Bug 2122948 - Reproducible crash in Writer
Summary: Reproducible crash in Writer
Keywords:
Status: CLOSED UPSTREAM
Alias: None
Product: Fedora
Classification: Fedora
Component: libreoffice
Version: 36
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Stephan Bergmann
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-08-31 11:52 UTC by Jan Kratochvil
Modified: 2023-05-15 12:46 UTC (History)
5 users (show)

Fixed In Version: libreoffice-7.3.6.2-2.fc36
Clone Of:
Environment:
Last Closed: 2023-05-15 12:46:39 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
core.3329743.odt (28.25 KB, application/vnd.oasis.opendocument.text)
2022-08-31 11:52 UTC, Jan Kratochvil
no flags Details
crash dialog (50.95 KB, image/png)
2022-08-31 11:52 UTC, Jan Kratochvil
no flags Details
core.3329743.xz (13.64 MB, application/octet-stream)
2022-08-31 11:54 UTC, Jan Kratochvil
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Document Foundation 155323 0 None None None 2023-05-15 12:46:39 UTC

Description Jan Kratochvil 2022-08-31 11:52:26 UTC
Created attachment 1908657 [details]
core.3329743.odt

Description of problem:
It always crashes when doing a specific operation with ODT file.

Version-Release number of selected component (if applicable):
libreoffice-writer-7.3.4.2-4.fc36.x86_64

How reproducible:
Always.

Steps to Reproduce:
1. ooffice core.3329743.odt
2. Select line "Další podrobnosti o prodávaném vozidle (parametry, výbava, příslušenství):" incl. 6 next dash-empty lines.
3. Delete them by delete+backspace.
4. Type CTRL-S.

Actual results:
Crash dialog (attached).

Expected results:
No crash.

Additional info:

Comment 1 Jan Kratochvil 2022-08-31 11:52:53 UTC
Created attachment 1908658 [details]
crash dialog

Comment 2 Jan Kratochvil 2022-08-31 11:54:19 UTC
Created attachment 1908659 [details]
core.3329743.xz

Comment 3 Jan Kratochvil 2022-08-31 11:56:11 UTC
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
#1  0x00007f535628ecb3 in __pthread_kill_internal (signo=6, threadid=<optimized out>) at pthread_kill.c:78
#2  0x00007f535623e9c6 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#3  0x00007f53562287f4 in __GI_abort () at abort.c:79
#4  0x00007f53566bd70f in (anonymous namespace)::signalHandlerFunction (signal=11, info=0x7ffe9f55cbb0, context=0x7ffe9f55ca80) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sal/osl/unx/signal.cxx:438
#5  <signal handler called>
#6  0x00007f532ca558ce in sw::mark::FindFieldSep (rMark=...) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sw/source/core/crsr/bookmark.cxx:59
#7  0x00007f532ce205e0 in (anonymous namespace)::HideIterator::Next (this=0x7ffe9f55d960) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sw/source/core/text/redlnitr.cxx:158
#8  sw::CheckParaRedlineMerge (rFrame=..., rTextNode=..., eMode=sw::FrameMode::New) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sw/source/core/text/redlnitr.cxx:226
#9  0x00007f532ce2916d in SwTextFrame::SwTextFrame (this=<optimized out>, pNode=<optimized out>, pSib=<optimized out>, eMode=<optimized out>, this=<optimized out>, pNode=<optimized out>, pSib=<optimized out>, eMode=<optimized out>) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sw/source/core/text/txtfrm.cxx:794
#10 0x00007f532ce65f7b in sw::MakeTextFrame (eMode=sw::FrameMode::New, pSibling=0x562b704cc7e0, rNode=...) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sw/source/core/text/txtfrm.cxx:802
#11 SwTextNode::MakeFrame (this=0x562b7383cbf0, pSib=0x562b704cc7e0) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sw/source/core/txtnode/ndtxt.cxx:274
#12 0x00007f532cbf8aa9 in SwContentNode::MakeFramesForAdjacentContentNode (this=<optimized out>, rNode=...) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sw/source/core/docnode/node.cxx:1384
#13 0x00007f532cbf982d in SwNodes::ChgNode (this=0x562b70000910, rDelPos=..., nSz=..., rInsPos=SwNodeIndex (node 142), bNewFrames=true) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sw/source/core/docnode/nodes.cxx:386
#14 0x00007f532cc0672a in SwNodes::MoveNodes (this=0x562b70000910, aRange=..., rNodes=..., aIndex=..., bNewFrames=true) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sw/source/core/docnode/nodes.cxx:868
#15 0x00007f532cc07a01 in SwNodes::MoveRange (this=0x562b70000910, rPam=SwPaM = {...}, rPos=SwPosition (node 142, offset 0), rNodes=...) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sw/source/core/docnode/nodes.cxx:1635
#16 0x00007f532cb4a6c4 in sw::DocumentContentOperationsManager::MoveRange (this=0x562b700137d0, rPaM=SwPaM = {...}, rPos=SwPosition (node 142, offset 0), eMvFlags=<optimized out>) at /usr/include/c++/12/bits/unique_ptr.h:445
#17 0x00007f532cb240ee in SwRangeRedline::MoveFromSection (this=0x562b737a7550, nMyPos=<optimized out>) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sw/source/core/doc/docredln.cxx:1785
#18 0x00007f532cb10855 in SwRangeRedline::Show (this=0x562b737a7550, nLoop=<optimized out>, nMyPos=31, bForced=<optimized out>) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sw/source/core/doc/docredln.cxx:1257
#19 0x00007f532cb568db in sw::DocumentRedlineManager::SetRedlineFlags (this=0x562b70010ac0, eMode=49) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sw/source/core/doc/DocumentRedlineManager.cxx:1134
#20 0x00007f532d11d20f in SwXMLWriter::Write_ (this=0x562b6ffe94e0, pMediumItemSet=<optimized out>) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sw/source/filter/xml/wrtxml.cxx:438
#21 0x00007f532d102d85 in SwXMLWriter::WriteMedium (aTargetMedium=..., this=0x562b6ffe94e0) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sw/source/filter/xml/wrtxml.cxx:473
#22 StgWriter::Write (this=this@entry=0x562b6ffe94e0, rPaM=warning: RTTI symbol not found for class 'SwUnoCursor [clone .lto_priv.0]'
warning: RTTI symbol not found for class 'SwUnoCursor [clone .lto_priv.0]'
warning: RTTI symbol not found for class 'SwUnoCursor [clone .lto_priv.0]'
warning: RTTI symbol not found for class 'SwUnoCursor [clone .lto_priv.0]'
warning: RTTI symbol not found for class 'SwUnoCursor [clone .lto_priv.0]'
SwPaM = {...}, rStg=uno::Reference to (OStorage *) 0x562b70176d08, pFName=pFName@entry=0x0, pMedium=pMedium@entry=0x562b73801970) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sw/source/filter/writer/writer.cxx:529
#23 0x00007f532d115893 in SwXMLWriter::Write (this=0x562b6ffe94e0, rPaM=warning: RTTI symbol not found for class 'SwUnoCursor [clone .lto_priv.0]'
warning: RTTI symbol not found for class 'SwUnoCursor [clone .lto_priv.0]'
warning: RTTI symbol not found for class 'SwUnoCursor [clone .lto_priv.0]'
warning: RTTI symbol not found for class 'SwUnoCursor [clone .lto_priv.0]'
warning: RTTI symbol not found for class 'SwUnoCursor [clone .lto_priv.0]'
SwPaM = {...}, rMed=..., pFileName=0x0) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sw/source/filter/xml/wrtxml.cxx:480
#24 0x00007f532d084482 in SwWriter::Write (this=0x7ffe9f55f0f0, rxWriter=..., pRealFileName=0x0) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sw/source/filter/basflt/shellio.cxx:860
#25 0x00007f532d15a8a0 in SwDocShell::SaveAs (this=0x562b6ffb9a30, rMedium=...) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sw/source/uibase/app/docsh.cxx:548
#26 0x00007f5354d39940 in SfxObjectShell::SaveAsOwnFormat (this=0x562b6ffb9a30, rMedium=...) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sfx2/source/doc/objstor.cxx:3176
#27 0x00007f5354d364fd in SfxObjectShell::SaveTo_Impl (this=0x562b6ffb9a30, rMedium=..., pSet=<optimized out>) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sfx2/source/doc/objstor.cxx:1444
#28 0x00007f5354d3e468 in SfxObjectShell::DoSave_Impl (pArgs=0x7ffe9f55f6b0, this=0x562b6ffb9a30) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sfx2/source/doc/objstor.cxx:2584
#29 SfxObjectShell::Save_Impl (this=0x562b6ffb9a30, pSet=0x7ffe9f55f6b0) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sfx2/source/doc/objstor.cxx:2654
#30 0x00007f5354d5d665 in SfxBaseModel::storeSelf (this=0x562b6d586400, aSeqArgs=...) at /usr/include/c++/12/optional:306
#31 0x00007f5354e2fd3e in SfxStoringHelper::GUIStoreModel(com::sun::star::uno::Reference<com::sun::star::frame::XModel> const&, std::basic_string_view<char16_t, std::char_traits<char16_t> >, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue>&, bool, SignatureState) [clone .isra.0] (this=this@entry=0x7ffe9f55fba0, xModel=uno::Reference to (SwXTextDocument *) 0x562b6d586490, aSlotName=..., aArgsSequence=uno::Sequence of length 2 = {...}, bPreselectPassword=<optimized out>, nDocumentSignatureState=SignatureState::NOSIGNATURES) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sfx2/source/doc/guisaveas.cxx:1423
#32 0x00007f5354d235c7 in SfxObjectShell::ExecFile_Impl (this=0x562b6ffb9a30, rReq=...) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sfx2/source/doc/objserv.cxx:969
#33 0x00007f5354bef14d in SfxDispatcher::Call_Impl (this=0x562b703fef60, rShell=..., rSlot=..., rReq=..., bRecord=<optimized out>) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sfx2/source/control/dispatch.cxx:253
#34 0x00007f5354bf2bfb in SfxDispatcher::PostMsgHandler (this=0x562b703fef60, pReq=...) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sfx2/source/control/dispatch.cxx:989
#35 0x00007f5354bf02f8 in std::__invoke_impl<void, void (SfxDispatcher::*&)(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >), SfxDispatcher*&, std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> > > (__f=<optimized out>, __t=<optimized out>) at /usr/include/c++/12/bits/invoke.h:74
#36 std::__invoke<void (SfxDispatcher::*&)(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >), SfxDispatcher*&, std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> > > (__fn=<optimized out>) at /usr/include/c++/12/bits/invoke.h:96
#37 std::_Bind<void (SfxDispatcher::*(SfxDispatcher*, std::_Placeholder<1>))(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >)>::__call<void, std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >&&, 0ul, 1ul>(std::tuple<std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >&&>&&, std::_Index_tuple<0ul, 1ul>) (__args=..., this=<optimized out>) at /usr/include/c++/12/functional:484
#38 std::_Bind<void (SfxDispatcher::*(SfxDispatcher*, std::_Placeholder<1>))(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >)>::operator()<std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >, void>(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >&&) (this=<optimized out>) at /usr/include/c++/12/functional:567
#39 std::__invoke_impl<void, std::_Bind<void (SfxDispatcher::*(SfxDispatcher*, std::_Placeholder<1>))(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >)>&, std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> > >(std::__invoke_other, std::_Bind<void (SfxDispatcher::*(SfxDispatcher*, std::_Placeholder<1>))(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >)>&, std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >&&) (__f=...) at /usr/include/c++/12/bits/invoke.h:61
#40 std::__invoke_r<void, std::_Bind<void (SfxDispatcher::*(SfxDispatcher*, std::_Placeholder<1>))(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >)>&, std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> > >(std::_Bind<void (SfxDispatcher::*(SfxDispatcher*, std::_Placeholder<1>))(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >)>&, std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >&&) (__fn=...) at /usr/include/c++/12/bits/invoke.h:111
#41 std::_Function_handler<void (std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >), std::_Bind<void (SfxDispatcher::*(SfxDispatcher*, std::_Placeholder<1>))(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >)> >::_M_invoke(std::_Any_data const&, std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >&&) (__functor=..., __args#0=...) at /usr/include/c++/12/bits/std_function.h:290
#42 0x00007f5354d90fd5 in std::function<void (std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >)>::operator()(std::unique_ptr<SfxRequest, std::default_delete<SfxRequest> >) const (__args#0=std::unique_ptr<SfxRequest> = {...}, this=0x562b70abcae0) at /usr/include/c++/12/bits/std_function.h:591
#43 SfxHintPoster::DoEvent_Impl (pPostedHint=<optimized out>, this=0x562b70abcad0) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sfx2/source/notify/hintpost.cxx:42
#44 SfxHintPoster::LinkStubDoEvent_Impl (instance=0x562b70abcad0, data=<optimized out>) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/sfx2/source/notify/hintpost.cxx:38
#45 0x00007f5352827358 in Link<void*, void>::Call (data=<optimized out>, this=0x562b72338d98) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/include/tools/link.hxx:111
#46 ImplHandleUserEvent (pSVEvent=0x562b72338d90) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/vcl/source/window/winproc.cxx:2014
#47 ImplWindowFrameProc (_pWindow=<optimized out>, nEvent=SalEvent::UserEvent, pEvent=0x562b72338d90) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/vcl/source/window/winproc.cxx:2584
#48 0x00007f5352a878e9 in operator() (__closure=<synthetic pointer>) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/vcl/source/app/salusereventlist.cxx:119
#49 SalUserEventList::DispatchUserEvents (this=0x562b6cdae690, bHandleAllCurrentEvents=false) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/vcl/source/app/salusereventlist.cxx:120
#50 0x00007f533fef04bd in call_userEventFn (data=data@entry=0x562b6bea5610) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/vcl/unx/gtk3/gtkdata.cxx:808
#51 0x00007f534f5024cb in g_idle_dispatch (source=0x562b724b46a0, callback=0x7f533fef0480 <call_userEventFn(void*)>, user_data=0x562b6bea5610) at ../glib/gmain.c:5935
#52 0x00007f534f505faf in g_main_dispatch (context=0x562b6bfd11a0) at ../glib/gmain.c:3417
#53 g_main_context_dispatch (context=0x562b6bfd11a0) at ../glib/gmain.c:4135
#54 0x00007f534f55b2c8 in g_main_context_iterate.constprop.0 (context=context@entry=0x562b6bfd11a0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:4211
#55 0x00007f534f503940 in g_main_context_iteration (context=0x562b6bfd11a0, may_block=1) at ../glib/gmain.c:4276
#56 0x00007f533fef35fb in GtkSalData::Yield (bHandleAllCurrentEvents=<optimized out>, bWait=<optimized out>, this=0x562b6bea5610) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/vcl/unx/gtk3/gtkdata.cxx:405
#57 GtkInstance::DoYield (this=<optimized out>, bWait=true, bHandleAllCurrentEvents=<optimized out>) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/vcl/unx/gtk3/gtkinst.cxx:425
#58 0x00007f5352ac9212 in ImplYield (i_bWait=i_bWait@entry=true, i_bAllEvents=i_bAllEvents@entry=false) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/vcl/source/app/svapp.cxx:465
#59 0x00007f5352ac9270 in Application::Yield () at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/vcl/source/app/svapp.cxx:532
#60 0x00007f5352acf7f5 in Application::Execute () at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/vcl/source/app/svapp.cxx:444
#61 0x00007f53565e3acb in desktop::Desktop::Main (this=<optimized out>) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/desktop/source/app/app.cxx:1599
#62 0x00007f5352ada47a in ImplSVMain () at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/vcl/source/app/svmain.cxx:199
#63 0x00007f53565fa3d3 in soffice_main () at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/desktop/source/app/sofficemain.cxx:98
#64 0x0000562b6b32d0bf in sal_main () at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/desktop/source/app/main.c:49
#65 main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/libreoffice-7.3.4.2-4.fc36.x86_64/desktop/source/app/main.c:47

Comment 4 Jan Kratochvil 2022-08-31 11:56:32 UTC
(soffice:3349483): GLib-GObject-WARNING **: 13:49:01.482: invalid cast from 'GtkBox' to 'GtkMenuShell'
(soffice:3349483): GLib-GObject-WARNING **: 13:49:01.482: invalid cast from 'GtkBox' to 'GtkMenuShell'
Fatal exception: Signal 11
Stack:
/usr/lib64/libreoffice/program/libuno_sal.so.3(+0x3a522)[0x7f80ab693522]
/usr/lib64/libreoffice/program/libuno_sal.so.3(+0x3a70a)[0x7f80ab69370a]
/lib64/libc.so.6(+0x3ea70)[0x7f80ab23ea70]
/usr/lib64/libreoffice/program/../program/libswlo.so(+0x4558ce)[0x7f80816558ce]
/usr/lib64/libreoffice/program/../program/libswlo.so(+0x8205e0)[0x7f8081a205e0]
/usr/lib64/libreoffice/program/../program/libswlo.so(_ZN11SwTextFrameC1EP10SwTextNodeP7SwFrameN2sw9FrameModeE+0xed)[0x7f8081a2916d]
/usr/lib64/libreoffice/program/../program/libswlo.so(_ZN10SwTextNode9MakeFrameEP7SwFrame+0x2b)[0x7f8081a65f7b]
/usr/lib64/libreoffice/program/../program/libswlo.so(_ZN13SwContentNode32MakeFramesForAdjacentContentNodeERS_+0xc9)[0x7f80817f8aa9]
/usr/lib64/libreoffice/program/../program/libswlo.so(_ZN7SwNodes7ChgNodeERK11SwNodeIndexN4o3tl10strong_intIi16Tag_SwNodeOffsetEERS0_b+0xc7d)[0x7f80817f982d]
/usr/lib64/libreoffice/program/../program/libswlo.so(_ZN7SwNodes9MoveNodesERK11SwNodeRangeRS_RK11SwNodeIndexb+0x1ada)[0x7f808180672a]
/usr/lib64/libreoffice/program/../program/libswlo.so(_ZN7SwNodes9MoveRangeER5SwPaMR10SwPositionRS_+0x501)[0x7f8081807a01]
/usr/lib64/libreoffice/program/../program/libswlo.so(+0x54a6c4)[0x7f808174a6c4]
/usr/lib64/libreoffice/program/../program/libswlo.so(_ZN14SwRangeRedline15MoveFromSectionEm+0x55e)[0x7f80817240ee]
/usr/lib64/libreoffice/program/../program/libswlo.so(_ZN14SwRangeRedline4ShowEtmb+0x2d5)[0x7f8081710855]
/usr/lib64/libreoffice/program/../program/libswlo.so(+0x5568db)[0x7f80817568db]
/usr/lib64/libreoffice/program/../program/libswlo.so(+0xb1d20f)[0x7f8081d1d20f]
/usr/lib64/libreoffice/program/../program/libswlo.so(_ZN9StgWriter5WriteER5SwPaMRKN3com3sun4star3uno9ReferenceINS4_5embed8XStorageEEEPKN3rtl8OUStringEP9SfxMedium+0x285)[0x7f8081d02d85]
/usr/lib64/libreoffice/program/../program/libswlo.so(+0xb15893)[0x7f8081d15893]
/usr/lib64/libreoffice/program/../program/libswlo.so(_ZN8SwWriter5WriteERKN5tools5SvRefI6WriterEEPKN3rtl8OUStringE+0x242)[0x7f8081c84482]
/usr/lib64/libreoffice/program/../program/libswlo.so(+0xb5a8a0)[0x7f8081d5a8a0]
/usr/lib64/libreoffice/program/libsfxlo.so(_ZN14SfxObjectShell15SaveAsOwnFormatER9SfxMedium+0x110)[0x7f80a9d39940]
/usr/lib64/libreoffice/program/libsfxlo.so(+0x3364fd)[0x7f80a9d364fd]
/usr/lib64/libreoffice/program/libsfxlo.so(+0x33e468)[0x7f80a9d3e468]
/usr/lib64/libreoffice/program/libsfxlo.so(_ZN12SfxBaseModel9storeSelfERKN3com3sun4star3uno8SequenceINS2_5beans13PropertyValueEEE+0x895)[0x7f80a9d5d665]
/usr/lib64/libreoffice/program/libsfxlo.so(+0x42fd3e)[0x7f80a9e2fd3e]
/usr/lib64/libreoffice/program/libsfxlo.so(+0x3235c7)[0x7f80a9d235c7]
/usr/lib64/libreoffice/program/libsfxlo.so(+0x1ef14d)[0x7f80a9bef14d]
/usr/lib64/libreoffice/program/libsfxlo.so(_ZN13SfxDispatcher14PostMsgHandlerESt10unique_ptrI10SfxRequestSt14default_deleteIS1_EE+0x1ab)[0x7f80a9bf2bfb]
/usr/lib64/libreoffice/program/libsfxlo.so(+0x1f02f8)[0x7f80a9bf02f8]
/usr/lib64/libreoffice/program/libsfxlo.so(+0x390fd5)[0x7f80a9d90fd5]
/usr/lib64/libreoffice/program/libvcllo.so(+0x427358)[0x7f80a7827358]
/usr/lib64/libreoffice/program/libvcllo.so(_ZN16SalUserEventList18DispatchUserEventsEb+0x199)[0x7f80a7a878e9]
/usr/lib64/libreoffice/program/libvclplug_gtk3lo.so(+0xf04bd)[0x7f8094ef04bd]
/lib64/libglib-2.0.so.0(+0x514cb)[0x7f80a45024cb]
/lib64/libglib-2.0.so.0(g_main_context_dispatch+0x19f)[0x7f80a4505faf]
/lib64/libglib-2.0.so.0(+0xaa2c8)[0x7f80a455b2c8]
/lib64/libglib-2.0.so.0(g_main_context_iteration+0x30)[0x7f80a4503940]
/usr/lib64/libreoffice/program/libvclplug_gtk3lo.so(+0xf35fb)[0x7f8094ef35fb]
/usr/lib64/libreoffice/program/libvcllo.so(+0x6c9212)[0x7f80a7ac9212]
/usr/lib64/libreoffice/program/libvcllo.so(_ZN11Application7ExecuteEv+0x45)[0x7f80a7acf7f5]
/usr/lib64/libreoffice/program/libsofficeapp.so(+0x3eacb)[0x7f80ab5b9acb]
/usr/lib64/libreoffice/program/libvcllo.so(_Z10ImplSVMainv+0x36a)[0x7f80a7ada47a]
/usr/lib64/libreoffice/program/libsofficeapp.so(soffice_main+0x183)[0x7f80ab5d03d3]
/usr/lib64/libreoffice/program/soffice.bin(+0x10bf)[0x562d430f60bf]
/lib64/libc.so.6(+0x29550)[0x7f80ab229550]
/lib64/libc.so.6(__libc_start_main+0x89)[0x7f80ab229609]
/usr/lib64/libreoffice/program/soffice.bin(+0x10f5)[0x562d430f60f5]

Comment 5 Caolan McNamara 2022-09-01 13:30:22 UTC
possibly worse is that in trunk I can't open it due to a parse exception, will have to bisect that first

Comment 6 Caolan McNamara 2022-09-01 13:36:47 UTC
bisected that new problem to https://gerrit.libreoffice.org/c/core/+/136513

Comment 7 Jan Kratochvil 2022-09-01 13:56:43 UTC
Two bugs are worse than the one I expected. Still thanks for the progress.

Comment 8 Caolan McNamara 2022-09-23 19:30:24 UTC
https://gerrit.libreoffice.org/c/core/+/140523

Comment 9 Fedora Update System 2022-09-24 08:59:10 UTC
FEDORA-2022-85dea40aed has been submitted as an update to Fedora 36. https://bodhi.fedoraproject.org/updates/FEDORA-2022-85dea40aed

Comment 10 Fedora Update System 2022-09-25 01:51:11 UTC
FEDORA-2022-85dea40aed has been pushed to the Fedora 36 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2022-85dea40aed`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2022-85dea40aed

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 11 Jan Kratochvil 2022-09-25 06:40:54 UTC
The Comment 0 reproducer is still crashing the same way: libreoffice-writer-7.3.6.2-2.fc36.x86_64

Comment 12 Fedora Update System 2022-09-26 01:48:12 UTC
FEDORA-2022-85dea40aed has been pushed to the Fedora 36 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 13 Jan Kratochvil 2022-09-26 05:47:25 UTC
The Comment 0 reproducer is still crashing the same way: libreoffice-writer-7.3.6.2-2.fc36.x86_64

Comment 14 Ben Cotton 2023-04-25 18:25:14 UTC
This message is a reminder that Fedora Linux 36 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 36 on 2023-05-16.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '36'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, change the 'version' 
to a later Fedora Linux version. Note that the version field may be hidden.
Click the "Show advanced fields" button if you do not see it.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora Linux 36 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora Linux, you are encouraged to change the 'version' to a later version
prior to this bug being closed.

Comment 15 Fedora Admin user for bugzilla script actions 2023-05-13 00:09:35 UTC
This package has changed maintainer in Fedora. Reassigning to the new maintainer of this component.

Comment 16 Jan Kratochvil 2023-05-13 01:32:37 UTC
The Comment 0 reproducer is still crashing the same way: libreoffice-writer-7.3.7.2-2.fc36.x86_64


Note You need to log in before you can comment on or make changes to this bug.