Bug 799628

Summary: [abrt] libreoffice-core-3.4.5.2-5.fc16: SwViewImp::PaintLayer: Process /usr/lib64/libreoffice/program/soffice.bin was killed by signal 11 (SIGSEGV)
Product: [Fedora] Fedora Reporter: Cheng-Chia Tseng <pswo10680>
Component: libreofficeAssignee: Caolan McNamara <caolanm>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 16CC: caolanm, dtardon, erack, ltinkl, mstahl, sbergman
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
Whiteboard: abrt_hash:2b285d52ea94dcc10a072500d263eef4e0b6c5b8
Fixed In Version: libreoffice-3.4.5.2-8.fc16 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-03-10 00:20:55 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: maps
none
File: dso_list
none
File: smolt_data
none
File: backtrace none

Description Cheng-Chia Tseng 2012-03-03 16:58:24 UTC 
libreport version: 2.0.8
abrt_version:   2.0.7
backtrace_rating: 4
cmdline:        /usr/lib64/libreoffice/program/soffice.bin --writer --splash-pipe=7
crash_function: SwViewImp::PaintLayer
executable:     /usr/lib64/libreoffice/program/soffice.bin
kernel:         3.2.7-1.fc16.x86_64
pid:            2469
pwd:            /home/realplus
reason:         Process /usr/lib64/libreoffice/program/soffice.bin was killed by signal 11 (SIGSEGV)
time:           西元2012年03月03日 (週六) 22時49分36秒
uid:            1000
username:       realplus
xsession_errors: 

backtrace:      Text file, 55881 bytes
dso_list:       Text file, 19994 bytes
maps:           Text file, 79246 bytes
smolt_data:     Binary file, 2916 bytes

environ:
:XDG_VTNR=1
:XDG_SESSION_ID=2
:HOSTNAME=HiHeHo-S205
:IMSETTINGS_INTEGRATE_DESKTOP=yes
:GIO_LAUNCHED_DESKTOP_FILE_PID=2458
:GPG_AGENT_INFO=/tmp/keyring-nCFoPC/gpg:0:1
:SHELL=/bin/bash
:TERM=dumb
:DESKTOP_STARTUP_ID=gnome-shell-1478-HiHeHo-S205-libreoffice-2_TIME938020
:HISTSIZE=1000
:XDG_SESSION_COOKIE=f01d1509c87b498c5f6afb8200000011-1330785281.685158-1562711213
:GJS_DEBUG_OUTPUT=stderr
:OLDPWD=/usr/lib64/libreoffice/program
:GNOME_KEYRING_CONTROL=/tmp/keyring-nCFoPC
:'GJS_DEBUG_TOPICS=JS ERROR;JS LOG'
:IMSETTINGS_MODULE=IBus
:USER=realplus
:SSH_AUTH_SOCK=/tmp/keyring-nCFoPC/ssh
:USERNAME=realplus
:SESSION_MANAGER=local/unix:@/tmp/.ICE-unix/1270,unix/unix:/tmp/.ICE-unix/1270
:GIO_LAUNCHED_DESKTOP_FILE=/usr/share/applications/libreoffice-writer.desktop
:MAIL=/var/spool/mail/realplus
:PATH=/usr/lib64/ccache:/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/realplus/.local/bin:/home/realplus/bin
:DESKTOP_SESSION=gnome
:QT_IM_MODULE=xim
:PWD=/home/realplus
:XMODIFIERS=@im=ibus
:KDE_IS_PRELINKED=1
:GNOME_KEYRING_PID=1266
:LANG=zh_TW.utf8
:GDM_LANG=zh_TW.utf8
:KDEDIRS=/usr
:GDMSESSION=gnome
:HISTCONTROL=ignoredups
:HOME=/home/realplus
:XDG_SEAT=seat0
:SHLVL=1
:GNOME_DESKTOP_SESSION_ID=this-is-deprecated
:SAL_ENABLE_FILE_LOCKING=1
:LOGNAME=realplus
:CVS_RSH=ssh
:DBUS_SESSION_BUS_ADDRESS=unix:abstract=/tmp/dbus-byxwqDMbCA,guid=44acabacb82f64ac946f2ed100000044
:'LESSOPEN=||/usr/bin/lesspipe.sh %s'
:WINDOWPATH=1
:XDG_RUNTIME_DIR=/run/user/realplus
:DISPLAY=:0
:CCACHE_HASHDIR=
:XAUTHORITY=/var/run/gdm/auth-for-realplus-WEJbpk/database
:LD_LIBRARY_PATH=/usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/amd64/client:/usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/amd64/server:/usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/amd64/native_threads:/usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/amd64

var_log_messages:
:Feb 28 22:12:23 HiHeHo-S205 kernel: [24034.753725] soffice.bin[4998]: segfault at 0 ip 0000003625c3b311 sp 00007fffc7a101d0 error 6 in libuno_sal.so.3[3625c00000+57000]
:Feb 28 22:12:27 HiHeHo-S205 abrt[9456]: Saved core dump of pid 4998 (/usr/lib64/libreoffice/program/soffice.bin) to /var/spool/abrt/ccpp-2012-02-28-22:12:24-4998 (162369536 bytes)
:Feb 28 22:35:22 HiHeHo-S205 kernel: [25412.904196] soffice.bin[9502] general protection ip:3625c3b160 sp:7fffa677fa20 error:0 in libuno_sal.so.3[3625c00000+57000]
:Feb 28 22:35:24 HiHeHo-S205 abrt[11526]: Saved core dump of pid 9502 (/usr/lib64/libreoffice/program/soffice.bin) to /var/spool/abrt/ccpp-2012-02-28-22:35:22-9502 (130383872 bytes)
:Feb 28 23:22:15 HiHeHo-S205 kernel: [28225.956775] soffice.bin[11587]: segfault at a20 ip 00000030f509bd53 sp 00007fff7beb0d80 error 4 in libX11.so.6.3.0[30f5000000+139000]
:Feb 28 23:22:17 HiHeHo-S205 abrt[14599]: Saved core dump of pid 11587 (/usr/lib64/libreoffice/program/soffice.bin) to /var/spool/abrt/ccpp-2012-02-28-23:22:15-11587 (120573952 bytes)
:Mar  2 01:37:35 HiHeHo-S205 kernel: [ 5635.377290] soffice.bin[7328] general protection ip:3625c3b160 sp:7fff4abdc7d0 error:0 in libuno_sal.so.3[3625c00000+57000]
:Mar  2 01:37:37 HiHeHo-S205 abrt[9803]: Saved core dump of pid 7328 (/usr/lib64/libreoffice/program/soffice.bin) to /var/spool/abrt/ccpp-2012-03-02-01:37:35-7328 (106672128 bytes)
:Mar  3 22:49:36 HiHeHo-S205 kernel: [  963.258543] soffice.bin[2469] general protection ip:7fa238e9c3fc sp:7fff4e933990 error:0 in libswlx.so[7fa238748000+bd7000]
:Mar  3 22:49:37 HiHeHo-S205 abrt[2563]: Saved core dump of pid 2469 (/usr/lib64/libreoffice/program/soffice.bin) to /var/spool/abrt/ccpp-2012-03-03-22:49:36-2469 (95752192 bytes)
Comment 1 Cheng-Chia Tseng 2012-03-03 16:58:29 UTC 
Created attachment 567300 [details]
File: maps
Comment 2 Cheng-Chia Tseng 2012-03-03 16:58:31 UTC 
Created attachment 567301 [details]
File: dso_list
Comment 3 Cheng-Chia Tseng 2012-03-03 16:58:33 UTC 
Created attachment 567302 [details]
File: smolt_data
Comment 4 Cheng-Chia Tseng 2012-03-03 16:58:35 UTC 
Created attachment 567303 [details]
File: backtrace
Comment 5 Cheng-Chia Tseng 2012-03-03 17:13:15 UTC 
I used ibus-chewing to input a few characters, then LibreOffice crashed.

After a few tests, I found a way to let LibreOffice crashed easily with ibus-chewing.

1. Launch LibreOffice
2. Switch to ibus-chewing input method via Alt + Shift.
3. Type g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3 (16 times at least), then press Enter twice
4. Try to keep typing g4g4g4g4g4g4g4g4 until LibreOffice crash. If you have entered more than 16 times and LibreOffice has not yet crashed, go back to Step 3 and do it again. LibreOffice will crash eventually.
Comment 6 Caolan McNamara 2012-03-05 16:42:25 UTC 
reproducible
Comment 7 Caolan McNamara 2012-03-05 21:03:20 UTC 
well, I can reproduce a crash in the gtk input engine integration, though the original backtrace suggests a crash in writer layout
Comment 8 Caolan McNamara 2012-03-06 12:02:18 UTC 
can reproduce the other crash too, seems to be part of the same problem alright. Should be good in >= 3.4.5.2-8
Comment 9 Fedora Update System 2012-03-07 10:21:46 UTC 
libreoffice-3.4.5.2-8.fc16 has been submitted as an update for Fedora 16.
https://admin.fedoraproject.org/updates/libreoffice-3.4.5.2-8.fc16
Comment 10 Fedora Update System 2012-03-08 03:54:08 UTC 
Package libreoffice-3.4.5.2-8.fc16:
* should fix your issue,
* was pushed to the Fedora 16 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing libreoffice-3.4.5.2-8.fc16'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-3267/libreoffice-3.4.5.2-8.fc16
then log in and leave karma (feedback).
Comment 11 Fedora Update System 2012-03-10 00:20:55 UTC 
libreoffice-3.4.5.2-8.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.