Bug 971288

Summary: [abrt] libreoffice-core-3.6.6.2-8.fc18: writerfilter::dmapper::DomainMapper_Impl::appendOLE: Process /usr/lib64/libreoffice/program/soffice.bin was killed by signal 11 (SIGSEGV)
Product: [Fedora] Fedora Reporter: Artem <artem.goncharov>
Component: libreofficeAssignee: Caolan McNamara <caolanm>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 18CC: artem.goncharov, caolanm, dtardon, erack, ltinkl, mstahl, sbergman
Target Milestone: ---Flags: artem.goncharov: needinfo+
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
Whiteboard: abrt_hash:fa65aff046d8b4fa4206596e14c37e6dcad299ee
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-10-08 12:29:39 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: backtrace
none
File: cgroup
none
File: core_backtrace
none
File: dso_list
none
File: environ
none
File: limits
none
File: maps
none
File: open_fds
none
File: proc_pid_status
none
File: var_log_messages none

Description Artem 2013-06-06 08:17:15 UTC
Description of problem:
Tried to open a word file (it is unfortunately private and I can't attach it). Crashed immediately not even showing up

Version-Release number of selected component:
libreoffice-core-3.6.6.2-8.fc18

Additional info:
reporter:       libreport-2.1.4
backtrace_rating: 4
cmdline:        /usr/lib64/libreoffice/program/soffice.bin --writer '/home/agoncharov/tmp/OPSC Gold BAS Database Design-SAD.D2.12.docx' --splash-pipe=6
crash_function: writerfilter::dmapper::DomainMapper_Impl::appendOLE
executable:     /usr/lib64/libreoffice/program/soffice.bin
kernel:         3.9.4-200.fc18.x86_64
runlevel:       N 5
uid:            1000
xsession_errors: 

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 writerfilter::dmapper::DomainMapper_Impl::appendOLE at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/dmapper/DomainMapper_Impl.cxx:1204
 #1 writerfilter::dmapper::DomainMapper::sprmWithProps at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/dmapper/DomainMapper.cxx:3209
 #2 writerfilter::dmapper::DomainMapper::lcl_sprm at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/dmapper/DomainMapper.cxx:1459
 #3 writerfilter::ooxml::OOXMLPropertyImpl::resolve at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx:184
 #4 writerfilter::ooxml::OOXMLPropertySetImpl::resolve at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx:438
 #5 writerfilter::dmapper::DomainMapper::lcl_props at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/dmapper/DomainMapper.cxx:3522
 #6 writerfilter::LoggedStream::props at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/resourcemodel/LoggedResources.cxx:220
 #7 writerfilter::ooxml::OOXMLFastContextHandler::sendPropertiesWithId at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/ooxml/OOXMLFastContextHandler.cxx:1029
 #8 writerfilter::ooxml::OOXMLFactory_wml::endAction at /usr/src/debug/libreoffice-3.6.6.2/workdir/unxlngx6.pro/CustomTarget/writerfilter/source/OOXMLFactory_wml.cxx:4641
 #9 writerfilter::ooxml::OOXMLFactory::endAction at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/ooxml/OOXMLFactory.cxx:335

Comment 1 Artem 2013-06-06 08:17:23 UTC
Created attachment 757539 [details]
File: backtrace

Comment 2 Artem 2013-06-06 08:17:27 UTC
Created attachment 757540 [details]
File: cgroup

Comment 3 Artem 2013-06-06 08:17:32 UTC
Created attachment 757541 [details]
File: core_backtrace

Comment 4 Artem 2013-06-06 08:17:36 UTC
Created attachment 757542 [details]
File: dso_list

Comment 5 Artem 2013-06-06 08:17:40 UTC
Created attachment 757543 [details]
File: environ

Comment 6 Artem 2013-06-06 08:17:43 UTC
Created attachment 757544 [details]
File: limits

Comment 7 Artem 2013-06-06 08:17:47 UTC
Created attachment 757545 [details]
File: maps

Comment 8 Artem 2013-06-06 08:17:50 UTC
Created attachment 757546 [details]
File: open_fds

Comment 9 Artem 2013-06-06 08:17:54 UTC
Created attachment 757547 [details]
File: proc_pid_status

Comment 10 Artem 2013-06-06 08:17:57 UTC
Created attachment 757548 [details]
File: var_log_messages

Comment 11 David Tardon 2013-06-10 08:42:18 UTC
The code is:

m_aAnchoredStack.top( ).bToRemove = true; // <-- this line crashes
RemoveLastParagraph();
m_aTextAppendStack.pop();

It looks to me like this might happen if there is an OLE object without a replacement shape. (Btw, the two following lines look suspicious to me too, as that is what happens in DomainMapper_Impl::PopShapeContext if m_aTextAppendStack.top().bToRemove == true . But I do not really understand that code, so I cannot tell without a sample document.)

dtardon->artem: Could you mail the docx to me or Caolan?

Comment 12 Michael Stahl 2013-06-10 10:12:19 UTC
master commit 344e4a25eac6505678f4ce8a6c1c8cef83c68276 looks like it could fix this... but to be sure it's really the same problem the crashing document is needed.

Comment 13 Artem 2013-06-10 18:09:07 UTC
sample provided to Caolan

Comment 14 Caolan McNamara 2013-10-08 12:29:39 UTC
confirmed works ok now in f19