Bug 113284 - Crash opening index dialog
Summary: Crash opening index dialog
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
5.4.3.2 release
Hardware: All All
: highest critical
Assignee: Not Assigned
URL:
Whiteboard: target:6.0.0 target:5.4.4 target:6.1.0
Keywords: bibisected, bisected, haveBacktrace, regression
: 113299 113472 113473 113773 113873 114075 114560 (view as bug list)
Depends on:
Blocks: TableofContents-Indexes
  Show dependency treegraph
 
Reported: 2017-10-20 09:56 UTC by Yousuf Philips (jay) (retired)
Modified: 2018-03-18 17:04 UTC (History)
12 users (show)

See Also:
Crash report or crash signature:


Attachments
bt with debug symbols (31.06 KB, text/plain)
2017-10-20 18:43 UTC, Julien Nabet
Details
Exception throw bt from SwOneExampleFrame::LinkStubTimeoutHdl (11.96 KB, text/plain)
2017-10-20 20:03 UTC, Jan-Marek Glogowski
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Yousuf Philips (jay) (retired) 2017-10-20 09:56:01 UTC
steps:
1. open attachment 47194 [details]
2. go to last page of doc
3. right-click > edit index
4. dialog appears and LO crashes

doesnt happen in 5.4 daily.

Version: 5.4.3.0.0+
Build ID: fb64cf127dc6398f5d18d186a93966837db0bb1e
CPU threads: 2; OS: Linux 4.4; UI render: default; VCL: gtk2; 
TinderBox: Linux-rpm_deb-x86_64@70-TDF, Branch:libreoffice-5-4, Time: 2017-09-27_12:54:32
Locale: en-US (en_US.UTF-8); Calc: group

Version: 6.0.0.0.alpha1+ [updater build]
Build ID: 143c482b3189cb084fbdf5e6f78f15b43f099e24
CPU threads: 2; OS: Linux 4.4; UI render: default; VCL: gtk2; 
Locale: en-US (en_US.UTF-8); Calc: group

Version: 6.0.0.0.alpha0+ [tdf build]
Build ID: c5a93cad149618bbd43632f1660a558c34bdbf7e
CPU threads: 2; OS: Linux 4.4; UI render: default; VCL: gtk2; 
TinderBox: Linux-rpm_deb-x86_64@70-TDF, Branch:master, Time: 2017-10-07_01:12:25
Locale: en-US (en_US.UTF-8); Calc: group

http://crashreport.libreoffice.org/stats/crash_details/58759953-cf45-44cc-9986-208172524a4b
Comment 1 Xisco Faulí 2017-10-20 12:47:38 UTC
Regression introduced by:

author	Tamas Bunth <tamas.bunth@collabora.co.uk>	2017-09-19 14:53:16 (GMT)
committer	Tamás Bunth <btomi96@gmail.com>	2017-09-29 12:37:02 (GMT)
commit	141d4427d2d2db6a16133fcf7571798233a99cb0 (patch)
tree	1bf46c6f1a7bcfc1f5c37e4422943f3630bce3eb
parent	f6990d3f61b37e15d0320ef60d2d66535fadddc0 (diff)
tdf#99689 allow Subscript in Illustration Index...
... and Index of Tables.

Bisected with: bibisect-linux64-6.0 

Adding Cc: to Tamas Bunth
Comment 2 Julien Nabet 2017-10-20 18:43:53 UTC
Created attachment 137165 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today, I could reproduce this.
(I use gtk3 rendering + enable-dbgutil)
Comment 3 Julien Nabet 2017-10-20 18:45:35 UTC
Jan-Marek: noticing this part in bt:
#1  0x00007ffff73cb42a in __GI_abort () at abort.c:89
#2  0x00007fffec7079d0 in Scheduler::ProcessTaskScheduling() () at /home/julien/lo/libreoffice/vcl/source/app/scheduler.cxx:445
#3  0x00007fffec706b59 in Scheduler::CallbackTaskScheduling() () at /home/julien/lo/libreoffice/vcl/source/app/scheduler.cxx:262

thought you might be interested in this one.

(last commit retrieved: commit 44f54bf392375b789e3e3c3e868c9426d6cd4e41 (HEAD -> master, origin/master, origin/HEAD)
Author: Takeshi Abe <tabe@fixedpoint.jp>
Date:   Wed Oct 18 17:22:02 2017 +0900
)
Comment 4 Jan-Marek Glogowski 2017-10-20 20:03:05 UTC
Created attachment 137167 [details]
Exception throw bt from SwOneExampleFrame::LinkStubTimeoutHdl

(In reply to Julien Nabet from comment #3)
> Jan-Marek: noticing this part in bt:
> #1  0x00007ffff73cb42a in __GI_abort () at abort.c:89
> #2  0x00007fffec7079d0 in Scheduler::ProcessTaskScheduling() () at
> /home/julien/lo/libreoffice/vcl/source/app/scheduler.cxx:445
> #3  0x00007fffec706b59 in Scheduler::CallbackTaskScheduling() () at
> /home/julien/lo/libreoffice/vcl/source/app/scheduler.cxx:262

That's the general try … catch (...) … abort(), when a task throws an exception. Nothing I can do here, except:

(gdb) f 2
#2  0x00002aaab618bafb in Scheduler::ProcessSingleTask (nTime=1508527162299, pLastDataPtr=0x0) at /home/glg/Development/libreoffice/dbgutil-clang/vcl/source/app/scheduler.cxx:458
458                 abort();
(gdb) p *pTask
$2 = (Idle) {
  <Timer> = {
    <Task> = {
      _vptr$Task = 0x2aaab6c11440 <vtable for Idle+16>, 
      mpSchedulerData = 0x6e3ac90, 
      mpDebugName = 0x2aaad5988604 "sw uibase SwOneExampleFrame Loaded", 
      mePriority = TaskPriority::HIGH_IDLE, 
      mbActive = false, 
      mbStatic = false
    }, 
    members of Timer: 
    maInvokeHandler = {
      function_ = 0x2aaad580e430 <SwOneExampleFrame::LinkStubTimeoutHdl(void*, Timer*)>, 
      instance_ = 0x6e5f910
    }, 
    mnTimeout = 0, 
    mbAuto = false
  }, <No data fields>}

So we know which tasks crashs LO, but the exception can come from any code in this task. So we actually want to find the throw point:

make debugrun gb_DBGARGS="~/Documents/tdf#113284/niqqudless.odt"
(gdb) r

wait until document is loaded, then CTRL+C

(gdb) set pagination off
(gdb) catch throw
(gdb) command 1
>bt
>c
>end
(gdb) set logging redirect on
(gdb) set logging on
(gdb) c

Generate crash in LO.
wait until GDB is back

(gdb) q

Open gdb.txt. The last throw is the problem. See attachment.

Probably it's easier to use the rr debugger?
Comment 5 Julien Nabet 2017-10-20 20:50:51 UTC
Thank you Jan-Marek for your detailed response.

Tamas: when reverting https://cgit.freedesktop.org/libreoffice/core/commit/?id=141d4427d2d2db6a16133fcf7571798233a99cb0, I don't reproduce the abort anymore. Any thoughts?
Comment 6 Xisco Faulí 2017-10-22 20:26:41 UTC
*** Bug 113299 has been marked as a duplicate of this bug. ***
Comment 7 Commit Notification 2017-10-23 20:39:21 UTC
Tamas Bunth committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=090e9ecd0960e6027cfaaf4600e95dc311524143

tdf#113284 Check vector length before use

It will be available in 6.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 8 Julien Nabet 2017-10-23 21:03:57 UTC
Thank you Tamas!
I cherry-picked your patch and indeed, I don't reproduce the crash with it.
(I also tested tdf#113299 and no crash too!)
Comment 9 Xisco Faulí 2017-10-27 09:13:56 UTC
*** Bug 113472 has been marked as a duplicate of this bug. ***
Comment 10 Xisco Faulí 2017-10-27 09:14:41 UTC
*** Bug 113473 has been marked as a duplicate of this bug. ***
Comment 11 Julien Nabet 2017-11-11 20:41:38 UTC
*** Bug 113773 has been marked as a duplicate of this bug. ***
Comment 12 Aron Budea 2017-11-17 02:04:50 UTC
*** Bug 113873 has been marked as a duplicate of this bug. ***
Comment 13 Aron Budea 2017-11-17 02:09:14 UTC
Gerrit patch for 5.4: https://gerrit.libreoffice.org/#/c/44849/
Comment 14 Commit Notification 2017-11-17 13:47:13 UTC
Tamas Bunth committed a patch related to this issue.
It has been pushed to "libreoffice-5-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=2a63ffd4d51d0e643d569a8d43b81bb691e45916&h=libreoffice-5-4

tdf#113284 Check vector length before use

It will be available in 5.4.4.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 15 Aron Budea 2017-11-26 20:39:38 UTC
*** Bug 114075 has been marked as a duplicate of this bug. ***
Comment 16 Aron Budea 2017-12-19 15:59:13 UTC
*** Bug 114560 has been marked as a duplicate of this bug. ***
Comment 17 Chandanathil P. Geevan 2017-12-19 17:41:02 UTC
Happy to note that it has been FIXED in 5.4.4.2 (x64). 
Updated to 5.4.4.2 (x64)
Thanks!
Comment 18 Commit Notification 2018-03-18 15:09:46 UTC
Zdeněk Crhonek committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=b448f3cb86803ac23413cfbc643750d8e66d92b4

uitest for bug tdf#113284

It will be available in 6.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.