Hide Forgot
Description of problem: Tried to open a word file (it is unfortunately private and I can't attach it). Crashed immediately not even showing up Version-Release number of selected component: libreoffice-core-3.6.6.2-8.fc18 Additional info: reporter: libreport-2.1.4 backtrace_rating: 4 cmdline: /usr/lib64/libreoffice/program/soffice.bin --writer '/home/agoncharov/tmp/OPSC Gold BAS Database Design-SAD.D2.12.docx' --splash-pipe=6 crash_function: writerfilter::dmapper::DomainMapper_Impl::appendOLE executable: /usr/lib64/libreoffice/program/soffice.bin kernel: 3.9.4-200.fc18.x86_64 runlevel: N 5 uid: 1000 xsession_errors: Truncated backtrace: Thread no. 1 (10 frames) #0 writerfilter::dmapper::DomainMapper_Impl::appendOLE at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/dmapper/DomainMapper_Impl.cxx:1204 #1 writerfilter::dmapper::DomainMapper::sprmWithProps at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/dmapper/DomainMapper.cxx:3209 #2 writerfilter::dmapper::DomainMapper::lcl_sprm at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/dmapper/DomainMapper.cxx:1459 #3 writerfilter::ooxml::OOXMLPropertyImpl::resolve at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx:184 #4 writerfilter::ooxml::OOXMLPropertySetImpl::resolve at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx:438 #5 writerfilter::dmapper::DomainMapper::lcl_props at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/dmapper/DomainMapper.cxx:3522 #6 writerfilter::LoggedStream::props at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/resourcemodel/LoggedResources.cxx:220 #7 writerfilter::ooxml::OOXMLFastContextHandler::sendPropertiesWithId at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/ooxml/OOXMLFastContextHandler.cxx:1029 #8 writerfilter::ooxml::OOXMLFactory_wml::endAction at /usr/src/debug/libreoffice-3.6.6.2/workdir/unxlngx6.pro/CustomTarget/writerfilter/source/OOXMLFactory_wml.cxx:4641 #9 writerfilter::ooxml::OOXMLFactory::endAction at /usr/src/debug/libreoffice-3.6.6.2/writerfilter/source/ooxml/OOXMLFactory.cxx:335
Created attachment 757539 [details] File: backtrace
Created attachment 757540 [details] File: cgroup
Created attachment 757541 [details] File: core_backtrace
Created attachment 757542 [details] File: dso_list
Created attachment 757543 [details] File: environ
Created attachment 757544 [details] File: limits
Created attachment 757545 [details] File: maps
Created attachment 757546 [details] File: open_fds
Created attachment 757547 [details] File: proc_pid_status
Created attachment 757548 [details] File: var_log_messages
The code is: m_aAnchoredStack.top( ).bToRemove = true; // <-- this line crashes RemoveLastParagraph(); m_aTextAppendStack.pop(); It looks to me like this might happen if there is an OLE object without a replacement shape. (Btw, the two following lines look suspicious to me too, as that is what happens in DomainMapper_Impl::PopShapeContext if m_aTextAppendStack.top().bToRemove == true . But I do not really understand that code, so I cannot tell without a sample document.) dtardon->artem: Could you mail the docx to me or Caolan?
master commit 344e4a25eac6505678f4ce8a6c1c8cef83c68276 looks like it could fix this... but to be sure it's really the same problem the crashing document is needed.
sample provided to Caolan
confirmed works ok now in f19