Bug 82629

Summary: FILEOPEN: Writer crashes loading .rtf
Product: LibreOffice Reporter: libreofficebugzilla-j4kyd
Component: WriterAssignee: Not Assigned <libreoffice-bugs>
Status: RESOLVED WORKSFORME    
Severity: normal CC: barta
Priority: medium    
Version: 4.2.5.2 release   
Hardware: x86-64 (AMD64)   
OS: All   
Whiteboard:
Crash report or crash signature: Regression By:
Attachments: File triggering crash

Description libreofficebugzilla-j4kyd 2014-08-14 18:16:41 UTC 
Opening http://www.crimeline.info/uploads/cases/2014/2014ewcacrim1681.rtf causes LibreOffice 4.2.5.2 to crash on OSX with the message at the end of this.

Opening the file on LO 4.2.2.1 is absolutely fine...


================


Process:         soffice [17563]
Path:            /Applications/LibreOffice.app/Contents/MacOS/soffice
Identifier:      org.libreoffice.script
Version:         4.2.5002 (0)
Code Type:       X86-64 (Native)
Parent Process:  launchd [140]
Responsible:     soffice [17563]
User ID:         501

Date/Time:       2014-08-14 19:00:57.167 +0100
OS Version:      Mac OS X 10.9.4 (13E28)
Report Version:  11
Anonymous UUID:  F0759F5F-7109-5105-24A7-4614AB4696E9

Sleep/Wake UUID: DD902930-17CA-4263-9BEE-FF4C93AAAF2F

Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000018

VM Regions Near 0x18:
--> 
    __TEXT                 000000010486e000-000000010486f000 [    4K] r-x/rwx SM=COW  /Applications/LibreOffice.app/Contents/MacOS/soffice

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   libwriterfilterlo.dylib       	0x0000000118fd4ce7 writerfilter::dmapper::DomainMapper::sprmWithProps(writerfilter::Sprm&, boost::shared_ptr<writerfilter::dmapper::PropertyMap>, writerfilter::dmapper::SprmType) + 38471
1   libwriterfilterlo.dylib       	0x0000000118fcb5ee writerfilter::dmapper::DomainMapper::lcl_sprm(writerfilter::Sprm&) + 222
2   libwriterfilterlo.dylib       	0x0000000118fae61b writerfilter::rtftok::RTFReferenceProperties::resolve(writerfilter::Properties&) + 107
3   libwriterfilterlo.dylib       	0x0000000118fd8abc writerfilter::dmapper::DomainMapper::lcl_props(boost::shared_ptr<writerfilter::Reference<writerfilter::Properties> >) + 92
4   libwriterfilterlo.dylib       	0x00000001190ca68a writerfilter::LoggedStream::props(boost::shared_ptr<writerfilter::Reference<writerfilter::Properties> >) + 58
5   libwriterfilterlo.dylib       	0x0000000118f666ae writerfilter::rtftok::RTFDocumentImpl::checkNeedPap() + 990
6   libwriterfilterlo.dylib       	0x0000000118f6e9c0 writerfilter::rtftok::RTFDocumentImpl::text(rtl::OUString&) + 2080
7   libwriterfilterlo.dylib       	0x0000000118f6e013 writerfilter::rtftok::RTFDocumentImpl::resolveChars(char) + 1331
8   libwriterfilterlo.dylib       	0x0000000118f7015d non-virtual thunk to writerfilter::rtftok::RTFDocumentImpl::resolveChars(char) + 13
9   libwriterfilterlo.dylib       	0x0000000118fba0b5 writerfilter::rtftok::RTFTokenizer::resolveParse() + 613
10  libwriterfilterlo.dylib       	0x0000000118f6872d writerfilter::rtftok::RTFDocumentImpl::resolve(writerfilter::Stream&) + 29
11  libwriterfilterlo.dylib       	0x00000001190738e7 RtfFilter::filter(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) + 2471
12  libwriterfilterlo.dylib       	0x000000011907406d non-virtual thunk to RtfFilter::filter(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) + 13
13  libsfxlo.dylib                	0x0000000104f3a142 SfxObjectShell::ImportFrom(SfxMedium&, com::sun::star::uno::Reference<com::sun::star::text::XTextRange> const&) + 3410
14  libsfxlo.dylib                	0x0000000104f30507 SfxObjectShell::DoLoad(SfxMedium*) + 3575
15  libsfxlo.dylib                	0x0000000104f647de SfxBaseModel::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) + 654
16  libsfxlo.dylib                	0x0000000104fe2906 SfxFrameLoader_Impl::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) + 1734
17  libsfxlo.dylib                	0x0000000104fe33fd non-virtual thunk to SfxFrameLoader_Impl::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) + 13
18  libfwklo.dylib                	0x000000011136da92 framework::LoadEnv::impl_loadContent() + 2546
19  libfwklo.dylib                	0x00000001113693a7 framework::LoadEnv::startLoading() + 119
20  libfwklo.dylib                	0x00000001113086b2 framework::LoadDispatcher::impl_dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XDispatchResultListener> const&) + 802
21  libfwklo.dylib                	0x0000000111308d1f framework::LoadDispatcher::dispatchWithReturnValue(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) + 31
22  libfwklo.dylib                	0x0000000111308d92 non-virtual thunk to framework::LoadDispatcher::dispatchWithReturnValue(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) + 18
23  libcomphelper.dylib           	0x00000001049e90a1 comphelper::SynchronousDispatch::dispatch(com::sun::star::uno::Reference<com::sun::star::uno::XInterface> const&, rtl::OUString const&, rtl::OUString const&, int, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) + 689
24  libsofficeapp.dylib           	0x00000001049099e7 desktop::DispatchWatcher::executeDispatchRequests(std::vector<desktop::DispatchWatcher::DispatchRequest, std::allocator<desktop::DispatchWatcher::DispatchRequest> > const&, bool) + 15303
25  libsofficeapp.dylib           	0x000000010490e9f4 desktop::OfficeIPCThread::ExecuteCmdLineRequests(desktop::ProcessDocumentsRequest&) + 1332
26  libsofficeapp.dylib           	0x00000001048e8ba6 desktop::Desktop::HandleAppEvent(ApplicationEvent const&) + 1206
27  libvcllo.dylib                	0x000000010638a9d3 AquaSalInstance::Yield(bool, bool) + 515
28  libvcllo.dylib                	0x0000000106084133 ImplYield(bool, bool) + 115
29  libvcllo.dylib                	0x0000000106081bbc Application::Execute() + 44
30  libsofficeapp.dylib           	0x00000001048eb28f desktop::Desktop::Main() + 6783
31  libvcllo.dylib                	0x00000001060881a4 ImplSVMain() + 52
32  libvcllo.dylib                	0x000000010638a5d6 AquaSalInstance::handleAppDefinedEvent(NSEvent*) + 86
33  libvcllo.dylib                	0x00000001063befb6 -[VCL_NSApplication sendEvent:] + 326
34  com.apple.AppKit              	0x00007fff89a2a9f9 -[NSApplication run] + 646
35  com.apple.AppKit              	0x00007fff89a15783 NSApplicationMain + 940
36  libvcllo.dylib                	0x00000001063899ce ImplSVMainHook(int*) + 430
37  libvcllo.dylib                	0x0000000106088d4a SVMain() + 26
38  libsofficeapp.dylib           	0x0000000104912b76 soffice_main + 214
39  org.libreoffice.script        	0x000000010486ef20 main + 16
40  libdyld.dylib                 	0x00007fff901ea5fd start + 1

Thread 1:
0   libsystem_kernel.dylib        	0x00007fff895b9716 __psynch_cvwait + 10
1   libsystem_pthread.dylib       	0x00007fff90035c3b _pthread_cond_wait + 727
2   libuno_sal.dylib.3            	0x0000000104882243 rtl_cache_wsupdate_all(void*) + 131
3   libsystem_pthread.dylib       	0x00007fff90033899 _pthread_body + 138
4   libsystem_pthread.dylib       	0x00007fff9003372a _pthread_start + 137
5   libsystem_pthread.dylib       	0x00007fff90037fc9 thread_start + 13

Thread 2:: Dispatch queue: com.apple.libdispatch-manager
0   libsystem_kernel.dylib        	0x00007fff895ba662 kevent64 + 10
1   libdispatch.dylib             	0x00007fff8d245421 _dispatch_mgr_invoke + 239
2   libdispatch.dylib             	0x00007fff8d245136 _dispatch_mgr_thread + 52

Thread 3:
0   libsystem_kernel.dylib        	0x00007fff895b5a1a mach_msg_trap + 10
1   libsystem_kernel.dylib        	0x00007fff895b4d18 mach_msg + 64
2   com.apple.CoreFoundation      	0x00007fff8f94ff15 __CFRunLoopServiceMachPort + 181
3   com.apple.CoreFoundation      	0x00007fff8f94f539 __CFRunLoopRun + 1161
4   com.apple.CoreFoundation      	0x00007fff8f94ee75 CFRunLoopRunSpecific + 309
5   com.apple.AppKit              	0x00007fff89bd705e _NSEventThread + 144
6   libsystem_pthread.dylib       	0x00007fff90033899 _pthread_body + 138
7   libsystem_pthread.dylib       	0x00007fff9003372a _pthread_start + 137
8   libsystem_pthread.dylib       	0x00007fff90037fc9 thread_start + 13

Thread 4:
0   libsystem_kernel.dylib        	0x00007fff895b8e02 __accept + 10
1   libuno_sal.dylib.3            	0x000000010487614b osl_acceptPipe + 27
2   libsofficeapp.dylib           	0x000000010491150b desktop::OfficeIPCThread::execute() + 4555
3   libuno_salhelpergcc3.dylib.3  	0x0000000104d5e432 non-virtual thunk to salhelper::Thread::run() + 34
4   libuno_salhelpergcc3.dylib.3  	0x0000000104d5e5ef threadFunc + 15
5   libuno_sal.dylib.3            	0x000000010487c32e osl_thread_start_Impl + 126
6   libsystem_pthread.dylib       	0x00007fff90033899 _pthread_body + 138
7   libsystem_pthread.dylib       	0x00007fff9003372a _pthread_start + 137
8   libsystem_pthread.dylib       	0x00007fff90037fc9 thread_start + 13

Thread 5:
0   libsystem_kernel.dylib        	0x00007fff895b9716 __psynch_cvwait + 10
1   libsystem_pthread.dylib       	0x00007fff90035c3b _pthread_cond_wait + 727
2   libuno_sal.dylib.3            	0x000000010489d1d1 osl_waitCondition + 209
3   liblnglo.dylib                	0x00000001118aaf01 GrammarCheckingIterator::DequeueAndCheck() + 81
4   libuno_sal.dylib.3            	0x000000010487c32e osl_thread_start_Impl + 126
5   libsystem_pthread.dylib       	0x00007fff90033899 _pthread_body + 138
6   libsystem_pthread.dylib       	0x00007fff9003372a _pthread_start + 137
7   libsystem_pthread.dylib       	0x00007fff90037fc9 thread_start + 13

Thread 6:
0   libsystem_kernel.dylib        	0x00007fff895b9716 __psynch_cvwait + 10
1   libsystem_pthread.dylib       	0x00007fff90035c3b _pthread_cond_wait + 727
2   libuno_sal.dylib.3            	0x000000010489d19f osl_waitCondition + 159
3   libupdchklo.dylib             	0x0000000119a56c2b (anonymous namespace)::UpdateCheckThread::run() + 363
4   libupdchklo.dylib             	0x0000000119a59b7f threadFunc + 15
5   libuno_sal.dylib.3            	0x000000010487c32e osl_thread_start_Impl + 126
6   libsystem_pthread.dylib       	0x00007fff90033899 _pthread_body + 138
7   libsystem_pthread.dylib       	0x00007fff9003372a _pthread_start + 137
8   libsystem_pthread.dylib       	0x00007fff90037fc9 thread_start + 13

Thread 7:
0   libsystem_kernel.dylib        	0x00007fff895b9e6a __workq_kernreturn + 10
1   libsystem_pthread.dylib       	0x00007fff90034f08 _pthread_wqthread + 330
2   libsystem_pthread.dylib       	0x00007fff90037fb9 start_wqthread + 13

Thread 8:
0   libsystem_kernel.dylib        	0x00007fff895b9e6a __workq_kernreturn + 10
1   libsystem_pthread.dylib       	0x00007fff90034f08 _pthread_wqthread + 330
2   libsystem_pthread.dylib       	0x00007fff90037fb9 start_wqthread + 13

Thread 9:
0   libsystem_kernel.dylib        	0x00007fff895b9e6a __workq_kernreturn + 10
1   libsystem_pthread.dylib       	0x00007fff90034f08 _pthread_wqthread + 330
2   libsystem_pthread.dylib       	0x00007fff90037fb9 start_wqthread + 13

Thread 10:
0   libsystem_kernel.dylib        	0x00007fff895b9e6a __workq_kernreturn + 10
1   libsystem_pthread.dylib       	0x00007fff90034f08 _pthread_wqthread + 330
2   libsystem_pthread.dylib       	0x00007fff90037fb9 start_wqthread + 13

Thread 11:
0   libsystem_kernel.dylib        	0x00007fff895b9716 __psynch_cvwait + 10
1   libsystem_pthread.dylib       	0x00007fff90035c3b _pthread_cond_wait + 727
2   libuno_sal.dylib.3            	0x000000010489d19f osl_waitCondition + 159
3   libfwklo.dylib                	0x000000011132351a framework::WakeUpThread::run() + 106
4   libfwklo.dylib                	0x0000000111319eff threadFunc + 15
5   libuno_sal.dylib.3            	0x000000010487c32e osl_thread_start_Impl + 126
6   libsystem_pthread.dylib       	0x00007fff90033899 _pthread_body + 138
7   libsystem_pthread.dylib       	0x00007fff9003372a _pthread_start + 137
8   libsystem_pthread.dylib       	0x00007fff90037fc9 thread_start + 13

Thread 0 crashed with X86 Thread State (64-bit):
  rax: 0x0000000000000018  rbx: 0x00007fff5b38e8e8  rcx: 0x0000000000000010  rdx: 0x0000000000000018
  rdi: 0x0000000000000010  rsi: 0x000000000000000a  rbp: 0x00007fff5b38f780  rsp: 0x00007fff5b38e5d0
   r8: 0x0000000118fa32f0   r9: 0x0000000000000000  r10: 0x0000000000000057  r11: 0x000000000000000a
  r12: 0x0000608000668740  r13: 0x0000608000178fc0  r14: 0x00007fff5b38f790  r15: 0x00006080003d8420
  rip: 0x0000000118fd4ce7  rfl: 0x0000000000010206  cr2: 0x0000000000000018
  
Logical CPU:     2
Error Code:      0x00000004
Trap Number:     14
Comment 1 libreofficebugzilla-j4kyd 2014-08-14 18:17:48 UTC 
Created attachment 104630 [details]
File triggering crash
Comment 2 tommy27 2014-08-14 18:34:53 UTC 
reproducible under Win7x64 using 4.2.5.2
not reproducible under Win7x64 using 4.3.0.4

hence the bug in 4.2.x is fixed in 4.3.x

setting status RESOLVED WORKSFORME

try upgrading to 4.2.6.2 to see if the fix is in the latest 4.2.x release as well