Bug 863317

Summary: [abrt] libreoffice-core-3.5.6.2-2.fc17: GetDoc: Process /usr/lib64/libreoffice/program/soffice.bin was killed by signal 11 (SIGSEGV)
Product: [Fedora] Fedora Reporter: John Milner <jmilner+redhatbz>
Component: libreofficeAssignee: Caolan McNamara <caolanm>
Status: CLOSED NEXTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 17CC: caolanm, dtardon, erack, ltinkl, mstahl, sbergman
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
Whiteboard: abrt_hash:766ab9e908cadc364ebcb5a9267f4a84f43dd9fa
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-10-08 14:24:26 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Test case none

Description John Milner 2012-10-05 05:31:56 UTC 
Description of problem:
I was cutting and pasting a complex nested table from one document to a new, blank document. There were also many comments attached to the table.

Version-Release number of selected component:
libreoffice-core-3.5.6.2-2.fc17

Additional info:
libreport version: 2.0.14
abrt_version:   2.0.12
backtrace_rating: 4
cmdline:        /usr/lib64/libreoffice/program/soffice.bin --writer --splash-pipe=6
crash_function: GetDoc
kernel:         3.5.4-1.fc17.x86_64

truncated backtrace:
:Thread no. 1 (10 frames)
: #0 GetDoc at /usr/src/debug/libreoffice-3.5.6.2/solver/unxlngx6.pro/inc/svl/smplhint.hxx:69
: #2 SwPageFrm::PreparePage at /usr/src/debug/libreoffice-3.5.6.2/sw/source/core/layout/pagechg.cxx:530
: #3 SwFrm::InsertPage at /usr/src/debug/libreoffice-3.5.6.2/sw/source/core/layout/pagechg.cxx:1350
: #4 SwFrm::GetNextSctLeaf at /usr/src/debug/libreoffice-3.5.6.2/sw/source/core/layout/sectfrm.cxx:1667
: #5 SwFlowFrm::MoveFwd at /usr/src/debug/libreoffice-3.5.6.2/sw/source/core/layout/flowfrm.cxx:1946
: #6 SwTabFrm::MakeAll at /usr/src/debug/libreoffice-3.5.6.2/sw/source/core/layout/tabfrm.cxx:2554
: #7 SwFrm::PrepareMake at /usr/src/debug/libreoffice-3.5.6.2/sw/source/core/layout/calcmove.cxx:386
: #8 Calc at /usr/src/debug/libreoffice-3.5.6.2/sw/source/core/inc/frame.hxx:1056
: #9 CalcCntnt at /usr/src/debug/libreoffice-3.5.6.2/sw/source/core/layout/fly.cxx:1601
: #10 SwLayoutFrm::FormatWidthCols at /usr/src/debug/libreoffice-3.5.6.2/sw/source/core/layout/wsfrm.cxx:3512
Comment 1 Michael Stahl 2012-10-05 13:56:45 UTC 
can't figure out what the problem is from the stack trace.

can you reproduce the problem, and attach a document and
steps how to reroduce it?


pagechg.cxx:530
        SwDoc *pDoc = GetFmt()->GetDoc();

probably GetFmt() returns null here but in that case it should
have crashed in SwPageFrm's ctor already...
Comment 2 John Milner 2012-10-08 14:24:26 UTC 
Many thanks for the prompt response. Unfortunately, I no longer have the original document and cannot reproduce. I'll reopen if I encounter the problem again.
Comment 3 John Milner 2013-03-04 18:22:49 UTC 
Created attachment 705111 [details]
Test case

I had Writer crash while doing a find and replace operation, and ABRT pointed me here saying the bug had already been reported. I guess I have a test case now!

1. Open find-and-replace-crash.odt;
2. CTRL+H;
3. Type "Cindy" in "Search for" box;
4. Type "Hello" in "Replace with" box;
5. Notice "Replace All" button is disabled;
6. Click "Replace" over and over again as fast as possible;
7. Writer crashes, apparently after clicking "Replace" when there are no more occurrences left.

I can reproduce the crash consistently (I've done it four times now), but only if I click "Replace" fast enough.
Comment 4 David Tardon 2013-03-05 08:07:55 UTC 
(In reply to comment #3)
> Created attachment 705111 [details]
> Test case
> 
> I had Writer crash while doing a find and replace operation, and ABRT
> pointed me here saying the bug had already been reported. I guess I have a
> test case now!
> 
> 1. Open find-and-replace-crash.odt;
> 2. CTRL+H;

2.5. check Comments in More Options

> 3. Type "Cindy" in "Search for" box;
> 4. Type "Hello" in "Replace with" box;
> 5. Notice "Replace All" button is disabled;
> 6. Click "Replace" over and over again as fast as possible;
> 7. Writer crashes, apparently after clicking "Replace" when there are no
> more occurrences left.
> 
> I can reproduce the crash consistently (I've done it four times now), but
> only if I click "Replace" fast enough.

Yup, crashes with 3.5, but not with 3.6 (Fedora 18). Since this seems to be a quite uncommon operation, I do not think that we need to look for the fix to backport it. Anyway, thanks for the reproducer.