Bug 852128
Summary: | Writer crashed while editing a table | ||
---|---|---|---|
Product: | [Fedora] Fedora | Reporter: | Milan Bouchet-Valat <nalimilan> |
Component: | libreoffice | Assignee: | Michael Stahl <mstahl> |
Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
Severity: | unspecified | Docs Contact: | |
Priority: | unspecified | ||
Version: | 17 | CC: | caolanm, dtardon, erack, ltinkl, mstahl, sbergman |
Target Milestone: | --- | ||
Target Release: | --- | ||
Hardware: | x86_64 | ||
OS: | Unspecified | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2012-12-20 15:08:32 UTC | Type: | Bug |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Milan Bouchet-Valat
2012-08-27 16:30:19 UTC
caolanm->mstahl: does this bt speak to you, got some undo stuff in it Looks like I'm able to reproduce it from time to time. My workflow at the moment involves copying a table from an HTML file, pasting it into Writer, copying a column from it, *then hitting Ctrl+Z to remove it*, and pasting the copied column in an existing table. That's not something very common... It works 90% of the time, but sometimes I get the crash (maybe when I add another operation, like removing or adding a row, to the process). Here's another trace, FWIW: [New LWP 7762] [New LWP 7763] [New LWP 7765] [New LWP 7771] [New LWP 7783] [New LWP 7766] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". warning: "/usr/lib/debug/usr/lib64/libicudata.so.48.1.1.debug": separate debug info file has no debug info Core was generated by `/usr/lib64/libreoffice/program/soffice.bin --writer --splash-pipe=6'. Program terminated with signal 11, Segmentation fault. #0 0x00007f2e59e62f6f in operator[] (nP=0, this=0x293a818) at /usr/src/debug/libreoffice-3.5.6.2/sw/inc/cellatr.hxx:87 87 class SW_DLLPUBLIC SwTblBoxValue : public SfxPoolItem Thread 6 (Thread 0x7f2e716be700 (LWP 7766)): #0 0x00000037af6e8bcf in __GI___poll (fds=<optimized out>, nfds=<optimized out>, timeout=<optimized out>) at ../sysdeps/unix/sysv/linux/poll.c:87 resultvar = <optimized out> oldtype = 0 result = <optimized out> #1 0x00007f2e73bf7285 in x11::SelectionManager::dispatchEvent (this=this@entry=0x7f2e76533008, millisec=millisec@entry=1000) at /usr/src/debug/libreoffice-3.5.6.2/vcl/unx/generic/dtrans/X11_selection.cxx:3737 aPollFD = {fd = 19, events = 1, revents = 0} aGuard = {<osl::ClearableGuard<osl::Mutex>> = {pT = 0x0}, pResetT = 0x7f2e765333c8} #2 0x00007f2e73bf747a in x11::SelectionManager::run (pThis=0x7f2e76533008) at /usr/src/debug/libreoffice-3.5.6.2/vcl/unx/generic/dtrans/X11_selection.cxx:3775 aNow = {tv_sec = 1346168109, tv_usec = 480174} This = 0x7f2e76533008 aLast = {tv_sec = 1346168109, tv_usec = 87066} xFact = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x7f2e774dc058}, <No data fields>} #3 0x00000037b4a16d7c in osl_thread_start_Impl (pData=0x1401d50) at thread.c:277 __cancel_buf = {__cancel_jmp_buf = {{__cancel_jmp_buf = {0, 4997862513817957108, 0, 19036368, 139837448120064, 19, -4969973228499094796, 4986769271110906612}, __mask_was_saved = 0}}, __pad = {0x7f2e716bdd40, 0x0, 0x0, 0x0}} __cancel_routine = 0x37b4a16b80 <osl_thread_cleanup_Impl> __cancel_arg = 0x1401d50 __not_first_call = <optimized out> terminate = <optimized out> pImpl = 0x1401d50 #4 0x00000037afe07d14 in start_thread (arg=0x7f2e716be700) at pthread_create.c:309 __res = <optimized out> pd = 0x7f2e716be700 now = <optimized out> unwind_buf = {cancel_jmp_buf = {{jmp_buf = {139837448120064, 4997862513817957108, 0, 19036368, 139837448120064, 19, -4969973228463443212, 4986794001004901108}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}} not_first_call = 0 pagesize_m1 = <optimized out> sp = <optimized out> freesize = <optimized out> #5 0x00000037af6f167d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115 No locals. Thread 5 (Thread 0x7f2e5b35c700 (LWP 7783)): #0 0x00000037af6e8bcf in __GI___poll (fds=<optimized out>, nfds=<optimized out>, timeout=<optimized out>) at ../sysdeps/unix/sysv/linux/poll.c:87 resultvar = <optimized out> oldtype = 0 result = <optimized out> #1 0x00007f2e73bde6c8 in ICEConnectionWorker () at /usr/src/debug/libreoffice-3.5.6.2/vcl/unx/generic/app/sm.cxx:665 nConnectionsBefore = 1 bWakeup = <optimized out> nBytes = 16 pLocalFD = 0x7f2e512ffcd8 nRet = <optimized out> #2 0x00000037b4a16d7c in osl_thread_start_Impl (pData=0x17bb1d0) at thread.c:277 __cancel_buf = {__cancel_jmp_buf = {{__cancel_jmp_buf = {0, 4997862513817957108, 0, 22871968, 139837075474176, 20, -4969916722835606796, 4986769271110906612}, __mask_was_saved = 0}}, __pad = {0x7f2e5b35bd40, 0x0, 0x0, 0x0}} __cancel_routine = 0x37b4a16b80 <osl_thread_cleanup_Impl> __cancel_arg = 0x17bb1d0 __not_first_call = <optimized out> terminate = <optimized out> pImpl = 0x17bb1d0 #3 0x00000037afe07d14 in start_thread (arg=0x7f2e5b35c700) at pthread_create.c:309 __res = <optimized out> pd = 0x7f2e5b35c700 now = <optimized out> unwind_buf = {cancel_jmp_buf = {{jmp_buf = {139837075474176, 4997862513817957108, 0, 22871968, 139837075474176, 20, -4969916722799955212, 4986794001004901108}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}} not_first_call = 0 pagesize_m1 = <optimized out> sp = <optimized out> freesize = <optimized out> #4 0x00000037af6f167d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115 No locals. Thread 4 (Thread 0x7f2e5bfff700 (LWP 7771)): #0 pthread_cond_wait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:166 No locals. #1 0x00000037b4a13b99 in osl_waitCondition (Condition=0x12ae0d0, pTimeout=0x0) at /usr/src/debug/libreoffice-3.5.6.2/sal/osl/unx/conditn.cxx:297 pCond = 0x12ae0d0 nRet = <optimized out> Result = osl_cond_result_ok #2 0x00007f2e689df8b4 in wait (pTimeout=0x0, this=0x7f2e63914db8) at /usr/src/debug/libreoffice-3.5.6.2/solver/unxlngx6.pro/inc/osl/conditn.hxx:84 No locals. #3 GrammarCheckingIterator::DequeueAndCheck (this=0x7f2e63914c58) at /usr/src/debug/libreoffice-3.5.6.2/linguistic/source/gciterator.cxx:636 bQueueEmpty = true aLangPortions = empty uno::Sequence aLangPortionsLocale = empty uno::Sequence #4 0x00000037b4a16d7c in osl_thread_start_Impl (pData=0x15ae910) at thread.c:277 __cancel_buf = {__cancel_jmp_buf = {{__cancel_jmp_buf = {0, 4997862513817957108, 0, 239163539456, 139837088724736, 139837558470520, -4969917325741640972, 4986769271110906612}, __mask_was_saved = 0}}, __pad = {0x7f2e5bffed40, 0x0, 0x0, 0x0}} __cancel_routine = 0x37b4a16b80 <osl_thread_cleanup_Impl> __cancel_arg = 0x15ae910 __not_first_call = <optimized out> terminate = <optimized out> pImpl = 0x15ae910 #5 0x00000037afe07d14 in start_thread (arg=0x7f2e5bfff700) at pthread_create.c:309 __res = <optimized out> pd = 0x7f2e5bfff700 now = <optimized out> unwind_buf = {cancel_jmp_buf = {{jmp_buf = {139837088724736, 4997862513817957108, 0, 239163539456, 139837088724736, 139837558470520, -4969917325705989388, 4986794001004901108}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}} not_first_call = 0 pagesize_m1 = <optimized out> sp = <optimized out> freesize = <optimized out> #6 0x00000037af6f167d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115 No locals. Thread 3 (Thread 0x7f2e70ebd700 (LWP 7765)): #0 0x00000037afe0e32d in accept () at ../sysdeps/unix/syscall-template.S:82 No locals. #1 0x00000037b4a1d460 in osl_acceptPipe (pPipe=0x1227e10) at pipe.c:430 s = <optimized out> flags = <optimized out> pAcceptedPipe = <optimized out> #2 0x00000037bc23f625 in accept (Connection=..., this=0x7f2e75e06b18) at /usr/src/debug/libreoffice-3.5.6.2/solver/unxlngx6.pro/inc/osl/pipe.hxx:141 No locals. #3 desktop::OfficeIPCThread::run (this=0x7f2e75e06b08) at /usr/src/debug/libreoffice-3.5.6.2/desktop/source/app/officeipcthread.cxx:655 nError = 4294966784 #4 0x00000037bc24205a in osl::threadFunc (param=0x7f2e75e06b08) at /usr/src/debug/libreoffice-3.5.6.2/solver/unxlngx6.pro/inc/osl/thread.hxx:190 pObj = 0x7f2e75e06b08 #5 0x00000037b4a16d7c in osl_thread_start_Impl (pData=0x1221a10) at thread.c:277 __cancel_buf = {__cancel_jmp_buf = {{__cancel_jmp_buf = {0, 4997862513817957108, 0, 239163539456, 139837439727360, 0, -4969976526497107212, 4986769271110906612}, __mask_was_saved = 0}}, __pad = {0x7f2e70ebcd40, 0x0, 0x0, 0x0}} __cancel_routine = 0x37b4a16b80 <osl_thread_cleanup_Impl> __cancel_arg = 0x1221a10 __not_first_call = <optimized out> terminate = <optimized out> pImpl = 0x1221a10 #6 0x00000037afe07d14 in start_thread (arg=0x7f2e70ebd700) at pthread_create.c:309 __res = <optimized out> pd = 0x7f2e70ebd700 now = <optimized out> unwind_buf = {cancel_jmp_buf = {{jmp_buf = {139837439727360, 4997862513817957108, 0, 239163539456, 139837439727360, 0, -4969976526461455628, 4986794001004901108}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}} not_first_call = 0 pagesize_m1 = <optimized out> sp = <optimized out> freesize = <optimized out> #7 0x00000037af6f167d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115 No locals. Thread 2 (Thread 0x7f2e7ec59700 (LWP 7763)): #0 pthread_cond_timedwait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:218 No locals. #1 0x00000037b4a3c9a9 in rtl_cache_wsupdate_wait (seconds=10) at /usr/src/debug/libreoffice-3.5.6.2/sal/rtl/source/alloc_cache.cxx:1411 now = {tv_sec = 1346168102, tv_usec = 999092} wakeup = {tv_sec = 1346168112, tv_nsec = 999092000} #2 rtl_cache_wsupdate_all (arg=<optimized out>) at /usr/src/debug/libreoffice-3.5.6.2/sal/rtl/source/alloc_cache.cxx:1551 seconds = 10 #3 0x00000037afe07d14 in start_thread (arg=0x7f2e7ec59700) at pthread_create.c:309 __res = <optimized out> pd = 0x7f2e7ec59700 now = <optimized out> unwind_buf = {cancel_jmp_buf = {{jmp_buf = {139837672101632, 4997862513817957108, 0, 239163539456, 139837672101632, 0, -4969998222488751372, 4986794001004901108}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}} not_first_call = 0 pagesize_m1 = <optimized out> sp = <optimized out> freesize = <optimized out> #4 0x00000037af6f167d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115 No locals. Thread 1 (Thread 0x7f2e7ec6a8c0 (LWP 7762)): #0 0x00007f2e59e62f6f in operator[] (nP=0, this=0x293a818) at /usr/src/debug/libreoffice-3.5.6.2/sw/inc/cellatr.hxx:87 No locals. #1 operator[] (nP=0, this=0x293a818) at /usr/src/debug/libreoffice-3.5.6.2/sw/inc/swtable.hxx:81 No locals. #2 SwUndoTblNdsChg::UndoImpl (this=0x223f9c0, rContext=...) at /usr/src/debug/libreoffice-3.5.6.2/sw/source/core/undo/untbl.cxx:1766 pCpyBox = 0xc000000000 rLnBoxes = @0x7f2e7e445848: {<SvPtrarr> = {pData = 0x7f2e5179b820, nFree = 16, nA = 0}, <No data fields>} aIdx = {pNd = 0x2a9a8b0, pNext = 0x7f2e45870d10, pPrev = 0x7f2e600b3050} aTmpBox = {pBox = 0x0, aLines = {<SvPtrarr> = {pData = 0x7f2e45837198, nFree = 10, nA = 0}, <No data fields>}, pUpper = 0x0, pLineBefore = 0x0, pLineBehind = 0x0} aDelBoxes = std::vector of length 0, capacity 0 aMsgHnt = {<SwMsgPoolItem> = {<SfxPoolItem> = {_vptr.SfxPoolItem = 0x7f2e5a625230, nRefCount = 0, nWhich = 163, nKind = 0}, <No data fields>}, pTbl = 0x293a7e0, DATA = {pDelTbl = 0x0, pNewTblNm = 0x0}, pHistory = 0x0, nSplitLine = 65535, eFlags = TBL_BOXPTR, bModified = 0 '\000', bBehindSplitLine = 0 '\000'} pPCD = 0x0 #3 0x00007f2e59e44ab5 in SwUndo::UndoWithContext (this=0x223f9c0, rContext=...) at /usr/src/debug/libreoffice-3.5.6.2/sw/source/core/undo/undobj.cxx:253 pContext = 0x7fffbca48540 #4 0x00000037b8ac6141 in SfxListUndoAction::UndoWithContext (this=0x2c95580, i_context=...) at /usr/src/debug/libreoffice-3.5.6.2/svl/source/undo/undo.cxx:1347 i = 0 #5 0x00000037b8ac8356 in SfxUndoManager::ImplUndo (this=0x1616ee8, i_contextOrNull=0x7fffbca48540) at /usr/src/debug/libreoffice-3.5.6.2/svl/source/undo/undo.cxx:807 aGuard = {m_rManagerData = @0x1616f30, m_aGuard = {<osl::ClearableGuard<osl::Mutex>> = {pT = 0x0}, pResetT = 0x1616f30}, m_aUndoActionsCleanup = empty std::list, m_notifiers = empty std::list} aDoingGuard = {<comphelper::ScopeGuard> = {<boost::noncopyable_::noncopyable> = {<No data fields>}, m_func = {<boost::function_base> = {vtable = 0x37b8cff511, functor = {obj_ptr = 0x37b8aca1a0, type = {type = 0x37b8aca1a0, const_qualified = 92, volatile_qualified = 111}, func_ptr = 0x37b8aca1a0 <comphelper::FlagGuard::ResetFlag(bool&)>, bound_memfunc_ptr = {memfunc_ptr = (void (boost::detail::function::X::*)(boost::detail::function::X * const, int)) 0x37b8aca1a0 <comphelper::FlagGuard::ResetFlag(bool&)>, this adjustment 23162716, obj_ptr = 0x7f2e59b61766}, obj_ref = {obj_ptr = 0x37b8aca1a0, is_const_qualified = 92, is_volatile_qualified = 111}, data = -96 '\240'}}, static args = <optimized out>, static arity = <optimized out>}, m_excHandling = comphelper::ScopeGuard::IGNORE_EXCEPTIONS}, <No data fields>} sActionComment = "Supprimer la ligne" aLockGuard = {m_manager = @0x1616ee8} pAction = 0x2c95580 #6 0x00007f2e59e3882d in sw::UndoManager::impl_DoUndoRedo (this=0x1616ee0, undoOrRedo=<optimized out>) at /usr/src/debug/libreoffice-3.5.6.2/sw/source/core/undo/docundo.cxx:490 c = {m_pDoc = 0x16159d0} pEditShell = 0x170f2c0 bSaveCursors = <optimized out> context = {<SfxUndoContext> = {_vptr.SfxUndoContext = 0x7f2e5a6330b0}, m_rDoc = @0x16159d0, m_rCursorSupplier = @0x170f440, m_pSelFmt = 0x0, m_pMarkList = 0x0} bRet = false #7 0x00007f2e59c878f6 in SwEditShell::Undo (this=0x170f2c0, nCount=1) at /usr/src/debug/libreoffice-3.5.6.2/sw/source/core/edit/edundo.cxx:136 i = <optimized out> nLastUndoId = UNDO_ROW_DELETE bRestoreCrsr = false eOld = 48 aCurr = {pPrev = 0x170f2c0, pRoot = 0x170f6f0} bRet = <optimized out> #8 0x00007f2e5a244f76 in SwWrtShell::Do (this=0x170f2c0, eDoType=SwWrtShell::UNDO, nCnt=1) at /usr/src/debug/libreoffice-3.5.6.2/sw/source/ui/wrtsh/wrtundo.cxx:63 bSaveDoesUndo = 1 '\001' bCreateXSelection = <optimized out> bFrmSelected = <optimized out> #9 0x00007f2e5a14c637 in SwBaseShell::ExecUndo (this=<optimized out>, rReq=...) at /usr/src/debug/libreoffice-3.5.6.2/sw/source/ui/shells/basesh.cxx:493 nId = 5701 pArgs = 0x2fc6be0 pItem = 0x37b4a3b861 nCnt = 1 #10 0x00000037bab7c947 in CallExec (rReq=..., pFunc=<optimized out>, this=0x272cd20) at /usr/src/debug/libreoffice-3.5.6.2/sfx2/inc/sfx2/shell.hxx:201 No locals. #11 SfxDispatcher::Call_Impl (this=0x16a9920, rShell=..., rSlot=..., rReq=..., bRecord=1 '\001') at /usr/src/debug/libreoffice-3.5.6.2/sfx2/source/control/dispatch.cxx:276 bThisDispatcherAlive = 1 '\001' pOldInCallAliveFlag = 0x0 pView = 0x16a98a0 #12 0x00000037bab757a4 in SfxBindings::Execute_Impl (this=0x16a96c0, aReq=..., pSlot=0x7f2e5a6c52b8, pShell=0x272cd20) at /usr/src/debug/libreoffice-3.5.6.2/sfx2/source/control/bindings.cxx:1310 No locals. #13 0x00000037bab93d82 in SfxDispatchController_Impl::dispatch (this=0x21a4440, aURL=..., aArgs=empty uno::Sequence, rListener=...) at /usr/src/debug/libreoffice-3.5.6.2/sfx2/source/control/unoctitm.cxx:743 aReq = {<SfxHint> = {_vptr.SfxHint = 0x37bafe6870}, nSlot = 5701, pArgs = 0x0, pImp = 0x3112950} aSet = {<SfxItemSet> = {_vptr.SfxItemSet = 0x37b8cf8690, _pPool = 0x1615e40, _pParent = 0x0, _aItems = 0x0, _pWhichRanges = 0x295daf0, _nCount = 0}, aDefault = {<SfxPoolItem> = {_vptr.SfxPoolItem = 0x37b8cf8a70, nRefCount = 0, nWhich = 0, nKind = 0}, <No data fields>}, nFree = 10} pSlot = 0x7f2e5a6c52b8 aURLObj = {m_aAbsURIRef = ".uno:Undo", m_aScheme = {m_nBegin = 0, m_nLength = 4}, m_aUser = {m_nBegin = -1, m_nLength = 0}, m_aAuth = {m_nBegin = -1, m_nLength = 0}, m_aHost = {m_nBegin = -1, m_nLength = 0}, m_aPort = {m_nBegin = -1, m_nLength = 0}, m_aPath = {m_nBegin = 5, m_nLength = 4}, m_aQuery = {m_nBegin = -1, m_nLength = 0}, m_aFragment = {m_nBegin = -1, m_nLength = 0}, m_eScheme = INET_PROT_UNO, m_eSmartScheme = INET_PROT_HTTP} nModifier = <optimized out> nAddArgs = <optimized out> aInternalSet = {<SfxItemSet> = {_vptr.SfxItemSet = 0x37b8cf8690, _pPool = 0x12459f0, _pParent = 0x0, _aItems = 0x30763e0, _pWhichRanges = 0x2538c40, _nCount = 1}, aDefault = {<SfxPoolItem> = {_vptr.SfxPoolItem = 0x37b8cf8a70, nRefCount = 0, nWhich = 0, nKind = 0}, <No data fields>}, nFree = 8} pShell = 0x272cd20 lNewArgs = empty uno::Sequence nCount = 0 bTemp = <optimized out> aAddArgs = std::vector of length 0, capacity 0 xFrameRef = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x7f2e51308670}, <No data fields>} bSuccess = 0 '\000' pItem = 0x0 nCall = <optimized out> nMarkArg = <optimized out> bVBARequest = <optimized out> eMapUnit = SFX_MAPUNIT_TWIP aGuard = {m_solarMutex = @0x1185ba0} #14 0x00000037bab94763 in SfxOfficeDispatch::dispatch (this=0x7f2e50a0bd90, aURL=..., aArgs=empty uno::Sequence) at /usr/src/debug/libreoffice-3.5.6.2/sfx2/source/control/unoctitm.cxx:375 layer = {m_aEnvTypeName = "gcc3", m_xPreviousContext = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x1243ba0}, <No data fields>}} #15 0x00000037b96a9750 in svt::AsyncAccelExec::impl_ts_asyncCallback (this=0x25661c0) at /usr/src/debug/libreoffice-3.5.6.2/svtools/source/misc/acceleratorexecute.cxx:501 No locals. #16 0x00000037b70c6d2a in Call (pCaller=<optimized out>, this=<optimized out>) at /usr/src/debug/libreoffice-3.5.6.2/solver/unxlngx6.pro/inc/tools/link.hxx:140 No locals. #17 DoEvent_Impl (pEvent=<optimized out>, this=<optimized out>) at /usr/src/debug/libreoffice-3.5.6.2/vcl/source/helper/evntpost.cxx:59 No locals. #18 vcl::EventPoster::LinkStubDoEvent_Impl (pThis=<optimized out>, pCaller=<optimized out>) at /usr/src/debug/libreoffice-3.5.6.2/vcl/source/helper/evntpost.cxx:62 No locals. #19 0x00000037b7164e82 in Call (pCaller=<optimized out>, this=<optimized out>) at /usr/src/debug/libreoffice-3.5.6.2/solver/unxlngx6.pro/inc/tools/link.hxx:140 No locals. #20 ImplHandleUserEvent (pSVEvent=0x310eb30) at /usr/src/debug/libreoffice-3.5.6.2/vcl/source/window/winproc.cxx:1999 No locals. #21 ImplWindowFrameProc (pWindow=<optimized out>, nEvent=22, pEvent=0x310eb30) at /usr/src/debug/libreoffice-3.5.6.2/vcl/source/window/winproc.cxx:2571 nRet = 0 #22 0x00000037b716e5cc in CallCallback (pEvent=0x310eb30, nEvent=22, this=0x124d770) at /usr/src/debug/libreoffice-3.5.6.2/vcl/inc/salframe.hxx:294 No locals. #23 SalGenericDisplay::DispatchInternalEvent (this=0x11fe2f0) at /usr/src/debug/libreoffice-3.5.6.2/vcl/generic/app/gendisp.cxx:102 pData = 0x310eb30 pFrame = 0x124d770 nEvent = 22 #24 0x00007f2e75a130af in GtkData::userEventFn (data=data@entry=0x1186ed0) at /usr/src/debug/libreoffice-3.5.6.2/vcl/unx/gtk/app/gtkdata.cxx:946 bContinue = 1 aGuard = {pT = 0x1185ba0} pThis = 0x1186ed0 pData = 0x1 #25 0x00007f2e75a13129 in call_userEventFn (data=0x1186ed0) at /usr/src/debug/libreoffice-3.5.6.2/vcl/unx/gtk/app/gtkdata.cxx:956 No locals. #26 0x00007f2e7408b695 in g_main_dispatch (context=0x11be960) at gmain.c:2539 dispatch = 0x7f2e740893f0 <g_idle_dispatch> was_in_call = 0 user_data = 0x1186ed0 callback = 0x7f2e75a13100 <call_userEventFn(void*)> cb_funcs = 0x7f2e74361960 cb_data = 0x26ca400 current_source_link = {data = 0x30dc3c0, next = 0x0} need_destroy = <optimized out> source = 0x30dc3c0 current = 0x1358790 i = <optimized out> #27 g_main_context_dispatch (context=context@entry=0x11be960) at gmain.c:3075 No locals. #28 0x00007f2e7408b9c8 in g_main_context_iterate (context=context@entry=0x11be960, block=block@entry=0, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3146 max_priority = -100 timeout = 0 some_ready = 1 nfds = <optimized out> allocated_nfds = <optimized out> fds = 0x1664d90 #29 0x00007f2e7408ba84 in g_main_context_iteration (context=0x11be960, may_block=0) at gmain.c:3207 retval = <optimized out> #30 0x00007f2e75a12e51 in GtkData::Yield (this=0x1186ed0, bWait=true, bHandleAllCurrentEvents=<optimized out>) at /usr/src/debug/libreoffice-3.5.6.2/vcl/unx/gtk/app/gtkdata.cxx:582 nMaxEvents = 1 wasOneEvent = <optimized out> aReleaser = {m_nYieldCount = 1} bDispatchThread = true bWasEvent = <optimized out> #31 0x00007f2e75a13cdd in GtkInstance::Yield (this=0x1186e30, bWait=<optimized out>, bHandleAllCurrentEvents=<optimized out>) at /usr/src/debug/libreoffice-3.5.6.2/vcl/unx/gtk/app/gtkinst.cxx:613 No locals. #32 0x00000037b6ef8de4 in ImplYield (i_bAllEvents=false, i_bWait=true) at /usr/src/debug/libreoffice-3.5.6.2/vcl/source/app/svapp.cxx:458 pSVData = 0x37b74ca4a0 #33 Application::Yield (i_bAllEvents=false) at /usr/src/debug/libreoffice-3.5.6.2/vcl/source/app/svapp.cxx:492 No locals. #34 0x00000037b6ef8e87 in Application::Execute () at /usr/src/debug/libreoffice-3.5.6.2/vcl/source/app/svapp.cxx:435 pSVData = 0x37b74ca4a0 #35 0x00000037bc21ddb9 in desktop::Desktop::Main (this=0x7fffbca49630) at /usr/src/debug/libreoffice-3.5.6.2/desktop/source/app/app.cxx:1885 layer2 = {m_aEnvTypeName = "gcc3", m_xPreviousContext = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x7f2e75e1fb80}, <No data fields>}} bTerminateRequested = 0 '\000' nAcquireCount = <optimized out> rCmdLineArgs = @0x37bc468f40: {m_cwdUrl = {<boost::optional_detail::optional_base<rtl::OUString>> = {<boost::optional_detail::optional_tag> = {<No data fields>}, m_initialized = true, m_storage = {dummy_ = {data = "\360\360Kv.\177\000", aligner_ = {<No data fields>}}}}, <No data fields>}, m_aBoolParams = '\000' <repeats 15 times>, "\001", '\000' <repeats 16 times>, m_aStrParams = {"", "6", "" <repeats 19 times>}, m_aStrSetParams = "\000\001", '\000' <repeats 18 times>, m_eArgumentCount = desktop::CommandLineArgs::MANY, m_bDocumentArgs = true, m_aMutex = {mutex = 0x894d60}, static m_pGroupDefinitions = {{nCount = 8, pGroupMembers = 0x37bc468de0}}} aConfigErrHandler = {m_pContext = 0x0, m_xHandler = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x0}, <No data fields>}} xRestartManager = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x7f2e6ae29d60}, <No data fields>} layer = {m_aEnvTypeName = "gcc3", m_xPreviousContext = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x7f2e75e1fb40}, <No data fields>}} aOptions = {<utl::detail::Options> = {<utl::ConfigurationBroadcaster> = {_vptr.ConfigurationBroadcaster = 0x37b99efd90, mpList = 0x0, m_nBroadcastBlocked = 0, m_nBlockedHint = 0}, <utl::ConfigurationListener> = {_vptr.ConfigurationListener = 0x37b99efdc8}, <No data fields>}, <SfxListener> = {_vptr.SfxListener = 0x37b99efdf0, aBCs = {<SvPtrarr> = empty SvArray, <No data fields>}}, static sm_pSingleImplConfig = 0x12ec5b0, static sm_nAccessibilityRefCount = 5} eError = desktop::Desktop::BE_UNO_SERVICEMANAGER xSMgr = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x7f2e774dc058}, <No data fields>} xDesktop = <optimized out> aAppearanceCfg = {<utl::ConfigItem> = {<utl::ConfigurationBroadcaster> = {_vptr.ConfigurationBroadcaster = 0x37b99efe70, mpList = 0x0, m_nBroadcastBlocked = 0, m_nBlockedHint = 0}, sSubTree = "Office.Common/View", m_xHierarchyAccess = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x7f2e6ae5d660}, <No data fields>}, xChangeLstnr = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x0}, <No data fields>}, pImpl = 0x12d36b0}, nDragMode = 2, nScaleFactor = 100, nSnapMode = 2, nMiddleMouse = 2, nAAMinPixelHeight = 8, bMenuMouseFollow = 1 '\001', bFontAntialiasing = 1 '\001', static bInitialized = 1 '\001'} #36 0x00000037b6eff931 in ImplSVMain () at /usr/src/debug/libreoffice-3.5.6.2/vcl/source/app/svmain.cxx:178 pSVData = 0x37b74ca4a0 xMS = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x0}, <No data fields>} nReturn = 1 bInit = <optimized out> #37 0x00000037b6eff9d5 in SVMain () at /usr/src/debug/libreoffice-3.5.6.2/vcl/source/app/svmain.cxx:215 nRet = <optimized out> #38 0x00000037bc242b96 in soffice_main () at /usr/src/debug/libreoffice-3.5.6.2/desktop/source/app/sofficemain.cxx:71 aDesktop = {<Application> = {_vptr.Application = 0x37bc4661b0}, m_rSplashScreen = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x0}, <No data fields>}, m_bMinimized = 119 'w', m_bInvisible = 0 '\000', m_bServicesRegistered = true, m_nAppEvents = 124, m_aBootstrapError = desktop::Desktop::BE_OK, m_aBootstrapStatus = desktop::Desktop::BS_OK, m_pLockfile = {_M_ptr = 0x123bd40}, m_firstRunTimer = {_vptr.Timer = 0x37b74a8830, mpTimerData = 0x0, mnTimeout = 1, mbActive = 0 '\000', mbAuto = 0 '\000', maTimeoutHdl = {pInst = 0x0, pFunc = 0}}, static pResMgr = 0x0, static bSuppressOpenDefault = <optimized out>} rCmdLineArgs = <optimized out> #39 0x00000000004006bb in sal_main () at /usr/src/debug/libreoffice-3.5.6.2/desktop/source/app/main.c:34 No locals. #40 main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/libreoffice-3.5.6.2/desktop/source/app/main.c:33 ret = 0 hmm... the stack traces indicate that in the line: SwTableBox* pCpyBox = pTblNd->GetTable().GetTabSortBoxes()[0]; either an invalid table object or an empty array of boxes is returned. but i can't reproduce that problem here, because it crashes in a differnet place for me. but perhaps the crashes are related. 1. Table->Insert, OK 2. Firefox copy https://gerrit.libreoffice.org/#/q/status:open,n,z 3. place cursor below exising table, paste 4. mark a column in the pasted table, copy 5. move cursor in top right corner of empty table, paste 6. undo -> crash #0 FindTableNode (this=0x5039150) at /sw/source/core/docnode/node.cxx:400 #1 SwNode::FindTableNode (this=0x5039150) at /sw/source/core/docnode/node.cxx:395 #2 0x00007f6b5f0195da in FindTableNode (this=<optimized out>) at /sw/inc/node.hxx:692 #3 SwTableBox::~SwTableBox (this=0x5038180, __in_chrg=<optimized out>) at /sw/source/core/table/swtable.cxx:1733 #4 0x00007f6b5f0196b9 in SwTableBox::~SwTableBox (this=0x5038180, __in_chrg=<optimized out>) at /sw/source/core/table/swtable.cxx:1748 #5 0x00007f6b5f173840 in SwUndoTblNdsChg::UndoImpl (this=0x4e84bf0, rContext=...) at /sw/source/core/undo/untbl.cxx:1787 #6 0x00007f6b5f169afc in SwUndoTblCpyTbl::UndoImpl (this=0x4f1eff0, rContext=...) at /sw/source/core/undo/untbl.cxx:2547 this mysteriously worked in OOo 3.3 (or at least it doesn't crash), but OOo 3.4 beta crashes (after an additional redo->undo step) and LO 3.5 and master crash like description. the odd thing here is how the table box is deleted after the nodes have already been removed from the nodes array; appears to be a change in OOo 3.0. with that fixed i can't easily reproduce table undo crashes any more. http://cgit.freedesktop.org/libreoffice/core/commit/?id=cf842d7c7f9559bfdbb3924cd05a3a50d1dff5e3 fix for this should be in next F17 upload 3.5.6.2-7 fix is in upstream libreoffice-3-6 for 3.6.3 as well: http://cgit.freedesktop.org/libreoffice/core/commit/?h=libreoffice-3-6&id=d60ea419c57812f611125b0ca51bf897ea7e214b libreoffice-3.5.7.2-2.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/libreoffice-3.5.7.2-2.fc17 Package libreoffice-3.5.7.2-2.fc17: * should fix your issue, * was pushed to the Fedora 17 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing libreoffice-3.5.7.2-2.fc17' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-15506/libreoffice-3.5.7.2-2.fc17 then log in and leave karma (feedback). libreoffice-3.5.7.2-2.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report. |