other places in editeng already check that.
Comment 12 Jan Vlug 2015-05-12 20:44:29 UTC 
Another user experienced a similar problem:

entered a formula in the formula box in LibreOffice Calc.

reporter:       libreport-2.3.0
backtrace_rating: 4
cmdline:        /usr/lib64/libreoffice/program/soffice.bin --calc file:///home/jan/Documents/VVE/Noord/2014/bedragen.ods --splash-pipe=5
crash_function: operator==<const editeng::MisspellRange*, std::vector<editeng::MisspellRange> >
executable:     /usr/lib64/libreoffice/program/soffice.bin
kernel:         3.19.5-200.fc21.x86_64
package:        libreoffice-core-4.3.7.2-3.fc21
reason:         soffice.bin killed by SIGSEGV
runlevel:       N 5
type:           CCpp
uid:            1000
Comment 13 David Tardon 2015-06-04 06:39:33 UTC 
*** Bug 1227881 has been marked as a duplicate of this bug. ***
Comment 14 Greg 2015-06-16 05:10:04 UTC 
Another user experienced a similar problem:

Moved some blocks of cells, changed their border properties. Then started changing functions. Copy in a good one, change the cells needed, do the next, repeat. After half a dozen or so, boom.

reporter:       libreport-2.3.0
backtrace_rating: 4
cmdline:        /usr/lib64/libreoffice/program/soffice.bin --calc --splash-pipe=5
crash_function: operator==<const editeng::MisspellRange*, std::vector<editeng::MisspellRange> >
executable:     /usr/lib64/libreoffice/program/soffice.bin
kernel:         4.0.4-202.fc21.x86_64
package:        libreoffice-core-4.3.7.2-6.fc21
reason:         soffice.bin killed by SIGSEGV
runlevel:       N 5
type:           CCpp
uid:            1000