Regression introduced by:

author	Tamas Bunth <tamas.bunth@collabora.co.uk>	2017-09-19 14:53:16 (GMT)
committer	Tamás Bunth <btomi96@gmail.com>	2017-09-29 12:37:02 (GMT)
commit 141d4427d2d2db6a16133fcf7571798233a99cb0 (patch)
tree 1bf46c6f1a7bcfc1f5c37e4422943f3630bce3eb
parent f6990d3f61b37e15d0320ef60d2d66535fadddc0 (diff)
tdf#99689 allow Subscript in Illustration Index...
... and Index of Tables.

Bisected with: bibisect-linux64-6.0 

Adding Cc: to Tamas Bunth

Created attachment 137165 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today, I could reproduce this.
(I use gtk3 rendering + enable-dbgutil)

Jan-Marek: noticing this part in bt:
#1  0x00007ffff73cb42a in __GI_abort () at abort.c:89
#2  0x00007fffec7079d0 in Scheduler::ProcessTaskScheduling() () at /home/julien/lo/libreoffice/vcl/source/app/scheduler.cxx:445
#3  0x00007fffec706b59 in Scheduler::CallbackTaskScheduling() () at /home/julien/lo/libreoffice/vcl/source/app/scheduler.cxx:262

thought you might be interested in this one.

(last commit retrieved: commit 44f54bf392375b789e3e3c3e868c9426d6cd4e41 (HEAD -> master, origin/master, origin/HEAD)
Author: Takeshi Abe <tabe@fixedpoint.jp>
Date:   Wed Oct 18 17:22:02 2017 +0900
)

Created attachment 137167 [details]
Exception throw bt from SwOneExampleFrame::LinkStubTimeoutHdl

(In reply to Julien Nabet from comment #3)
> Jan-Marek: noticing this part in bt:
> #1  0x00007ffff73cb42a in __GI_abort () at abort.c:89
> #2  0x00007fffec7079d0 in Scheduler::ProcessTaskScheduling() () at
> /home/julien/lo/libreoffice/vcl/source/app/scheduler.cxx:445
> #3  0x00007fffec706b59 in Scheduler::CallbackTaskScheduling() () at
> /home/julien/lo/libreoffice/vcl/source/app/scheduler.cxx:262

That's the general try … catch (...) … abort(), when a task throws an exception. Nothing I can do here, except:

(gdb) f 2
#2  0x00002aaab618bafb in Scheduler::ProcessSingleTask (nTime=1508527162299, pLastDataPtr=0x0) at /home/glg/Development/libreoffice/dbgutil-clang/vcl/source/app/scheduler.cxx:458
458                 abort();
(gdb) p *pTask
$2 = (Idle) {
  <Timer> = {
    <Task> = {
      _vptr$Task = 0x2aaab6c11440 <vtable for Idle+16>, 
      mpSchedulerData = 0x6e3ac90, 
      mpDebugName = 0x2aaad5988604 "sw uibase SwOneExampleFrame Loaded", 
      mePriority = TaskPriority::HIGH_IDLE, 
      mbActive = false, 
      mbStatic = false
    }, 
    members of Timer: 
    maInvokeHandler = {
      function_ = 0x2aaad580e430 <SwOneExampleFrame::LinkStubTimeoutHdl(void*, Timer*)>, 
      instance_ = 0x6e5f910
    }, 
    mnTimeout = 0, 
    mbAuto = false
  }, <No data fields>}

So we know which tasks crashs LO, but the exception can come from any code in this task. So we actually want to find the throw point:

make debugrun gb_DBGARGS="~/Documents/tdf#113284/niqqudless.odt"
(gdb) r

wait until document is loaded, then CTRL+C

(gdb) set pagination off
(gdb) catch throw
(gdb) command 1
>bt
>c
>end
(gdb) set logging redirect on
(gdb) set logging on
(gdb) c

Generate crash in LO.
wait until GDB is back

(gdb) q

Open gdb.txt. The last throw is the problem. See attachment.

Probably it's easier to use the rr debugger?

Thank you Jan-Marek for your detailed response.

Tamas: when reverting https://cgit.freedesktop.org/libreoffice/core/commit/?id=141d4427d2d2db6a16133fcf7571798233a99cb0, I don't reproduce the abort anymore. Any thoughts?

*** Bug 113299 has been marked as a duplicate of this bug. ***

Tamas Bunth committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=090e9ecd0960e6027cfaaf4600e95dc311524143

tdf#113284 Check vector length before use

It will be available in 6.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.

Thank you Tamas!
I cherry-picked your patch and indeed, I don't reproduce the crash with it.
(I also tested tdf#113299 and no crash too!)

*** Bug 113472 has been marked as a duplicate of this bug. ***

*** Bug 113473 has been marked as a duplicate of this bug. ***

*** Bug 113773 has been marked as a duplicate of this bug. ***

*** Bug 113873 has been marked as a duplicate of this bug. ***

Gerrit patch for 5.4: https://gerrit.libreoffice.org/#/c/44849/

Tamas Bunth committed a patch related to this issue.
It has been pushed to "libreoffice-5-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=2a63ffd4d51d0e643d569a8d43b81bb691e45916&h=libreoffice-5-4

tdf#113284 Check vector length before use

It will be available in 5.4.4.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.

*** Bug 114075 has been marked as a duplicate of this bug. ***

*** Bug 114560 has been marked as a duplicate of this bug. ***

Happy to note that it has been FIXED in 5.4.4.2 (x64). 
Updated to 5.4.4.2 (x64)
Thanks!

Zdeněk Crhonek committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=b448f3cb86803ac23413cfbc643750d8e66d92b4

uitest for bug tdf#113284

It will be available in 6.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.