Bug 114704 - Crash when texts containing certain CJK characters are printed or exported to pdf
Summary: Crash when texts containing certain CJK characters are printed or exported to...
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
Inherited From OOo
Hardware: All Linux (All)
: highest critical
Assignee: Caolán McNamara
URL:
Whiteboard: target:6.1.0 target:6.0.0.2 target:5.4.5
Keywords: haveBacktrace
Depends on:
Blocks:
 
Reported: 2017-12-26 21:58 UTC by malte.kleemeier
Modified: 2018-01-10 19:11 UTC (History)
4 users (show)

See Also:
Crash report or crash signature: ["SfxInterface::Register(SfxModule*)"]


Attachments
odt file that produces the crash (8.00 KB, application/vnd.oasis.opendocument.text)
2017-12-26 22:01 UTC, malte.kleemeier
Details
backtrace (14.60 KB, text/x-log)
2017-12-26 22:02 UTC, malte.kleemeier
Details
backtrace from master_dbg~2017-12-27_00.43.38_LibreOfficeDev_6.1.0.0.alpha0_Linux_x86-64_archive (46.12 KB, text/x-log)
2017-12-27 16:44 UTC, malte.kleemeier
Details
open GL disabled: backtrace from master_dbg~2017-12-27_00.43.38_LibreOfficeDev_6.1.0.0.alpha0_Linux_x86-64_archive (46.20 KB, text/x-log)
2017-12-27 21:24 UTC, malte.kleemeier
Details

Note You need to log in before you can comment on or make changes to this bug.
Description malte.kleemeier 2017-12-26 21:58:05 UTC
Description:
LibreOffice Writer reproducibly crashes when trying to print certain characters from CJK fonts. Bug may be also related to operating system (Ubuntu 17.10 64 bit) or the font used.

The character which produces the problem:
"…" (horizontal ellipsis, code point 0x2026).

Problem occurred for the following fonts:
"Noto Serif CJK SC"
"Noto Serif CJK TC"
obviously no crashes for fonts of the "Noto Sans" series.

odt file that gives the crash on my system and a backtrace are attached

Steps to Reproduce:
1. Open LibreOffice
2. Load "pdf_export_crash_17-12-27.odt" (attached)
3. Select File->Export as PDF; Press OK 
or 
3. Send file to printer

Actual Results:  
LibreOffice crashes immediately 

Expected Results:
produce the pdf / print


Reproducible: Always


User Profile Reset: Yes


OpenGL enabled: Yes

Additional Info:
Version: 5.4.2.2
Build ID: 1:5.4.2-0ubuntu0.17.10.1
CPU threads: 8; OS: Linux 4.13; UI render: default; VCL: gtk3; 
Locale: en-US (en_US.UTF-8); Calc: group


User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0
Comment 1 malte.kleemeier 2017-12-26 22:01:55 UTC
Created attachment 138669 [details]
odt file that produces the  crash
Comment 2 malte.kleemeier 2017-12-26 22:02:59 UTC
Created attachment 138670 [details]
backtrace
Comment 3 Xisco Faulí 2017-12-27 07:09:35 UTC Comment hidden (obsolete)
Comment 4 malte.kleemeier 2017-12-27 13:32:35 UTC
Many thanks for the fast response.

Yes, I tried to reset the the user profile as described under the link you sent. On my system the error still occurs. 

I also created a new user and cleared the folder ~/.config/libreoffice for the new account. When I log in as the new user, start Libreoffice, load "pdf_export_crash_17-12-27.odt", and try to export, Libreoffice crashes as before.

Do you think this can be related to the version of LibreOffice?
Mine is:         5.4.2.2 (default for Ubuntu 17.10)
You tested with: 5.4.3.2

Should I better report the bug to Ubuntu?

Would any further information help you to locate the bug? 

Greetings
Comment 5 Xisco Faulí 2017-12-27 14:14:46 UTC
Could you please try to reproduce it with the latest version of LibreOffice
from https://www.libreoffice.org/download/libreoffice-fresh/ ?
Comment 6 malte.kleemeier 2017-12-27 14:37:22 UTC
Thank you for your advice. Just tried it. It again crashed giving this report:

crashreport.libreoffice.org/stats/crash_details/8034031d-1d3c-4276-8d46-c7def7fed476
Comment 7 Xisco Faulí 2017-12-27 14:58:17 UTC
Could you please try to download a debug build from http://dev-builds.libreoffice.org/daily/master/ ( the ones with dbg on the name) and obtain a backtrace as explained here: https://wiki.documentfoundation.org/QA/BugReport/Debug_Information#GNU.2FLinux ??
Comment 8 malte.kleemeier 2017-12-27 16:44:18 UTC
Created attachment 138685 [details]
backtrace from  master_dbg~2017-12-27_00.43.38_LibreOfficeDev_6.1.0.0.alpha0_Linux_x86-64_archive
Comment 9 malte.kleemeier 2017-12-27 16:46:56 UTC
I proceeded as you advised. The 6.1.0 Version also gave the error.
Please have a look for the backtrace for more information.
Many thanks!
Comment 10 Julien Nabet 2017-12-27 17:03:50 UTC
Let's put this one to NEW since there's a bt.
Comment 11 Xisco Faulí 2017-12-27 18:19:08 UTC
(In reply to malte.kleemeier from comment #9)
> I proceeded as you advised. The 6.1.0 Version also gave the error.
> Please have a look for the backtrace for more information.
> Many thanks!

Thank you very much.
In your original report, OpenGL was enabled, does it crash if you disable it from Options - View ?
Comment 12 malte.kleemeier 2017-12-27 21:24:31 UTC
Created attachment 138699 [details]
open GL disabled: backtrace from master_dbg~2017-12-27_00.43.38_LibreOfficeDev_6.1.0.0.alpha0_Linux_x86-64_archive
Comment 13 malte.kleemeier 2017-12-27 21:34:34 UTC
I disabled anything under Tools->Options->View->Graphics Output 
(last line under the "Graphics Output" item of the dialog said "GL is currently disabled").
Then I restarted LibreOffice to be sure that the changes made take effect.
LibreOffice still crashes (obviously for the same reason as before). There
is a backtrace "open GL disabled: backtrace from master_dbg..." giving you
more details.

Greetings
Comment 14 Xisco Faulí 2017-12-27 23:08:30 UTC
Ok, I could reproduce the crash after installing https://noto-website-2.storage.googleapis.com/pkgs/NotoSerifCJKsc-hinted.zip

Version: 6.1.0.0.alpha0+
Build ID: 45bbb07680b3d81aaf66ef2d11c95d4c48ab23de
CPU threads: 4; OS: Linux 4.10; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group threaded
Comment 15 Xisco Faulí 2017-12-27 23:23:14 UTC
Reproduced in

Version: 5.2.0.0.alpha1+
Build ID: 5b168b3fa568e48e795234dc5fa454bf24c9805e
CPU Threads: 4; OS Version: Linux 4.10; UI Render: default; 
Locale: ca-ES (ca_ES.UTF-8)

Version: 4.3.0.0.alpha1+
Build ID: c15927f20d4727c3b8de68497b6949e72f9e6e9e

Version 4.1.0.0.alpha0+ (Build ID: efca6f15609322f62a35619619a6d5fe5c9bd5a)

LibreOffice 3.3.0 
OOO330m19 (Build:6)
tag libreoffice-3.3.0.4
Comment 16 Xisco Faulí 2017-12-27 23:24:01 UTC
Caolán, one for you?
Comment 17 Julien Nabet 2017-12-28 15:55:29 UTC
Khaled: since it concerns fonts, thought you might be interested in this bugtracker too.
Comment 18 Caolán McNamara 2018-01-08 16:05:29 UTC
FontDict element index 3 offset appear to be out by one in the font to overlap over the last byte of element index 2
Comment 19 Caolán McNamara 2018-01-08 16:41:15 UTC
ah, we squeeze through a float and lose precision
Comment 20 Commit Notification 2018-01-09 09:05:07 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=088df374f01a28c06c4602f33fea2b717bf403f5

tdf#114704 use of float as intermediate causes out by one on large offsets

It will be available in 6.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 21 Caolán McNamara 2018-01-09 09:05:59 UTC
backport to earlier versions in gerrit
Comment 22 Commit Notification 2018-01-09 14:09:00 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-6-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=4e96c457f08368843d32337a9a2d9ccefa62839e&h=libreoffice-6-0

tdf#114704 use of float as intermediate causes out by one on large offsets

It will be available in 6.0.0.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 23 Commit Notification 2018-01-09 14:09:11 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-5-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=7f9a8481f76fc45ff682b654484c1ac311820dfe&h=libreoffice-5-4

tdf#114704 use of float as intermediate causes out by one on large offsets

It will be available in 5.4.5.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 24 malte.kleemeier 2018-01-10 19:11:10 UTC
Today I tried it on my system using
libreoffice-5-4~2018-01-09_14.40.58_LibreOfficeDev_5.4.5.0.0_Linux_x86-64_deb

Everything is working fine now.

Great work, I'm really impressed by the way error tracking is done at libreoffice. Many thanks!