Bug 971288 - [abrt] libreoffice-core-3.6.6.2-8.fc18: writerfilter::dmapper::DomainMapper_Impl::appendOLE: Process /usr/lib64/libreoffice/program/soffice.bin was killed by signal 11 (SIGSEGV)
[abrt] libreoffice-core-3.6.6.2-8.fc18: writerfilter::dmapper::DomainMapper_I...
Status: CLOSED CURRENTRELEASE
Product: Fedora
Classification: Fedora
Component: libreoffice (Show other bugs)
18
x86_64 Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Caolan McNamara
Fedora Extras Quality Assurance
abrt_hash:fa65aff046d8b4fa4206596e14c...
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-06-06 04:17 EDT by Artem
Modified: 2013-10-08 08:29 EDT (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-10-08 08:29:39 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
artem.goncharov: needinfo+


Attachments (Terms of Use)
File: backtrace (133.84 KB, text/plain)
2013-06-06 04:17 EDT, Artem
no flags Details
File: cgroup (133 bytes, text/plain)
2013-06-06 04:17 EDT, Artem
no flags Details
File: core_backtrace (13.53 KB, text/plain)
2013-06-06 04:17 EDT, Artem
no flags Details
File: dso_list (23.17 KB, text/plain)
2013-06-06 04:17 EDT, Artem
no flags Details
File: environ (2.35 KB, text/plain)
2013-06-06 04:17 EDT, Artem
no flags Details
File: limits (1.29 KB, text/plain)
2013-06-06 04:17 EDT, Artem
no flags Details
File: maps (105.77 KB, text/plain)
2013-06-06 04:17 EDT, Artem
no flags Details
File: open_fds (923 bytes, text/plain)
2013-06-06 04:17 EDT, Artem
no flags Details
File: proc_pid_status (940 bytes, text/plain)
2013-06-06 04:17 EDT, Artem
no flags Details
File: var_log_messages (362 bytes, text/plain)
2013-06-06 04:17 EDT, Artem
no flags Details

  None (edit)
Description Artem 2013-06-06 04:17:15 EDT
Description of problem:
Tried to open a word file (it is unfortunately private and I can't attach it). Crashed immediately not even showing up

Version-Release number of selected component:
libreoffice-core-3.6.6.2-8.fc18

Additional info:
reporter:       libreport-2.1.4
backtrace_rating: 4
cmdline:        /usr/lib64/libreoffice/program/soffice.bin --writer '/home/agoncharov/tmp/OPSC Gold BAS Database Design-SAD.D2.12.docx' --splash-pipe=6
crash_function: writerfilter::dmapper::DomainMapper_Impl::appendOLE
executable:     /usr/lib64/libreoffice/program/soffice.bin
kernel:         3.9.4-200.fc18.x86_64
runlevel:       N 5
uid:            1000
xsession_errors: 

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 writerfilter::dmapper::DomainMapper_Impl::appendOLE at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/dmapper/DomainMapper_Impl.cxx:1204
 #1 writerfilter::dmapper::DomainMapper::sprmWithProps at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/dmapper/DomainMapper.cxx:3209
 #2 writerfilter::dmapper::DomainMapper::lcl_sprm at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/dmapper/DomainMapper.cxx:1459
 #3 writerfilter::ooxml::OOXMLPropertyImpl::resolve at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx:184
 #4 writerfilter::ooxml::OOXMLPropertySetImpl::resolve at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx:438
 #5 writerfilter::dmapper::DomainMapper::lcl_props at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/dmapper/DomainMapper.cxx:3522
 #6 writerfilter::LoggedStream::props at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/resourcemodel/LoggedResources.cxx:220
 #7 writerfilter::ooxml::OOXMLFastContextHandler::sendPropertiesWithId at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/ooxml/OOXMLFastContextHandler.cxx:1029
 #8 writerfilter::ooxml::OOXMLFactory_wml::endAction at /usr/src/debug/libreoffice-3.6.6.2/workdir/unxlngx6.pro/CustomTarget/writerfilter/source/OOXMLFactory_wml.cxx:4641
 #9 writerfilter::ooxml::OOXMLFactory::endAction at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/ooxml/OOXMLFactory.cxx:335
Comment 1 Artem 2013-06-06 04:17:23 EDT
Created attachment 757539 [details]
File: backtrace
Comment 2 Artem 2013-06-06 04:17:27 EDT
Created attachment 757540 [details]
File: cgroup
Comment 3 Artem 2013-06-06 04:17:32 EDT
Created attachment 757541 [details]
File: core_backtrace
Comment 4 Artem 2013-06-06 04:17:36 EDT
Created attachment 757542 [details]
File: dso_list
Comment 5 Artem 2013-06-06 04:17:40 EDT
Created attachment 757543 [details]
File: environ
Comment 6 Artem 2013-06-06 04:17:43 EDT
Created attachment 757544 [details]
File: limits
Comment 7 Artem 2013-06-06 04:17:47 EDT
Created attachment 757545 [details]
File: maps
Comment 8 Artem 2013-06-06 04:17:50 EDT
Created attachment 757546 [details]
File: open_fds
Comment 9 Artem 2013-06-06 04:17:54 EDT
Created attachment 757547 [details]
File: proc_pid_status
Comment 10 Artem 2013-06-06 04:17:57 EDT
Created attachment 757548 [details]
File: var_log_messages
Comment 11 David Tardon 2013-06-10 04:42:18 EDT
The code is:

m_aAnchoredStack.top( ).bToRemove = true; // <-- this line crashes
RemoveLastParagraph();
m_aTextAppendStack.pop();

It looks to me like this might happen if there is an OLE object without a replacement shape. (Btw, the two following lines look suspicious to me too, as that is what happens in DomainMapper_Impl::PopShapeContext if m_aTextAppendStack.top().bToRemove == true . But I do not really understand that code, so I cannot tell without a sample document.)

dtardon->artem: Could you mail the docx to me or Caolan?
Comment 12 Michael Stahl 2013-06-10 06:12:19 EDT
master commit 344e4a25eac6505678f4ce8a6c1c8cef83c68276 looks like it could fix this... but to be sure it's really the same problem the crashing document is needed.
Comment 13 Artem 2013-06-10 14:09:07 EDT
sample provided to Caolan
Comment 14 Caolan McNamara 2013-10-08 08:29:39 EDT
confirmed works ok now in f19

Note You need to log in before you can comment on or make changes to this bug.