Bug 971288 - [abrt] libreoffice-core-3.6.6.2-8.fc18: writerfilter::dmapper::DomainMapper_Impl::appendOLE: Process /usr/lib64/libreoffice/program/soffice.bin was killed by signal 11 (SIGSEGV)
Summary: [abrt] libreoffice-core-3.6.6.2-8.fc18: writerfilter::dmapper::DomainMapper_I...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: libreoffice
Version: 18
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Caolan McNamara
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:fa65aff046d8b4fa4206596e14c...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-06-06 08:17 UTC by Artem
Modified: 2013-10-08 12:29 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-10-08 12:29:39 UTC
Type: ---
artem.goncharov: needinfo+


Attachments (Terms of Use)
File: backtrace (133.84 KB, text/plain)
2013-06-06 08:17 UTC, Artem
no flags Details
File: cgroup (133 bytes, text/plain)
2013-06-06 08:17 UTC, Artem
no flags Details
File: core_backtrace (13.53 KB, text/plain)
2013-06-06 08:17 UTC, Artem
no flags Details
File: dso_list (23.17 KB, text/plain)
2013-06-06 08:17 UTC, Artem
no flags Details
File: environ (2.35 KB, text/plain)
2013-06-06 08:17 UTC, Artem
no flags Details
File: limits (1.29 KB, text/plain)
2013-06-06 08:17 UTC, Artem
no flags Details
File: maps (105.77 KB, text/plain)
2013-06-06 08:17 UTC, Artem
no flags Details
File: open_fds (923 bytes, text/plain)
2013-06-06 08:17 UTC, Artem
no flags Details
File: proc_pid_status (940 bytes, text/plain)
2013-06-06 08:17 UTC, Artem
no flags Details
File: var_log_messages (362 bytes, text/plain)
2013-06-06 08:17 UTC, Artem
no flags Details

Description Artem 2013-06-06 08:17:15 UTC
Description of problem:
Tried to open a word file (it is unfortunately private and I can't attach it). Crashed immediately not even showing up

Version-Release number of selected component:
libreoffice-core-3.6.6.2-8.fc18

Additional info:
reporter:       libreport-2.1.4
backtrace_rating: 4
cmdline:        /usr/lib64/libreoffice/program/soffice.bin --writer '/home/agoncharov/tmp/OPSC Gold BAS Database Design-SAD.D2.12.docx' --splash-pipe=6
crash_function: writerfilter::dmapper::DomainMapper_Impl::appendOLE
executable:     /usr/lib64/libreoffice/program/soffice.bin
kernel:         3.9.4-200.fc18.x86_64
runlevel:       N 5
uid:            1000
xsession_errors: 

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 writerfilter::dmapper::DomainMapper_Impl::appendOLE at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/dmapper/DomainMapper_Impl.cxx:1204
 #1 writerfilter::dmapper::DomainMapper::sprmWithProps at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/dmapper/DomainMapper.cxx:3209
 #2 writerfilter::dmapper::DomainMapper::lcl_sprm at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/dmapper/DomainMapper.cxx:1459
 #3 writerfilter::ooxml::OOXMLPropertyImpl::resolve at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx:184
 #4 writerfilter::ooxml::OOXMLPropertySetImpl::resolve at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx:438
 #5 writerfilter::dmapper::DomainMapper::lcl_props at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/dmapper/DomainMapper.cxx:3522
 #6 writerfilter::LoggedStream::props at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/resourcemodel/LoggedResources.cxx:220
 #7 writerfilter::ooxml::OOXMLFastContextHandler::sendPropertiesWithId at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/ooxml/OOXMLFastContextHandler.cxx:1029
 #8 writerfilter::ooxml::OOXMLFactory_wml::endAction at /usr/src/debug/libreoffice-3.6.6.2/workdir/unxlngx6.pro/CustomTarget/writerfilter/source/OOXMLFactory_wml.cxx:4641
 #9 writerfilter::ooxml::OOXMLFactory::endAction at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/ooxml/OOXMLFactory.cxx:335

Comment 1 Artem 2013-06-06 08:17:23 UTC
Created attachment 757539 [details]
File: backtrace

Comment 2 Artem 2013-06-06 08:17:27 UTC
Created attachment 757540 [details]
File: cgroup

Comment 3 Artem 2013-06-06 08:17:32 UTC
Created attachment 757541 [details]
File: core_backtrace

Comment 4 Artem 2013-06-06 08:17:36 UTC
Created attachment 757542 [details]
File: dso_list

Comment 5 Artem 2013-06-06 08:17:40 UTC
Created attachment 757543 [details]
File: environ

Comment 6 Artem 2013-06-06 08:17:43 UTC
Created attachment 757544 [details]
File: limits

Comment 7 Artem 2013-06-06 08:17:47 UTC
Created attachment 757545 [details]
File: maps

Comment 8 Artem 2013-06-06 08:17:50 UTC
Created attachment 757546 [details]
File: open_fds

Comment 9 Artem 2013-06-06 08:17:54 UTC
Created attachment 757547 [details]
File: proc_pid_status

Comment 10 Artem 2013-06-06 08:17:57 UTC
Created attachment 757548 [details]
File: var_log_messages

Comment 11 David Tardon 2013-06-10 08:42:18 UTC
The code is:

m_aAnchoredStack.top( ).bToRemove = true; // <-- this line crashes
RemoveLastParagraph();
m_aTextAppendStack.pop();

It looks to me like this might happen if there is an OLE object without a replacement shape. (Btw, the two following lines look suspicious to me too, as that is what happens in DomainMapper_Impl::PopShapeContext if m_aTextAppendStack.top().bToRemove == true . But I do not really understand that code, so I cannot tell without a sample document.)

dtardon->artem: Could you mail the docx to me or Caolan?

Comment 12 Michael Stahl 2013-06-10 10:12:19 UTC
master commit 344e4a25eac6505678f4ce8a6c1c8cef83c68276 looks like it could fix this... but to be sure it's really the same problem the crashing document is needed.

Comment 13 Artem 2013-06-10 18:09:07 UTC
sample provided to Caolan

Comment 14 Caolan McNamara 2013-10-08 12:29:39 UTC
confirmed works ok now in f19


Note You need to log in before you can comment on or make changes to this bug.