Bug 861680

Summary: [abrt] libreoffice-core-3.5.6.2-2.fc17: IsTableNode: Process /usr/lib64/libreoffice/program/soffice.bin was killed by signal 11 (SIGSEGV)
Product: [Fedora] Fedora Reporter: Tobias Mueller <fedora-bugs>
Component: libreofficeAssignee: Michael Stahl <mstahl>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 17CC: caolanm, dtardon, erack, ltinkl, mstahl, sbergman, thb
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
Whiteboard: abrt_hash:04047ff34fd4abc322d3a9210bfc608460ce56de
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-12-20 16:11:16 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: core_backtrace
none
File: environ
none
File: backtrace
none
File: limits
none
File: cgroup
none
File: maps
none
File: dso_list
none
File: var_log_messages
none
File: open_fds
none
file that makes libreoffice crash none

Description Tobias Mueller 2012-09-29 23:50:39 UTC
Description of problem:
I tried to open a file.

Version-Release number of selected component:
libreoffice-core-3.5.6.2-2.fc17

Additional info:
libreport version: 2.0.13
abrt_version:   2.0.12
backtrace_rating: 4
cmdline:        /usr/lib64/libreoffice/program/soffice.bin --writer file:///tmp/dd.docx --splash-pipe=6
crash_function: IsTableNode
kernel:         3.5.3-1.fc17.x86_64

truncated backtrace:
:Thread no. 1 (10 frames)
: #0 IsTableNode at /usr/src/debug/libreoffice-3.5.6.2/sw/inc/node.hxx
: #1 SwNode::FindTableNode at /usr/src/debug/libreoffice-3.5.6.2/sw/source/core/docnode/node.cxx
: #2 FindTableNode at /usr/src/debug/libreoffice-3.5.6.2/sw/inc/node.hxx
: #3 SwTableBox::SwTableBox at /usr/src/debug/libreoffice-3.5.6.2/sw/source/core/table/swtable.cxx
: #4 lcl_CopyTblBox at /usr/src/debug/libreoffice-3.5.6.2/sw/source/core/docnode/ndcopy.cxx
: #5 SvPtrarr::_ForEach at /usr/src/debug/libreoffice-3.5.6.2/svl/source/memtools/svarray.cxx
: #6 ForEach at /usr/src/debug/libreoffice-3.5.6.2/sw/inc/swtable.hxx
: #7 lcl_CopyTblLine at /usr/src/debug/libreoffice-3.5.6.2/sw/source/core/docnode/ndcopy.cxx
: #8 SvPtrarr::_ForEach at /usr/src/debug/libreoffice-3.5.6.2/svl/source/memtools/svarray.cxx
: #9 ForEach at /usr/src/debug/libreoffice-3.5.6.2/sw/inc/swtable.hxx

Comment 1 Tobias Mueller 2012-09-29 23:50:43 UTC
Created attachment 619240 [details]
File: core_backtrace

Comment 2 Tobias Mueller 2012-09-29 23:50:45 UTC
Created attachment 619241 [details]
File: environ

Comment 3 Tobias Mueller 2012-09-29 23:50:48 UTC
Created attachment 619242 [details]
File: backtrace

Comment 4 Tobias Mueller 2012-09-29 23:50:50 UTC
Created attachment 619243 [details]
File: limits

Comment 5 Tobias Mueller 2012-09-29 23:50:52 UTC
Created attachment 619244 [details]
File: cgroup

Comment 6 Tobias Mueller 2012-09-29 23:50:54 UTC
Created attachment 619245 [details]
File: maps

Comment 7 Tobias Mueller 2012-09-29 23:50:57 UTC
Created attachment 619246 [details]
File: dso_list

Comment 8 Tobias Mueller 2012-09-29 23:50:59 UTC
Created attachment 619247 [details]
File: var_log_messages

Comment 9 Tobias Mueller 2012-09-29 23:51:01 UTC
Created attachment 619248 [details]
File: open_fds

Comment 10 Tobias Mueller 2012-09-30 14:49:18 UTC
Opened a file.

backtrace_rating: 4
Package: libreoffice-core-3.5.6.2-2.fc17
OS Release: Fedora release 17 (Beefy Miracle)

Comment 11 Tobias Mueller 2012-09-30 14:51:10 UTC
Created attachment 619446 [details]
file that makes libreoffice crash

Comment 12 Caolan McNamara 2012-10-02 08:31:57 UTC
reproducible

Comment 13 Caolan McNamara 2012-10-02 09:27:32 UTC
no crash in 3-6 at least

Comment 14 Michael Stahl 2012-10-02 22:14:40 UTC
tracked it down to this commit in the libreoffice-3-5 branch:

commit 9073da554f407c7aed8af6231313c5355cc266e0
Author: Miklos Vajna <vmiklos>
Date:   Mon Jun 11 11:19:19 2012 +0200

    fdo#49659 three RTF fixes

from the backtrace i guess this part is the problem:

    3) dmapper: handle tables in substreams
    
    (cherry picked from commit 61ba6e49f5bbadaf1334ce71459647c3d0a3a37d)
    (cherry picked from commit 3c5a75208b41239b2e840a2ea9932a9f5b872b36)

so this bug is actually a regression in LO 3.5.6, it didn't crash in 3.5.5.

it also seems to work in the 3.6 branch, as mentioned in comment #13.

so probably something is missing in that backport...

Comment 15 Michael Stahl 2012-10-04 10:45:37 UTC
fixed upstream by Miklos:

http://cgit.freedesktop.org/libreoffice/core/commit/?h=libreoffice-3-5&id=ee2645558a843cbaa658ed12effc543da7ac335c

will be fixed in 3.5.7.2-1 package.

Comment 16 Fedora Update System 2012-10-05 05:29:28 UTC
libreoffice-3.5.7.2-2.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/libreoffice-3.5.7.2-2.fc17

Comment 17 Fedora Update System 2012-10-06 03:50:08 UTC
Package libreoffice-3.5.7.2-2.fc17:
* should fix your issue,
* was pushed to the Fedora 17 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing libreoffice-3.5.7.2-2.fc17'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-15506/libreoffice-3.5.7.2-2.fc17
then log in and leave karma (feedback).

Comment 18 Fedora Update System 2012-12-20 16:11:18 UTC
libreoffice-3.5.7.2-2.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.