Bug 889342

Summary:	crash when opening odp file
Product:	[Fedora] Fedora	Reporter:	Bill Nottingham <notting>
Component:	libreoffice	Assignee:	David Tardon <dtardon>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	18	CC:	caolanm, c.david86, davej, dtardon, erack, ltinkl, mstahl, rvokal, sbergman
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-03-05 23:21:31 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Bill Nottingham 2012-12-20 21:04:52 UTC

Description of problem:

warning: Currently logging to gdbtrace.log.  Turn the logging off and on to make the new setting effective.
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
warning: "/usr/lib/debug/usr/lib64/libicudata.so.49.1.1.debug": separate debug info file has no debug info
[New Thread 0x7ffff1bbc700 (LWP 12575)]
[New Thread 0x7fffebbaf700 (LWP 12578)]
[New Thread 0x7fffeb3ae700 (LWP 12579)]
[New Thread 0x7fffe8e8f700 (LWP 12580)]
[New Thread 0x7fffda848700 (LWP 12581)]
[Thread 0x7fffebbaf700 (LWP 12578) exited]
Detaching after fork from child process 12584.
[New Thread 0x7fffebbaf700 (LWP 12586)]
[New Thread 0x7fffd2661700 (LWP 12587)]
[Thread 0x7fffd2661700 (LWP 12587) exited]
[New Thread 0x7fffd2661700 (LWP 12589)]
[Thread 0x7fffd2661700 (LWP 12589) exited]
[New Thread 0x7fffd2661700 (LWP 12590)]

Program received signal SIGSEGV, Segmentation fault.
0x0000003424e5d475 in SfxItemPool::Remove(SfxPoolItem const&) () from /usr/lib64/libreoffice/program/libsvllo.so
#0  0x0000003424e5d475 in SfxItemPool::Remove(SfxPoolItem const&) () from /usr/lib64/libreoffice/program/libsvllo.so
#1  0x00007fffdb028fcc in CharAttribList::OptimizeRanges(SfxItemPool&) () from /usr/lib64/libreoffice/program/../program/libeditenglo.so
#2  0x00007fffdb08385b in ImpEditEngine::GetAttribs(unsigned short, unsigned short, unsigned short, unsigned char) const () from /usr/lib64/libreoffice/program/../program/libeditenglo.so
#3  0x00007fffdb02f25b in EditEngine::GetAttribs(unsigned short, unsigned short, unsigned short, unsigned char) const () from /usr/lib64/libreoffice/program/../program/libeditenglo.so
#4  0x00007fffdb0ffdd7 in SvxOutlinerForwarder::GetAttribs(ESelection const&, unsigned char) const () from /usr/lib64/libreoffice/program/../program/libeditenglo.so
#5  0x00007fffdb10d16d in SvxUnoTextRangeBase::_setPropertyValues(com::sun::star::uno::Sequence<rtl::OUString> const&, com::sun::star::uno::Sequence<com::sun::star::uno::Any> const&, int) () from /usr/lib64/libreoffice/program/../program/libeditenglo.so
#6  0x000000342966100e in SvXMLImportPropertyMapper::_FillMultiPropertySet(std::vector<XMLPropertyState, std::allocator<XMLPropertyState> > const&, com::sun::star::uno::Reference<com::sun::star::beans::XMultiPropertySet> const&, com::sun::star::uno::Reference<com::sun::star::beans::XPropertySetInfo> const&, UniReference<XMLPropertySetMapper> const&, _ContextID_Index_Pair*) () from /usr/lib64/libreoffice/program/../program/libxolo.so
#7  0x00000034296612e4 in SvXMLImportPropertyMapper::FillPropertySet(std::vector<XMLPropertyState, std::allocator<XMLPropertyState> > const&, com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet>, _ContextID_Index_Pair*) const () from /usr/lib64/libreoffice/program/../program/libxolo.so
#8  0x000000342972f9ac in XMLTextStyleContext::FillPropertySet(com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> const&) () from /usr/lib64/libreoffice/program/../program/libxolo.so
#9  0x00000034296f9717 in XMLTextImportHelper::SetStyleAndAttrs(SvXMLImport&, com::sun::star::uno::Reference<com::sun::star::text::XTextCursor> const&, rtl::OUString const&, unsigned char, unsigned char, signed char, unsigned char) () from /usr/lib64/libreoffice/program/../program/libxolo.so
#10 0x000000342972531b in XMLParaContext::~XMLParaContext() () from /usr/lib64/libreoffice/program/../program/libxolo.so
#11 0x0000003429726239 in XMLParaContext::~XMLParaContext() () from /usr/lib64/libreoffice/program/../program/libxolo.so
#12 0x00000034295288c3 in SvXMLImport::endElement(rtl::OUString const&) () from /usr/lib64/libreoffice/program/../program/libxolo.so
#13 0x00007fffda86612d in sax_expatwrap::SaxExpatParser_Impl::callbackEndElement(void*, char const*) () from /usr/lib64/libreoffice/program/../program/expwrap.uno.so
#14 0x000000341a0087b0 in doContent (parser=parser@entry=0x1a81fd0, startTagLevel=startTagLevel@entry=0, enc=0x341a226800 <utf8_encoding>, s=0x1764ee1 "</text:p></draw:text-box></draw:frame><presentation:notes draw:style-name=\"dp2\"><office:forms form:automatic-focus=\"false\" form:apply-design-mode=\"false\"/><draw:page-thumbnail draw:style-name=\"gr3\" dr"..., end=0x1766888 "ot ship an interim solution in 7.0 that we will regret in the future. </text:p></text:list-item></text:list></text:list-item><text:li", 'u' <repeats 67 times>..., nextPtr=0x1a82000, haveMore=1 '\001') at lib/xmlparse.c:2532
#15 0x000000341a00972e in contentProcessor (parser=0x1a81fd0, start=<optimized out>, end=<optimized out>, endPtr=<optimized out>) at lib/xmlparse.c:2105
#16 0x000000341a00da3d in XML_ParseBuffer (parser=0x1a81fd0, len=<optimized out>, isFinal=0) at lib/xmlparse.c:1651
#17 0x00007fffda8649d6 in sax_expatwrap::SaxExpatParser_Impl::parse() () from /usr/lib64/libreoffice/program/../program/expwrap.uno.so
#18 0x00007fffda8687ae in sax_expatwrap::SaxExpatParser::parseStream(com::sun::star::xml::sax::InputSource const&) () from /usr/lib64/libreoffice/program/../program/expwrap.uno.so
#19 0x00007fffd9a07334 in ReadThroughComponent(com::sun::star::uno::Reference<com::sun::star::io::XInputStream>, com::sun::star::uno::Reference<com::sun::star::lang::XComponent>, String const&, com::sun::star::uno::Reference<com::sun::star::lang::XMultiServiceFactory>&, char const*, com::sun::star::uno::Sequence<com::sun::star::uno::Any>, rtl::OUString const&, unsigned char, unsigned char) () from /usr/lib64/libreoffice/program/../program/libsdlo.so
#20 0x00007fffd9a07c18 in ReadThroughComponent(com::sun::star::uno::Reference<com::sun::star::embed::XStorage> const&, com::sun::star::uno::Reference<com::sun::star::lang::XComponent>, char const*, char const*, com::sun::star::uno::Reference<com::sun::star::lang::XMultiServiceFactory>&, char const*, com::sun::star::uno::Sequence<com::sun::star::uno::Any>, rtl::OUString const&, unsigned char) () from /usr/lib64/libreoffice/program/../program/libsdlo.so
#21 0x00007fffd9a09921 in SdXMLFilter::Import(unsigned long&) () from /usr/lib64/libreoffice/program/../program/libsdlo.so
#22 0x00007fffd9a8c382 in sd::DrawDocShell::Load(SfxMedium&) () from /usr/lib64/libreoffice/program/../program/libsdlo.so
#23 0x00000034264c211d in SfxObjectShell::LoadOwnFormat(SfxMedium&) () from /usr/lib64/libreoffice/program/libsfxlo.so
#24 0x00000034264cf00e in SfxObjectShell::DoLoad(SfxMedium*) () from /usr/lib64/libreoffice/program/libsfxlo.so
#25 0x0000003426511b7d in SfxBaseModel::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) () from /usr/lib64/libreoffice/program/libsfxlo.so
#26 0x000000342654a980 in SfxFrameLoader_Impl::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) () from /usr/lib64/libreoffice/program/libsfxlo.so
#27 0x00007fffe9ba2ab3 in framework::LoadEnv::impl_loadContent() () from /usr/lib64/libreoffice/program/../program/libfwklo.so
#28 0x00007fffe9ba3f08 in framework::LoadEnv::startLoading() () from /usr/lib64/libreoffice/program/../program/libfwklo.so
#29 0x00007fffe9b1ec6e in framework::LoadDispatcher::impl_dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XDispatchResultListener> const&) () from /usr/lib64/libreoffice/program/../program/libfwklo.so
#30 0x00007fffe9b1f158 in framework::LoadDispatcher::dispatchWithReturnValue(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) () from /usr/lib64/libreoffice/program/../program/libfwklo.so
#31 0x00000034238fed24 in comphelper::SynchronousDispatch::dispatch(com::sun::star::uno::Reference<com::sun::star::uno::XInterface> const&, rtl::OUString const&, rtl::OUString const&, int, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) () from /usr/lib64/libreoffice/program/libcomphelpgcc3.so
#32 0x0000003426e3baf0 in desktop::DispatchWatcher::executeDispatchRequests(std::vector<desktop::DispatchWatcher::DispatchRequest, std::allocator<desktop::DispatchWatcher::DispatchRequest> > const&, bool) () from /usr/lib64/libreoffice/program/libsofficeapp.so
#33 0x0000003426e49851 in desktop::OfficeIPCThread::ExecuteCmdLineRequests(desktop::ProcessDocumentsRequest&) () from /usr/lib64/libreoffice/program/libsofficeapp.so
#34 0x0000003426e1fa75 in desktop::Desktop::OpenClients() () from /usr/lib64/libreoffice/program/libsofficeapp.so
#35 0x0000003426e20cbc in desktop::Desktop::OpenClients_Impl(void*) () from /usr/lib64/libreoffice/program/libsofficeapp.so
#36 0x000000341c368a22 in ImplWindowFrameProc(Window*, SalFrame*, unsigned short, void const*) () from /usr/lib64/libreoffice/program/libvcllo.so
#37 0x000000341c37151c in SalGenericDisplay::DispatchInternalEvent() () from /usr/lib64/libreoffice/program/libvcllo.so
#38 0x00007ffff116b87f in GtkData::userEventFn(void*) () from /usr/lib64/libreoffice/program/libvclplug_gtklo.so
#39 0x00007ffff116b8f9 in call_userEventFn () from /usr/lib64/libreoffice/program/libvclplug_gtklo.so
#40 0x00007fffef0baa75 in g_main_dispatch (context=0x663130) at gmain.c:2715
#41 g_main_context_dispatch (context=context@entry=0x663130) at gmain.c:3219
#42 0x00007fffef0bada8 in g_main_context_iterate (context=context@entry=0x663130, block=block@entry=0, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3290
#43 0x00007fffef0bae64 in g_main_context_iteration (context=0x663130, may_block=0) at gmain.c:3351
#44 0x00007ffff116b611 in GtkData::Yield(bool, bool) () from /usr/lib64/libreoffice/program/libvclplug_gtklo.so
#45 0x000000341c0f76f4 in Application::Yield(bool) () from /usr/lib64/libreoffice/program/libvcllo.so
#46 0x000000341c0f7797 in Application::Execute() () from /usr/lib64/libreoffice/program/libvcllo.so
#47 0x0000003426e1e450 in desktop::Desktop::Main() () from /usr/lib64/libreoffice/program/libsofficeapp.so
#48 0x000000341c0ffba9 in ImplSVMain() () from /usr/lib64/libreoffice/program/libvcllo.so
#49 0x000000341c0ffc35 in SVMain() () from /usr/lib64/libreoffice/program/libvcllo.so
#50 0x0000003426e4ac35 in soffice_main () from /usr/lib64/libreoffice/program/libsofficeapp.so
#51 0x00000000004006fb in main ()

Thread 10 (Thread 0x7fffd2661700 (LWP 12590)):
#0  pthread_cond_timedwait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:217
#1  0x000000341a437cf0 in osl_waitCondition () from /usr/lib64/libreoffice/program/../ure-link/lib/libuno_sal.so.3
#2  0x00007fffebdf1763 in configmgr::Components::WriteThread::execute() () from /usr/lib64/libreoffice/program/../program/configmgr.uno.so
#3  0x0000003419803d76 in salhelper::Thread::run() () from /usr/lib64/libreoffice/program/../ure-link/lib/libuno_salhelpergcc3.so.3
#4  0x0000003419803fea in threadFunc () from /usr/lib64/libreoffice/program/../ure-link/lib/libuno_salhelpergcc3.so.3
#5  0x000000341a417bd7 in osl_thread_start_Impl () from /usr/lib64/libreoffice/program/../ure-link/lib/libuno_sal.so.3
#6  0x0000003413007d15 in start_thread (arg=0x7fffd2661700) at pthread_create.c:308
#7  0x00000034128f246d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:114

Thread 7 (Thread 0x7fffebbaf700 (LWP 12586)):
#0  pthread_cond_timedwait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:217
#1  0x000000341a437cf0 in osl_waitCondition () from /usr/lib64/libreoffice/program/../ure-link/lib/libuno_sal.so.3
#2  0x00007fffe9b4e24c in framework::WakeUpThread::run() () from /usr/lib64/libreoffice/program/../program/libfwklo.so
#3  0x00007fffe9b364aa in threadFunc () from /usr/lib64/libreoffice/program/../program/libfwklo.so
#4  0x000000341a417bd7 in osl_thread_start_Impl () from /usr/lib64/libreoffice/program/../ure-link/lib/libuno_sal.so.3
#5  0x0000003413007d15 in start_thread (arg=0x7fffebbaf700) at pthread_create.c:308
#6  0x00000034128f246d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:114

Thread 6 (Thread 0x7fffda848700 (LWP 12581)):
#0  0x00000034128e998d in poll () at ../sysdeps/unix/syscall-template.S:81
#1  0x00007fffeec283f5 in x11::SelectionManager::dispatchEvent(int) () from /usr/lib64/libreoffice/program/libvclplug_genlo.so
#2  0x00007fffeec285d6 in x11::SelectionManager::run(void*) () from /usr/lib64/libreoffice/program/libvclplug_genlo.so
#3  0x000000341a417bd7 in osl_thread_start_Impl () from /usr/lib64/libreoffice/program/../ure-link/lib/libuno_sal.so.3
#4  0x0000003413007d15 in start_thread (arg=0x7fffda848700) at pthread_create.c:308
#5  0x00000034128f246d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:114

Thread 5 (Thread 0x7fffe8e8f700 (LWP 12580)):
#0  0x00000034128e998d in poll () at ../sysdeps/unix/syscall-template.S:81
#1  0x00007fffeec0eab6 in ICEConnectionWorker () from /usr/lib64/libreoffice/program/libvclplug_genlo.so
#2  0x000000341a417bd7 in osl_thread_start_Impl () from /usr/lib64/libreoffice/program/../ure-link/lib/libuno_sal.so.3
#3  0x0000003413007d15 in start_thread (arg=0x7fffe8e8f700) at pthread_create.c:308
#4  0x00000034128f246d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:114

Thread 4 (Thread 0x7fffeb3ae700 (LWP 12579)):
#0  0x00000034128f312d in accept () at ../sysdeps/unix/syscall-template.S:81
#1  0x000000341a412150 in osl_acceptPipe () from /usr/lib64/libreoffice/program/../ure-link/lib/libuno_sal.so.3
#2  0x0000003426e468aa in desktop::OfficeIPCThread::execute() () from /usr/lib64/libreoffice/program/libsofficeapp.so
#3  0x0000003419803d76 in salhelper::Thread::run() () from /usr/lib64/libreoffice/program/../ure-link/lib/libuno_salhelpergcc3.so.3
#4  0x0000003419803fea in threadFunc () from /usr/lib64/libreoffice/program/../ure-link/lib/libuno_salhelpergcc3.so.3
#5  0x000000341a417bd7 in osl_thread_start_Impl () from /usr/lib64/libreoffice/program/../ure-link/lib/libuno_sal.so.3
#6  0x0000003413007d15 in start_thread (arg=0x7fffeb3ae700) at pthread_create.c:308
#7  0x00000034128f246d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:114

Thread 2 (Thread 0x7ffff1bbc700 (LWP 12575)):
#0  pthread_cond_timedwait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:217
#1  0x000000341a41df09 in rtl_cache_wsupdate_all(void*) () from /usr/lib64/libreoffice/program/../ure-link/lib/libuno_sal.so.3
#2  0x0000003413007d15 in start_thread (arg=0x7ffff1bbc700) at pthread_create.c:308
#3  0x00000034128f246d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:114

Thread 1 (Thread 0x7ffff7fad980 (LWP 12571)):
#0  0x0000003424e5d475 in SfxItemPool::Remove(SfxPoolItem const&) () from /usr/lib64/libreoffice/program/libsvllo.so
#1  0x00007fffdb028fcc in CharAttribList::OptimizeRanges(SfxItemPool&) () from /usr/lib64/libreoffice/program/../program/libeditenglo.so
#2  0x00007fffdb08385b in ImpEditEngine::GetAttribs(unsigned short, unsigned short, unsigned short, unsigned char) const () from /usr/lib64/libreoffice/program/../program/libeditenglo.so
#3  0x00007fffdb02f25b in EditEngine::GetAttribs(unsigned short, unsigned short, unsigned short, unsigned char) const () from /usr/lib64/libreoffice/program/../program/libeditenglo.so
#4  0x00007fffdb0ffdd7 in SvxOutlinerForwarder::GetAttribs(ESelection const&, unsigned char) const () from /usr/lib64/libreoffice/program/../program/libeditenglo.so
#5  0x00007fffdb10d16d in SvxUnoTextRangeBase::_setPropertyValues(com::sun::star::uno::Sequence<rtl::OUString> const&, com::sun::star::uno::Sequence<com::sun::star::uno::Any> const&, int) () from /usr/lib64/libreoffice/program/../program/libeditenglo.so
#6  0x000000342966100e in SvXMLImportPropertyMapper::_FillMultiPropertySet(std::vector<XMLPropertyState, std::allocator<XMLPropertyState> > const&, com::sun::star::uno::Reference<com::sun::star::beans::XMultiPropertySet> const&, com::sun::star::uno::Reference<com::sun::star::beans::XPropertySetInfo> const&, UniReference<XMLPropertySetMapper> const&, _ContextID_Index_Pair*) () from /usr/lib64/libreoffice/program/../program/libxolo.so
#7  0x00000034296612e4 in SvXMLImportPropertyMapper::FillPropertySet(std::vector<XMLPropertyState, std::allocator<XMLPropertyState> > const&, com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet>, _ContextID_Index_Pair*) const () from /usr/lib64/libreoffice/program/../program/libxolo.so
#8  0x000000342972f9ac in XMLTextStyleContext::FillPropertySet(com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> const&) () from /usr/lib64/libreoffice/program/../program/libxolo.so
#9  0x00000034296f9717 in XMLTextImportHelper::SetStyleAndAttrs(SvXMLImport&, com::sun::star::uno::Reference<com::sun::star::text::XTextCursor> const&, rtl::OUString const&, unsigned char, unsigned char, signed char, unsigned char) () from /usr/lib64/libreoffice/program/../program/libxolo.so
#10 0x000000342972531b in XMLParaContext::~XMLParaContext() () from /usr/lib64/libreoffice/program/../program/libxolo.so
#11 0x0000003429726239 in XMLParaContext::~XMLParaContext() () from /usr/lib64/libreoffice/program/../program/libxolo.so
#12 0x00000034295288c3 in SvXMLImport::endElement(rtl::OUString const&) () from /usr/lib64/libreoffice/program/../program/libxolo.so
#13 0x00007fffda86612d in sax_expatwrap::SaxExpatParser_Impl::callbackEndElement(void*, char const*) () from /usr/lib64/libreoffice/program/../program/expwrap.uno.so
#14 0x000000341a0087b0 in doContent (parser=parser@entry=0x1a81fd0, startTagLevel=startTagLevel@entry=0, enc=0x341a226800 <utf8_encoding>, s=0x1764ee1 "</text:p></draw:text-box></draw:frame><presentation:notes draw:style-name=\"dp2\"><office:forms form:automatic-focus=\"false\" form:apply-design-mode=\"false\"/><draw:page-thumbnail draw:style-name=\"gr3\" dr"..., end=0x1766888 "ot ship an interim solution in 7.0 that we will regret in the future. </text:p></text:list-item></text:list></text:list-item><text:li", 'u' <repeats 67 times>..., nextPtr=0x1a82000, haveMore=1 '\001') at lib/xmlparse.c:2532
#15 0x000000341a00972e in contentProcessor (parser=0x1a81fd0, start=<optimized out>, end=<optimized out>, endPtr=<optimized out>) at lib/xmlparse.c:2105
#16 0x000000341a00da3d in XML_ParseBuffer (parser=0x1a81fd0, len=<optimized out>, isFinal=0) at lib/xmlparse.c:1651
#17 0x00007fffda8649d6 in sax_expatwrap::SaxExpatParser_Impl::parse() () from /usr/lib64/libreoffice/program/../program/expwrap.uno.so
#18 0x00007fffda8687ae in sax_expatwrap::SaxExpatParser::parseStream(com::sun::star::xml::sax::InputSource const&) () from /usr/lib64/libreoffice/program/../program/expwrap.uno.so
#19 0x00007fffd9a07334 in ReadThroughComponent(com::sun::star::uno::Reference<com::sun::star::io::XInputStream>, com::sun::star::uno::Reference<com::sun::star::lang::XComponent>, String const&, com::sun::star::uno::Reference<com::sun::star::lang::XMultiServiceFactory>&, char const*, com::sun::star::uno::Sequence<com::sun::star::uno::Any>, rtl::OUString const&, unsigned char, unsigned char) () from /usr/lib64/libreoffice/program/../program/libsdlo.so
#20 0x00007fffd9a07c18 in ReadThroughComponent(com::sun::star::uno::Reference<com::sun::star::embed::XStorage> const&, com::sun::star::uno::Reference<com::sun::star::lang::XComponent>, char const*, char const*, com::sun::star::uno::Reference<com::sun::star::lang::XMultiServiceFactory>&, char const*, com::sun::star::uno::Sequence<com::sun::star::uno::Any>, rtl::OUString const&, unsigned char) () from /usr/lib64/libreoffice/program/../program/libsdlo.so
#21 0x00007fffd9a09921 in SdXMLFilter::Import(unsigned long&) () from /usr/lib64/libreoffice/program/../program/libsdlo.so
#22 0x00007fffd9a8c382 in sd::DrawDocShell::Load(SfxMedium&) () from /usr/lib64/libreoffice/program/../program/libsdlo.so
#23 0x00000034264c211d in SfxObjectShell::LoadOwnFormat(SfxMedium&) () from /usr/lib64/libreoffice/program/libsfxlo.so
#24 0x00000034264cf00e in SfxObjectShell::DoLoad(SfxMedium*) () from /usr/lib64/libreoffice/program/libsfxlo.so
#25 0x0000003426511b7d in SfxBaseModel::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) () from /usr/lib64/libreoffice/program/libsfxlo.so
#26 0x000000342654a980 in SfxFrameLoader_Impl::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) () from /usr/lib64/libreoffice/program/libsfxlo.so
#27 0x00007fffe9ba2ab3 in framework::LoadEnv::impl_loadContent() () from /usr/lib64/libreoffice/program/../program/libfwklo.so
#28 0x00007fffe9ba3f08 in framework::LoadEnv::startLoading() () from /usr/lib64/libreoffice/program/../program/libfwklo.so
#29 0x00007fffe9b1ec6e in framework::LoadDispatcher::impl_dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XDispatchResultListener> const&) () from /usr/lib64/libreoffice/program/../program/libfwklo.so
#30 0x00007fffe9b1f158 in framework::LoadDispatcher::dispatchWithReturnValue(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) () from /usr/lib64/libreoffice/program/../program/libfwklo.so
#31 0x00000034238fed24 in comphelper::SynchronousDispatch::dispatch(com::sun::star::uno::Reference<com::sun::star::uno::XInterface> const&, rtl::OUString const&, rtl::OUString const&, int, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) () from /usr/lib64/libreoffice/program/libcomphelpgcc3.so
#32 0x0000003426e3baf0 in desktop::DispatchWatcher::executeDispatchRequests(std::vector<desktop::DispatchWatcher::DispatchRequest, std::allocator<desktop::DispatchWatcher::DispatchRequest> > const&, bool) () from /usr/lib64/libreoffice/program/libsofficeapp.so
#33 0x0000003426e49851 in desktop::OfficeIPCThread::ExecuteCmdLineRequests(desktop::ProcessDocumentsRequest&) () from /usr/lib64/libreoffice/program/libsofficeapp.so
#34 0x0000003426e1fa75 in desktop::Desktop::OpenClients() () from /usr/lib64/libreoffice/program/libsofficeapp.so
#35 0x0000003426e20cbc in desktop::Desktop::OpenClients_Impl(void*) () from /usr/lib64/libreoffice/program/libsofficeapp.so
#36 0x000000341c368a22 in ImplWindowFrameProc(Window*, SalFrame*, unsigned short, void const*) () from /usr/lib64/libreoffice/program/libvcllo.so
#37 0x000000341c37151c in SalGenericDisplay::DispatchInternalEvent() () from /usr/lib64/libreoffice/program/libvcllo.so
#38 0x00007ffff116b87f in GtkData::userEventFn(void*) () from /usr/lib64/libreoffice/program/libvclplug_gtklo.so
#39 0x00007ffff116b8f9 in call_userEventFn () from /usr/lib64/libreoffice/program/libvclplug_gtklo.so
#40 0x00007fffef0baa75 in g_main_dispatch (context=0x663130) at gmain.c:2715
#41 g_main_context_dispatch (context=context@entry=0x663130) at gmain.c:3219
#42 0x00007fffef0bada8 in g_main_context_iterate (context=context@entry=0x663130, block=block@entry=0, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3290
#43 0x00007fffef0bae64 in g_main_context_iteration (context=0x663130, may_block=0) at gmain.c:3351
#44 0x00007ffff116b611 in GtkData::Yield(bool, bool) () from /usr/lib64/libreoffice/program/libvclplug_gtklo.so
#45 0x000000341c0f76f4 in Application::Yield(bool) () from /usr/lib64/libreoffice/program/libvcllo.so
#46 0x000000341c0f7797 in Application::Execute() () from /usr/lib64/libreoffice/program/libvcllo.so
#47 0x0000003426e1e450 in desktop::Desktop::Main() () from /usr/lib64/libreoffice/program/libsofficeapp.so
#48 0x000000341c0ffba9 in ImplSVMain() () from /usr/lib64/libreoffice/program/libvcllo.so
#49 0x000000341c0ffc35 in SVMain() () from /usr/lib64/libreoffice/program/libvcllo.so
#50 0x0000003426e4ac35 in soffice_main () from /usr/lib64/libreoffice/program/libsofficeapp.so
#51 0x00000000004006fb in main ()
A debugging session is active.

	Inferior 1 [process 12571] will be killed.

Quit anyway? (y or n) [answered Y; input not from terminal]

Version-Release number of selected component (if applicable):

libreoffice-core-3.6.3.2-8.fc18.x86_64

How reproducible:

100%

Steps to Reproduce:
1. Open this odp that I unfortunately cannot post here
2. <boom>

Comment 1 David Tardon 2012-12-21 05:03:02 UTC

> Steps to Reproduce:
> 1. Open this odp that I unfortunately cannot post here

Can you mail it to me, then?

Comment 2 Bill Nottingham 2012-12-21 18:46:40 UTC

Sure, done.

Comment 3 David Tardon 2013-02-01 12:38:34 UTC

Does not crash for me, but valgrind shows an invalid read with the same stack.

Comment 4 Bill Nottingham 2013-02-01 17:16:18 UTC

Oh, duh, I just realized - I'm running with MALLOC_PERTURB_ and G_SLICE=debug-blocks set, which likely may affect the behavior.

Comment 5 David Tardon 2013-02-06 12:02:29 UTC

already fixed in 4.0 by Caolan :)

Comment 6 Caolan McNamara 2013-02-27 11:36:00 UTC

*** Bug 915763 has been marked as a duplicate of this bug. ***

Comment 7 Fedora Update System 2013-02-27 19:46:36 UTC

libreoffice-3.6.5.2-5.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/libreoffice-3.6.5.2-5.fc18

Comment 8 Caolan McNamara 2013-02-28 15:34:43 UTC

*** Bug 901734 has been marked as a duplicate of this bug. ***

Comment 9 Fedora Update System 2013-03-02 20:19:28 UTC

Package libreoffice-3.6.5.2-5.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing libreoffice-3.6.5.2-5.fc18'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-3315/libreoffice-3.6.5.2-5.fc18
then log in and leave karma (feedback).

Comment 10 Fedora Update System 2013-03-05 23:21:34 UTC

libreoffice-3.6.5.2-5.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.