Bug Hunting Session
Bug 50975 - 3.6.0b1: Segfault when accessing the LO About dialog with librsvg ≈ 2.16
Summary: 3.6.0b1: Segfault when accessing the LO About dialog with librsvg ≈ 2.16
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: LibreOffice (show other bugs)
Version:
(earliest affected)
3.6.0.0.beta1
Hardware: Other Linux (All)
: medium normal
Assignee: Caolán McNamara
URL:
Whiteboard: target:3.7.0 target:3.5.6 target:3.6.0
Keywords:
Depends on:
Blocks:
 
Reported: 2012-06-11 09:07 UTC by Tobias Burnus
Modified: 2012-07-24 06:22 UTC (History)
2 users (show)

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Tobias Burnus 2012-06-11 09:07:24 UTC
That's on CentOS 5.7 (x86-64) with:

http://dev-builds.libreoffice.org/pre-releases/rpm/x86_64/LibO-Dev_3.6.0beta1_Linux_x86-64_helppack-rpm_en-US.tar.gz
http://download.documentfoundation.org/libreoffice/testing/3.5.4/rpm/x86_64/LibO_3.5.4rc2_Linux_x86-64_install-rpm_en-US.tar.gz

(Unfortunately, no debug-symbol packages seem to be available.)

If I start LO and go to the Help|About menu, it fails with the following backtrace:


*** glibc detected *** /work/iff_th1/burnus/libreoffice/opt/program/soffice.bin: double free or corruption (!prev): 0x000000001941a010 ***

/lib64/libc.so.6[0x3215c7245f]
/lib64/libc.so.6(cfree+0x4b)[0x3215c728bb]
/work/iff_th1/burnus/libreoffice/opt/program/../ure-link/lib/libxml2.so.2(xmlFreeParserCtxt+0x50)[0x2aaecfabbe97]
/usr/lib64/librsvg-2.so.2(rsvg_handle_close+0x70)[0x3d23224a10]
/work/iff_th1/burnus/libreoffice/opt/program/libvcllo.so[0x2aaece157f5b]
/work/iff_th1/burnus/libreoffice/opt/program/libvcllo.so(_ZN3vcl23RenderGraphicRasterizer20InitializeRasterizerEv+0x3b4)[0x2aaece082c54]
/work/iff_th1/burnus/libreoffice/opt/program/libvcllo.so(_ZNK3vcl23RenderGraphicRasterizer19GetDefaultSizePixelEv+0xa)[0x2aaece081c2a]
/work/iff_th1/burnus/libreoffice/opt/program/libcuilo.so[0x2aaabebfa63a]
/work/iff_th1/burnus/libreoffice/opt/program/libcuilo.so[0x2aaabebfbbbc]
/work/iff_th1/burnus/libreoffice/opt/program/libcuilo.so[0x2aaabecad726]
/work/iff_th1/burnus/libreoffice/opt/program/libsfxlo.so[0x2aaecbee1f2e]
/work/iff_th1/burnus/libreoffice/opt/program/libsfxlo.so[0x2aaecbf73a42]
/work/iff_th1/burnus/libreoffice/opt/program/libsfxlo.so[0x2aaecbf6900b]
/work/iff_th1/burnus/libreoffice/opt/program/libsfxlo.so[0x2aaecbf895f6]
/work/iff_th1/burnus/libreoffice/opt/program/libsfxlo.so[0x2aaecbf89e69]
/work/iff_th1/burnus/libreoffice/opt/program/../program/libfwklo.so[0x2aaab1aa2916]
/work/iff_th1/burnus/libreoffice/opt/program/libvcllo.so(_ZN4Menu6SelectEv+0x51)[0x2aaece0d0281]
/work/iff_th1/burnus/libreoffice/opt/program/libvcllo.so[0x2aaece0cb1e5]
/work/iff_th1/burnus/libreoffice/opt/program/libvcllo.so[0x2aaece150571]
/work/iff_th1/burnus/libreoffice/opt/program/libvcllo.so(_ZN17SalGenericDisplay21DispatchInternalEventEv+0xae)[0x2aaece15a99e]
/work/iff_th1/burnus/libreoffice/opt/program/libvclplug_genlo.so(_ZN13SalX11Display5YieldEv+0x1a)[0x2aaaaf8aa05a]
/work/iff_th1/burnus/libreoffice/opt/program/libvclplug_genlo.so[0x2aaaaf8aaa76]
/work/iff_th1/burnus/libreoffice/opt/program/libvclplug_genlo.so(_ZN7SalXLib5YieldEbb+0x4e2)[0x2aaaaf8a8f82]
/work/iff_th1/burnus/libreoffice/opt/program/libvcllo.so(_ZN11Application5YieldEb+0x41)[0x2aaecde8fd51]
/work/iff_th1/burnus/libreoffice/opt/program/libvcllo.so(_ZN11Application7ExecuteEv+0x27)[0x2aaecde8fe07]
/work/iff_th1/burnus/libreoffice/opt/program/libsofficeapp.so[0x2aaeca6f1fcd]
/work/iff_th1/burnus/libreoffice/opt/program/libvcllo.so[0x2aaecde966e7]
/work/iff_th1/burnus/libreoffice/opt/program/libvcllo.so(_Z6SVMainv+0x25)[0x2aaecde967b5]
/work/iff_th1/burnus/libreoffice/opt/program/libsofficeapp.so(soffice_main+0xe7)[0x2aaeca71dac7]
/work/iff_th1/burnus/libreoffice/opt/program/soffice.bin[0x40070b]
/lib64/libc.so.6(__libc_start_main+0xf4)[0x3215c1d994]
/work/iff_th1/burnus/libreoffice/opt/program/soffice.bin[0x40066a]
Comment 1 Tobias Burnus 2012-06-13 08:24:53 UTC
Possibly related to bug 50875? I also get a segfault when trying to include a .svg graphic.


*** glibc detected *** /work/iff_th1/burnus/libreoffice/opt/program/soffice.bin: double free or corruption (!prev): 0x00000000107bd1c0 ***
======= Backtrace: =========
/lib64/libc.so.6[0x3215c7245f]
/lib64/libc.so.6(cfree+0x4b)[0x3215c728bb]
/work/iff_th1/burnus/libreoffice/opt/program/../ure-link/lib/libxml2.so.2(xmlFreeParserCtxt+0x50)[0x2b0243099e97]
/usr/lib64/librsvg-2.so.2(rsvg_handle_close+0x70)[0x3d23224a10]
/work/iff_th1/burnus/libreoffice/opt/program/libvcllo.so[0x2b0241735f5b]
/work/iff_th1/burnus/libreoffice/opt/program/libvcllo.so(_ZN3vcl23RenderGraphicRasterizer20InitializeRasterizerEv+0x3b4)[0x2b0241660c54]
etc.
Comment 2 Roman Eisele 2012-06-28 08:15:40 UTC
NOT reproducible with LibreOffice 3.6.0beta1 (Build ID: 1f1cdd8), German langpack installed, on MacOS X 10.6.8 German UI. The About box works fine here.

Therefore, changed Platform to "Linux (All)" for now. Can someone please test on other Linux flavours and/or on Windows?
Comment 3 Florian Reisinger 2012-07-06 08:05:43 UTC
No prob on ubuntu... x64

A tester with bFedora would be interesting...
Comment 4 Thomas Hackert 2012-07-07 09:07:39 UTC
Hello Florian, *,
(In reply to comment #3)
> No prob on ubuntu... x64

cannot confirm it either with Debian Testing AMD64 and Version 3.6.0.0.beta3 (Build ID: 3e2b862) ... ;)

> A tester with bFedora would be interesting...

Or maybe with an other RPM based distro like OpenSuse, RedHat or the like ;?

HTH
Thomas.
Comment 5 Florian Reisinger 2012-07-07 23:31:49 UTC
Would you please try to reporduce it with b3
Comment 6 Tobias Burnus 2012-07-12 09:57:19 UTC
(In reply to comment #5)
> Would you please try to reporduce it with b3

Same result. I assume that LO effectively requires some newer library than the one installed on the system. (CentOS 5.7 is essentially CentOS/RHEL 5.0 [of 2007] with only few additional features but carefully trying to avoid incompatibilities.)

Hence, it might be unavoidable and CentOS 5.x is simply too old (and I should blame our IT staff).

In any case, it would be nice if one could download somewhere the debugging symbols: It would make it much easier to debug such problems.
Comment 7 Caolán McNamara 2012-07-23 12:52:18 UTC
rsvg_handle_new_from_data is used in LibO

a) rsvg_handle_new_from_data calls rsvg_handle_fill_with_data which calls rsvg_handle_close

b) We call rsvg_handle_close as well

In recent version of rsvg rsvg_handle_close checks to see if it's already been closed. In ancient versions like in RHEL-5 it doesn't
Comment 8 Not Assigned 2012-07-23 13:04:09 UTC
Caolan McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=682cb83ed59233decbeeaff68c4d871442b58bb1

Resolves: fdo#50975 rsvg_handle_new_from_data calls rsvg_handle_close
Comment 9 Not Assigned 2012-07-23 15:58:03 UTC
Caolan McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-3-5":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=765c20bbbc76bf85d0582b2a2cdb040f78faed1d&g=libreoffice-3-5

Resolves: fdo#50975 rsvg_handle_new_from_data calls rsvg_handle_close


It will be available in LibreOffice 3.5.6.
Comment 10 Not Assigned 2012-07-23 15:58:27 UTC
Caolan McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-3-6":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=cd878743c11d977ec1c336918d795180983972e5&g=libreoffice-3-6

Resolves: fdo#50975 rsvg_handle_new_from_data calls rsvg_handle_close


It will be available in LibreOffice 3.6.1.
Comment 11 Not Assigned 2012-07-24 06:22:03 UTC
Caolan McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-3-6-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=62b0f5db52330b5799db3cabfdf37626958fcb7c&g=libreoffice-3-6-0

Resolves: fdo#50975 rsvg_handle_new_from_data calls rsvg_handle_close


It will be available already in LibreOffice 3.6.0.