Bug 55566 - open two odb files with macro at "open document" event -> crash
Summary: open two odb files with macro at "open document" event -> crash
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: BASIC (show other bugs)
Version:
(earliest affected)
3.3.4 release
Hardware: x86-64 (AMD64) All
: high major
Assignee: Caolán McNamara
URL:
Whiteboard: target:5.3.0 target:5.2.0.1 target:5.1.5
Keywords:
Depends on:
Blocks:
 
Reported: 2012-10-03 09:16 UTC by Lionel Elie Mamane
Modified: 2016-10-25 18:54 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:


Attachments
reproduction example (3.27 KB, application/vnd.oasis.opendocument.database)
2012-10-03 09:16 UTC, Lionel Elie Mamane
Details
writer non-reproduction example (9.64 KB, application/vnd.oasis.opendocument.text)
2012-10-03 09:23 UTC, Lionel Elie Mamane
Details
calc non-reproduction example (8.34 KB, application/vnd.oasis.opendocument.spreadsheet)
2012-10-03 09:28 UTC, Lionel Elie Mamane
Details
java error report (117.36 KB, text/plain)
2012-12-27 16:22 UTC, Lionel Elie Mamane
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Lionel Elie Mamane 2012-10-03 09:16:44 UTC
Created attachment 68027 [details]
reproduction example

Reproduced with:

 - OpenOffice.org 3.3.0 OOO330m20 (Build: 9567)
 - 3.3.4 (official deb amd64 binaries:
          OOO330m19 (Build:401) tag libreoffice-3.3.4.1)
 - 3.5.5.3 (official deb amd64 binaries)
 - 3.6.2.1 (official deb amd64 binaries)
 - my libreoffice-3-6 dev tree


Reproduction instructions:

1) Set Macro security to medium:

   a) Menu Tools / Options / LibreOffice / Security
   b) click on button "Macro Security"
   c) In tab "Security Level", select radio button "Medium"
   d) OK
   e) OK

2) Close LibreOffice

3) save reproduction example attachment twice,
   once as "crash.odb" and once as "crash2.odb"

   Its only special thing is that it has a macro bound to
   its "Open Document" event.

4) Start LibreOffice as such:

   /path/to/libreoffice/program/soffice crash.odb crash2.odb

5) You get the macro security warning. Click on "Enable Macros"

------> crash

Crash does not happen in "macro security: low" mode, and does not happen if one clicks on "disable macros" on the first warning.

Crash does not happen with similar writer or calc documents.
Comment 1 Lionel Elie Mamane 2012-10-03 09:23:31 UTC
Created attachment 68028 [details]
writer non-reproduction example

Crash does *not* happen with this writer document.

Interestingly, it *does* happen with launching libreoffice as such:

/path/to/libreoffice/program/soffice crash.odt crash.odb

but *not* with


/path/to/libreoffice/program/soffice crash.odb crash.odt
Comment 2 Lionel Elie Mamane 2012-10-03 09:28:27 UTC
Created attachment 68029 [details]
calc non-reproduction example

Crash does not happen with this document.

However, interestingly, when launching libreoffice as:

/path/to/libreoffice/program/soffice crash.ods crash.odb

then answer "Enable macros" for "crash.ods", one gets error message "com.sun.star.uno.RuntimeExceptionScriptProtocolHandler::createScriptProvider(), Unable to obtain document content factory" for crash.odb. Click "OK" on that error message -> libreoffice exits/aborts

Again,

/path/to/libreoffice/program/soffice crash.odb crash.ods

works well.
Comment 3 Lionel Elie Mamane 2012-10-03 09:30:26 UTC
Here's the information from gdb:



Program terminated with signal 11, Segmentation fault.
#0  0x00007fdb6bda9e67 in com::sun::star::uno::BaseReference::iquery (pInterface=pInterface@entry=0x2eb4178, rType=...)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/solver/unxlngx6/inc/com/sun/star/uno/Reference.hxx:52
52	        Any aRet( pInterface->queryInterface( rType ) );

(gdb) print pInterface
$15 = (com::sun::star::uno::XInterface *) 0x2eb4178
(gdb) print *
$16 = {
  _vptr.XInterface = 0x51
}
(gdb) print rType
$17 = invalid uno::Type

(gdb) bt
#0  0x00007fdb6bda9e67 in com::sun::star::uno::BaseReference::iquery (pInterface=pInterface@entry=0x2eb4178, 
    rType=invalid uno::Type)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/solver/unxlngx6/inc/com/sun/star/uno/Reference.hxx:52
#1  0x00007fdb6bdbd6a0 in com::sun::star::uno::Reference<com::sun::star::document::XEventListener>::iquery (
    pInterface=pInterface@entry=0x2eb4178)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/solver/unxlngx6/inc/com/sun/star/uno/Reference.hxx:67
#2  0x00007fdb6c092dd1 in com::sun::star::uno::Reference<com::sun::star::document::XEventListener>::Reference (this=
    0x7fdb5a540610, pInterface=0x2eb4178)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/solver/unxlngx6/inc/com/sun/star/uno/Reference.hxx:163
#3  0x00007fdb6c0a8da3 in cppu::OInterfaceContainerHelper::forEach<com::sun::star::document::XEventListener, cppu::OInterfaceContainerHelper::NotifySingleListener<com::sun::star::document::XEventListener, com::sun::star::document::EventObject> > (
    this=this@entry=0x278ae70, func=...)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/solver/unxlngx6/inc/cppuhelper/interfacecontainer.h:283
#4  0x00007fdb6c0a8048 in cppu::OInterfaceContainerHelper::notifyEach<com::sun::star::document::XEventListener, com::sun::star::document::EventObject> (this=this@entry=0x278ae70, 
    NotificationMethod=&virtual com::sun::star::document::XEventListener::notifyEvent(com::sun::star::document::EventObject const&), Event=...)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/solver/unxlngx6/inc/cppuhelper/interfacecontainer.h:303
#5  0x00007fdb6c0a63b6 in SfxGlobalEvents_Impl::implts_notifyListener (this=0x278adf0, aEvent=...)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/sfx2/source/notify/eventsupplier.cxx:845
#6  0x00007fdb6c0a50fd in SfxGlobalEvents_Impl::documentEventOccured (this=0x278adf0, _Event=...)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/sfx2/source/notify/eventsupplier.cxx:653
#7  0x00007fdb550439e5 in cppu::OInterfaceContainerHelper::NotifySingleListener<com::sun::star::document::XDocumentEventListener, com::sun::star::document::DocumentEvent>::operator() (this=0x7fdb5a5407d0, listener=uno::Reference to {
  <com::sun::star::lang::XEventListener> = {
    <com::sun::star::uno::XInterface> = {
      _vptr.XInterface = 0x7fdb6c509bf0
    }, <No data fields>}, <No data fields>})
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/solver/unxlngx6/inc/cppuhelper/interfacecontainer.h:272
#8  0x00007fdb55043787 in cppu::OInterfaceContainerHelper::forEach<com::sun::star::document::XDocumentEventListener, cppu::OInterfaceContainerHelper::NotifySingleListener<com::sun::star::document::XDocumentEventListener, com::sun::star::document::DocumentEvent> > (this=this@entry=0x2bcc2c8, func=...)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/solver/unxlngx6/inc/cppuhelper/interfacecontainer.h:289
#9  0x00007fdb550432f2 in cppu::OInterfaceContainerHelper::notifyEach<com::sun::star::document::XDocumentEventListener, com::sun::star::document::DocumentEvent> (this=this@entry=0x2bcc2c8, 
    NotificationMethod=&virtual com::sun::star::document::XDocumentEventListener::documentEventOccured(com::sun::star::document::DocumentEvent const&), Event=...)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/solver/unxlngx6/inc/cppuhelper/interfacecontainer.h:303
#10 0x00007fdb55041902 in dbaccess::DocumentEventNotifier_Impl::impl_notifyEvent_nothrow (this=this@entry=0x2bcc280, 
    _rEvent=...)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/dbaccess/source/core/dataaccess/documenteventnotifier.cxx:216
#11 0x00007fdb5504279b in dbaccess::DocumentEventNotifier_Impl::processEvent (this=this@entry=0x2bcc280, _rEvent=...)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/dbaccess/source/core/dataaccess/documenteventnotifier.cxx:247
#12 0x00007fdb6d22926c in comphelper::AsyncEventNotifier::execute (this=0x2d1b250)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/comphelper/source/misc/asyncnotification.cxx:230
#13 0x00007fdb6c522ae8 in salhelper::Thread::run (this=0x2d1b250)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/salhelper/source/thread.cxx:60
#14 0x00007fdb6c522ebd in osl::threadFunc (param=0x2d1b260)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/solver/unxlngx6/inc/osl/thread.hxx:196
#15 0x00007fdb6e7d552f in osl_thread_start_Impl (pData=0x2d1b290)
---Type <return> to continue, or q <return> to quit---q
 at /home/master/src/libreoffice/workdirs/libreoffice-3.6/salQuit
(gdb) up 9
#9  0x00007fdb550432f2 in cppu::OInterfaceContainerHelper::notifyEach<com::sun::star::document::XDocumentEventListener, com::sun::star::document::DocumentEvent> (this=this@entry=0x2bcc2c8, 
    NotificationMethod=&virtual com::sun::star::document::XDocumentEventListener::documentEventOccured(com::sun::star::document::DocumentEvent const&), Event=...)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/solver/unxlngx6/inc/cppuhelper/interfacecontainer.h:303
303	    forEach< ListenerT, NotifySingleListener< ListenerT, EventT > >( NotifySingleListener< ListenerT, EventT >( NotificationMethod, Event ) );
(gdb) thread apply all bt 5

Thread 8 (Thread 0x7fdb6ec428a0 (LWP 6391)):
#0  0x00007fdb6da9db47 in __libc_writev (fd=3, vector=<optimized out>, count=3) at ../sysdeps/unix/sysv/linux/writev.c:56
#1  0x00007fdb63c3c9b7 in ?? () from /usr/lib/libxcb.so.1
#2  0x00007fdb63c3cec9 in ?? () from /usr/lib/libxcb.so.1
#3  0x00007fdb63c3d175 in xcb_writev () from /usr/lib/libxcb.so.1
#4  0x00007fdb665d7c67 in _XSend () from /usr/lib/x86_64-linux-gnu/libX11.so.6
(More stack frames follow...)

Thread 7 (Thread 0x7fdb62528700 (LWP 6392)):
#0  pthread_cond_timedwait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:216
#1  0x00007fdb6e7e51c6 in rtl_cache_wsupdate_wait (seconds=seconds@entry=10)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/sal/rtl/source/alloc_cache.cxx:1382
#2  0x00007fdb6e7e53a8 in rtl_cache_wsupdate_all (arg=0xa)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/sal/rtl/source/alloc_cache.cxx:1522
#3  0x00007fdb6d7b6b50 in start_thread (arg=<optimized out>) at pthread_create.c:304
#4  0x00007fdb6daa49dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
(More stack frames follow...)

Thread 6 (Thread 0x7fdb4c1f7700 (LWP 6417)):
#0  pthread_cond_timedwait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:216
#1  0x00007fdb6e817ca1 in osl_waitCondition (Condition=0x2ce48c0, pTimeout=0x7fdb4c1f6c70)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/sal/osl/unx/conditn.cxx:264
#2  0x00007fdb5a7c95f4 in osl::Condition::wait (this=this@entry=0x2cdca88, pTimeout=pTimeout@entry=0x7fdb4c1f6c70)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/solver/unxlngx6/inc/osl/conditn.hxx:84
#3  0x00007fdb5a7c153d in configmgr::Components::WriteThread::execute (this=0x2cdca40)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/configmgr/source/components.cxx:190
#4  0x00007fdb6c522ae8 in salhelper::Thread::run (this=0x2cdca40)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/salhelper/source/thread.cxx:60
(More stack frames follow...)

Thread 5 (Thread 0x7fdb56631700 (LWP 6399)):
#0  0x00007fdb6da99d93 in *__GI___poll (fds=<optimized out>, nfds=<optimized out>, timeout=-1)
    at ../sysdeps/unix/sysv/linux/poll.c:87
#1  0x00007fdb5f4d36a1 in ICEConnectionWorker ()
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/vcl/unx/generic/app/sm.cxx:647
#2  0x00007fdb6e7d552f in osl_thread_start_Impl (pData=0x2a1d040)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/sal/osl/unx/thread.c:261
#3  0x00007fdb6d7b6b50 in start_thread (arg=<optimized out>) at pthread_create.c:304
#4  0x00007fdb6daa49dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
(More stack frames follow...)

Thread 4 (Thread 0x7fdb53a51700 (LWP 6403)):
#0  0x00007fdb6da99d93 in *__GI___poll (fds=<optimized out>, nfds=<optimized out>, timeout=1000)
    at ../sysdeps/unix/sysv/linux/poll.c:87
#1  0x00007fdb5f4f7b3f in x11::SelectionManager::dispatchEvent (this=this@entry=0x2bb0ba0, millisec=millisec@entry=1000)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/vcl/unx/generic/dtrans/X11_selection.cxx:3736
#2  0x00007fdb5f4f7d95 in x11::SelectionManager::run (pThis=0x2bb0ba0)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/vcl/unx/generic/dtrans/X11_selection.cxx:3774
#3  0x00007fdb5f4e8a0c in call_SelectionManager_run (pMgr=0x2bb0ba0)
---Type <return> to continue, or q <return> to quit---
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/vcl/unx/generic/dtrans/X11_selection.cxx:108
#4  0x00007fdb6e7d552f in osl_thread_start_Impl (pData=0x2bbf3d0)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/sal/osl/unx/thread.c:261
(More stack frames follow...)

Thread 3 (Thread 0x7fdb59d40700 (LWP 6398)):
#0  0x00007fdb6daa562d in accept () at ../sysdeps/unix/syscall-template.S:82
#1  0x00007fdb6e7cbf00 in osl_acceptPipe (pPipe=0x27597a0)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/sal/osl/unx/pipe.c:467
#2  0x00007fdb6e54b246 in osl::Pipe::accept (this=this@entry=0x25b2c48, Connection=...)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/solver/unxlngx6/inc/osl/pipe.hxx:141
#3  0x00007fdb6e548aa2 in desktop::OfficeIPCThread::execute (this=0x25b2c20)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/desktop/source/app/officeipcthread.cxx:646
#4  0x00007fdb6c522ae8 in salhelper::Thread::run (this=0x25b2c20)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/salhelper/source/thread.cxx:60
(More stack frames follow...)

Thread 2 (Thread 0x7fdb53250700 (LWP 6415)):
#0  pthread_cond_timedwait@@GLIBC_2.3.2 () at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:216
#1  0x00007fdb6e817ca1 in osl_waitCondition (Condition=0x2c66a80, pTimeout=0x7fdb5324fca0)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/sal/osl/unx/conditn.cxx:264
#2  0x00007fdb58ba5824 in osl::Condition::wait (this=this@entry=0x7fdb5324fcb0, pTimeout=pTimeout@entry=0x7fdb5324fca0)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/solver/unxlngx6/inc/osl/conditn.hxx:84
#3  0x00007fdb58ba5641 in framework::WakeUpThread::run (this=0x2c66880)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/framework/source/helper/wakeupthread.cxx:63
#4  0x00007fdb58b94b10 in osl::threadFunc (param=0x2c66880)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/solver/unxlngx6/inc/osl/thread.hxx:196
(More stack frames follow...)

Thread 1 (Thread 0x7fdb5a541700 (LWP 6410)):
#0  0x00007fdb6bda9e67 in com::sun::star::uno::BaseReference::iquery (pInterface=pInterface@entry=0x2eb4178, 
    rType=invalid uno::Type)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/solver/unxlngx6/inc/com/sun/star/uno/Reference.hxx:52
#1  0x00007fdb6bdbd6a0 in com::sun::star::uno::Reference<com::sun::star::document::XEventListener>::iquery (
    pInterface=pInterface@entry=0x2eb4178)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/solver/unxlngx6/inc/com/sun/star/uno/Reference.hxx:67
#2  0x00007fdb6c092dd1 in com::sun::star::uno::Reference<com::sun::star::document::XEventListener>::Reference (this=
    0x7fdb5a540610, pInterface=0x2eb4178)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/solver/unxlngx6/inc/com/sun/star/uno/Reference.hxx:163
#3  0x00007fdb6c0a8da3 in cppu::OInterfaceContainerHelper::forEach<com::sun::star::document::XEventListener, cppu::OInterfaceContainerHelper::NotifySingleListener<com::sun::star::document::XEventListener, com::sun::star::document::EventObject> > (
    this=this@entry=0x278ae70, func=...)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/solver/unxlngx6/inc/cppuhelper/interfacecontainer.h:283
#4  0x00007fdb6c0a8048 in cppu::OInterfaceContainerHelper::notifyEach<com::sun::star::document::XEventListener, com::sun::star::document::EventObject> (this=this@entry=0x278ae70, 
    NotificationMethod=&virtual com::sun::star::document::XEventListener::notifyEvent(com::sun::star::document::EventObject const&), Event=...)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/solver/unxlngx6/inc/cppuhelper/interfacecontainer.h:303
(More stack frames follow...)
Comment 4 Lionel Elie Mamane 2012-10-03 09:38:50 UTC
(gdb) up
#1  0x00007fdb6bdbd6a0 in com::sun::star::uno::Reference<com::sun::star::document::XEventListener>::iquery (
    pInterface=pInterface@entry=0x2eb4178)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/solver/unxlngx6/inc/com/sun/star/uno/Reference.hxx:67
67	    return BaseReference::iquery(pInterface, interface_type::static_type());
(gdb) up
#2  0x00007fdb6c092dd1 in com::sun::star::uno::Reference<com::sun::star::document::XEventListener>::Reference (this=
    0x7fdb5a540610, pInterface=0x2eb4178)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/solver/unxlngx6/inc/com/sun/star/uno/Reference.hxx:163
163	    _pInterface = iquery( pInterface );
(gdb) up
#3  0x00007fdb6c0a8da3 in cppu::OInterfaceContainerHelper::forEach<com::sun::star::document::XEventListener, cppu::OInterfaceContainerHelper::NotifySingleListener<com::sun::star::document::XEventListener, com::sun::star::document::EventObject> > (
    this=this@entry=0x278ae70, func=...)
    at /home/master/src/libreoffice/workdirs/libreoffice-3.6/solver/unxlngx6/inc/cppuhelper/interfacecontainer.h:283
283	            iter.next(), ::com::sun::star::uno::UNO_QUERY );
(gdb) print iter
$18 = {
  rCont = @0x278ae70, 
  bIsList = 1 '\001', 
  aData = {
    pAsSequence = 0x2eb1830, 
    pAsInterface = 0x2eb1830
  }, 
  nRemain = 1
}
(gdb) print *iter.aData.pAsSequence
$19 = uno::Sequence of length 2 = {uno::Reference to {
  _vptr.XInterface = 0x7fdb5909f8c8
}, uno::Reference to {
  _vptr.XInterface = 0x51
}}
Comment 5 Julien Nabet 2012-12-27 07:50:18 UTC
Just for information, on pc Debian x86-64, I tried with 3.6, 4.0, master sources the 3 updated yesterday (and a brand new LO profile for each test).
Results:
- 3.6 KO
0x00007f15be3505cb in com::sun::star::uno::BaseReference::iquery (pInterface=0x3deabf8, rType=invalid uno::Type)
    at /home/julien/compile-libreoffice/libo_3_6/solver/unxlngx6/inc/com/sun/star/uno/Reference.hxx:52
52	        Any aRet( pInterface->queryInterface( rType ) );
(gdb) bt
#0  0x00007f15be3505cb in com::sun::star::uno::BaseReference::iquery (pInterface=0x3deabf8, rType=invalid uno::Type)
    at /home/julien/compile-libreoffice/libo_3_6/solver/unxlngx6/inc/com/sun/star/uno/Reference.hxx:52
#1  0x00007f15be363bbc in com::sun::star::uno::Reference<com::sun::star::document::XEventListener>::iquery (pInterface=0x3deabf8)
    at /home/julien/compile-libreoffice/libo_3_6/solver/unxlngx6/inc/com/sun/star/uno/Reference.hxx:67
#2  0x00007f15be63c5a9 in com::sun::star::uno::Reference<com::sun::star::document::XEventListener>::Reference (this=0x7f15a0cf8610, pInterface=0x3deabf8)
    at /home/julien/compile-libreoffice/libo_3_6/solver/unxlngx6/inc/com/sun/star/uno/Reference.hxx:163
#3  0x00007f15be652367 in cppu::OInterfaceContainerHelper::forEach<com::sun::star::document::XEventListener, cppu::OInterfaceContainerHelper::NotifySingleListener<com::sun::star::document::XEventListener, com::sun::star::document::EventObject> > (this=0x33ec9a0, func=...)
    at /home/julien/compile-libreoffice/libo_3_6/solver/unxlngx6/inc/cppuhelper/interfacecontainer.h:283
#4  0x00007f15be65160c in cppu::OInterfaceContainerHelper::notifyEach<com::sun::star::document::XEventListener, com::sun::star::document::EventObject> (this=0x33ec9a0, 
    NotificationMethod=&virtual com::sun::star::document::XEventListener::notifyEvent(com::sun::star::document::EventObject const&), Event=...)
    at /home/julien/compile-libreoffice/libo_3_6/solver/unxlngx6/inc/cppuhelper/interfacecontainer.h:303
#5  0x00007f15be64f9d6 in SfxGlobalEvents_Impl::implts_notifyListener (this=0x33ec920, aEvent=...)
    at /home/julien/compile-libreoffice/libo_3_6/sfx2/source/notify/eventsupplier.cxx:845
#6  0x00007f15be64e71d in SfxGlobalEvents_Impl::documentEventOccured (this=0x33ec920, _Event=...)
    at /home/julien/compile-libreoffice/libo_3_6/sfx2/source/notify/eventsupplier.cxx:653
#7  0x00007f15a534d295 in cppu::OInterfaceContainerHelper::NotifySingleListener<com::sun::star::document::XDocumentEventListener, com::sun::star::document::DocumentEvent>::operator() (this=0x7f15a0cf87d0, listener=
    uno::Reference to {<com::sun::star::lang::XEventListener> = {<com::sun::star::uno::XInterface> = {_vptr.XInterface = 0x7f15beaab7d0}, <No data fields>}, <No data fields>})
    at /home/julien/compile-libreoffice/libo_3_6/solver/unxlngx6/inc/cppuhelper/interfacecontainer.h:272
#8  0x00007f15a534d037 in cppu::OInterfaceContainerHelper::forEach<com::sun::star::document::XDocumentEventListener, cppu::OInterfaceContainerHelper::NotifySingleListener<com::sun::star::document::XDocumentEventListener, com::sun::star::document::DocumentEvent> > (this=0x369c098, func=...)
    at /home/julien/compile-libreoffice/libo_3_6/solver/unxlngx6/inc/cppuhelper/interfacecontainer.h:289
#9  0x00007f15a534cba2 in cppu::OInterfaceContainerHelper::notifyEach<com::sun::star::document::XDocumentEventListener, com::sun::star::document::DocumentEvent> (this=
    0x369c098, NotificationMethod=&virtual com::sun::star::document::XDocumentEventListener::documentEventOccured(com::sun::star::document::DocumentEvent const&), Event=...)
    at /home/julien/compile-libreoffice/libo_3_6/solver/unxlngx6/inc/cppuhelper/interfacecontainer.h:303
#10 0x00007f15a534b20e in dbaccess::DocumentEventNotifier_Impl::impl_notifyEvent_nothrow (this=0x369c050, _rEvent=...)
    at /home/julien/compile-libreoffice/libo_3_6/dbaccess/source/core/dataaccess/documenteventnotifier.cxx:216
#11 0x00007f15a534c0a9 in dbaccess::DocumentEventNotifier_Impl::processEvent (this=0x369c050, _rEvent=...)
    at /home/julien/compile-libreoffice/libo_3_6/dbaccess/source/core/dataaccess/documenteventnotifier.cxx:247
- 4.0 OK
- master OK
Comment 6 Lionel Elie Mamane 2012-12-27 16:22:04 UTC
Tried with 4.0. One time, did not get crash, but got error message 'CreateDocumentScriptProvider Unable to obtain document' or some such. Then, when I try again, I always get a crash again.
Comment 7 Lionel Elie Mamane 2012-12-27 16:22:29 UTC
Created attachment 72189 [details]
java error report
Comment 8 Lionel Elie Mamane 2012-12-27 16:25:02 UTC
Program terminated with signal 11, Segmentation fault.
#0  0x00007f5d6b93c084 in com::sun::star::uno::Reference<com::sun::star::uno::XInterface>::set (this=0x2dec9f8, 
    pInterface=0x2e25ec8)
    at /home/master/src/libreoffice/workdirs/libreoffice-4.0/solver/unxlngx6/inc/com/sun/star/uno/Reference.hxx:214
214	        castToXInterface(pInterface)->acquire();
(gdb) bt
#0  0x00007f5d6b93c084 in com::sun::star::uno::Reference<com::sun::star::uno::XInterface>::set (this=0x2dec9f8, pInterface=
    0x2e25ec8)
    at /home/master/src/libreoffice/workdirs/libreoffice-4.0/solver/unxlngx6/inc/com/sun/star/uno/Reference.hxx:214
#1  0x00007f5d6b98fd01 in com::sun::star::uno::Reference<com::sun::star::uno::XInterface>::operator= (this=0x2dec9f8, 
    pInterface=0x2e25ec8)
    at /home/master/src/libreoffice/workdirs/libreoffice-4.0/solver/unxlngx6/inc/com/sun/star/uno/Reference.hxx:324
#2  0x00007f5d6b98d7db in cppu::OInterfaceContainerHelper::addInterface (this=0x211a0e8, rListener=uno::Reference to {
  _vptr.XInterface = 0x7f5d53ea6ee8
}) at /home/master/src/libreoffice/workdirs/libreoffice-4.0/cppuhelper/source/interfacecontainer.cxx:225
#3  0x00007f5d6ad15c9f in SfxGlobalEvents_Impl::addEventListener (this=0x211a070, xListener=uno::Reference to {
  <com::sun::star::lang::XEventListener> = {
    <com::sun::star::uno::XInterface> = {
      _vptr.XInterface = 0x7f5d53ea6e50
    }, <No data fields>}, <No data fields>})
    at /home/master/src/libreoffice/workdirs/libreoffice-4.0/sfx2/source/notify/eventsupplier.cxx:585
#4  0x00007f5d539702ac in framework::AutoRecovery::implts_startListening (this=0x2f20f20)
    at /home/master/src/libreoffice/workdirs/libreoffice-4.0/framework/source/services/autorecovery.cxx:1387
#5  0x00007f5d5396a512 in framework::AutoRecovery::impl_initService (this=0x2f20f20)
    at /home/master/src/libreoffice/workdirs/libreoffice-4.0/framework/source/services/autorecovery.cxx:421

#6  0x00007f5d5396a3da in framework::AutoRecovery::impl_createInstance (xServiceManager=uno::Reference to {
  <com::sun::star::uno::XInterface> = {
    _vptr.XInterface = 0x7f5d6bc6a350
  }, <No data fields>})
    at /home/master/src/libreoffice/workdirs/libreoffice-4.0/framework/source/services/autorecovery.cxx:415
#7  0x00007f5d6b982036 in cppu::OSingleFactoryHelper::createInstanceEveryTime (this=0x2f352f8, xContext=uno::Reference to {
  <com::sun::star::uno::XInterface> = {
    _vptr.XInterface = 0x7f5d6bc69450
  }, <No data fields>}) at /home/master/src/libreoffice/workdirs/libreoffice-4.0/cppuhelper/source/factory.cxx:173
#8  0x00007f5d6b98224d in cppu::OSingleFactoryHelper::createInstanceWithContext (this=this@entry=0x2f352f8, xContext=
    uno::Reference to {
  <com::sun::star::uno::XInterface> = {
    _vptr.XInterface = 0x7f5d6bc69450
  }, <No data fields>}) at /home/master/src/libreoffice/workdirs/libreoffice-4.0/cppuhelper/source/factory.cxx:205
#9  0x00007f5d6b982c46 in cppu::OFactoryComponentHelper::createInstanceWithContext (this=0x2f35290, xContext=

    uno::Reference to {
  <com::sun::star::uno::XInterface> = {
    _vptr.XInterface = 0x7f5d6bc69450
  }, <No data fields>}) at /home/master/src/libreoffice/workdirs/libreoffice-4.0/cppuhelper/source/factory.cxx:471

#10 0x00007f5d6b947f5a in (anonymous namespace)::ServiceManager::createInstanceWithContext (this=0x1515610, 
    aServiceSpecifier="com.sun.star.frame.AutoRecovery", Context=uno::Reference to {
  <com::sun::star::uno::XInterface> = {
    _vptr.XInterface = 0x7f5d6bc69450
  }, <No data fields>}) at /home/master/src/libreoffice/workdirs/libreoffice-4.0/cppuhelper/source/defaultbootstrap.cxx:989
#11 0x00007f5d454262a3 in com::sun::star::frame::AutoRecovery::create (the_context=uno::Reference to {
  <com::sun::star::uno::XInterface> = {
    _vptr.XInterface = 0x7f5d6bc69450
  }, <No data fields>})
    at /home/master/src/libreoffice/workdirs/libreoffice-4.0/solver/unxlngx6/inc/offapi/com/sun/star/frame/AutoRecovery.hpp:26
#12 0x00007f5d4541a979 in svx::DocRecovery::RecoveryCore::impl_startListening (this=0x2f34610)
    at /home/master/src/libreoffice/workdirs/libreoffice-4.0/svx/source/dialog/docrecovery.cxx:570
#13 0x00007f5d45417a47 in svx::DocRecovery::RecoveryCore::RecoveryCore (this=0x2f34610, rxContext=uno::Reference to {
  <com::sun::star::uno::XInterface> = {
    _vptr.XInterface = 0x7f5d6bc69450
  }, <No data fields>}, bUsedForSaving=<optimized out>)
    at /home/master/src/libreoffice/workdirs/libreoffice-4.0/svx/source/dialog/docrecovery.cxx:134
#14 0x00007f5d4555bac1 in svx::RecoveryUI::impl_doEmergencySave (this=0x2f1a060)
    at /home/master/src/libreoffice/workdirs/libreoffice-4.0/svx/source/unodraw/recoveryui.cxx:255
Comment 9 Julien Nabet 2012-12-27 16:26:54 UTC
For information, here's my Java version:
java version "1.7.0_03"
OpenJDK Runtime Environment (IcedTea7 2.1.3) (7u3-2.1.3-1)
OpenJDK 64-Bit Server VM (build 22.0-b10, mixed mode)
Comment 10 tommy27 2013-08-24 17:00:59 UTC
for the record: no crash with 4.0.4 under Win7 64bit 

@Lionel Elie Mamane
do you still see this crash on recent LibO releases under Linux?
Comment 11 Alex Thurgood 2013-08-26 08:44:44 UTC
Still reproducible on OSX 64bit build from master :
Version: 4.2.0.0.alpha0+
Build ID: 22d1beb78a475e4846af945afde1c4d6c263b5d6

com.sun.star.uno.RuntimeExceptionScriptProtocolHandler::createScriptProvider(),  Unable to obtain document content factory!

On OSX, the app doesn't crash, but goes into a frozen/hung state (beachball syndrome), requiring force kill.


Alex
Comment 12 Alex Thurgood 2013-08-26 09:00:18 UTC
FWIW, I see the following bt, but don't have a debug build so no symbols :

(gdb) bt           
#0  0x00007fff8b39f122 in __psynch_mutexwait ()
#1  0x00007fff8f572dfd in pthread_mutex_lock ()
#2  0x00000001000046e0 in osl_acquireMutex ()
#3  0x0000000102050c6e in SalYieldMutex::acquire ()
#4  0x000000010208f892 in -[SalFrameWindow displayIfNeeded] ()
#5  0x00007fff921a91cc in _handleWindowNeedsDisplayOrLayoutOrUpdateConstraints ()
#6  0x00007fff92774901 in __83-[NSWindow _postWindowNeedsDisplayOrLayoutOrUpdateConstraintsUnlessPostingDisabled]_block_invoke_01208 ()
#7  0x00007fff8dbe2417 in __CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ ()
#8  0x00007fff8dbe2381 in __CFRunLoopDoObservers ()
#9  0x00007fff8dbbd7b8 in __CFRunLoopRun ()
#10 0x00007fff8dbbd0e2 in CFRunLoopRunSpecific ()
#11 0x00007fff94663eb4 in RunCurrentEventLoopInMode ()
#12 0x00007fff94663b94 in ReceiveNextEventCommon ()
#13 0x00007fff94663ae3 in BlockUntilNextEventMatchingListInMode ()
#14 0x00007fff921a6533 in _DPSNextEvent ()
#15 0x00007fff921a5df2 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] ()
#16 0x0000000102051800 in AquaSalInstance::Yield ()
#17 0x0000000101d49c17 in ImplYield ()
#18 0x0000000101d4768c in Application::Execute ()
#19 0x0000000100073606 in desktop::Desktop::Main ()
#20 0x0000000101d4dc74 in ImplSVMain ()
#21 0x0000000102051346 in AquaSalInstance::handleAppDefinedEvent ()
#22 0x0000000102085f7e in -[VCL_NSApplication sendEvent:] ()
#23 0x00007fff9219d21a in -[NSApplication run] ()
#24 0x00007fff92141bd6 in NSApplicationMain ()
#25 0x000000010205073b in ImplSVMainHook ()
#26 0x0000000101d4e80a in SVMain ()
#27 0x00000001000a10b6 in soffice_main ()
#28 0x0000000100000f00 in main ()
Comment 13 QA Administrators 2015-04-01 14:41:08 UTC Comment hidden (obsolete)
Comment 14 Alex Thurgood 2015-04-01 16:28:45 UTC
Tested on OSX 10.10.2 master :



crash.odb opens, but crash2.odb throws the following error and then LibreOffice hangs (spinning beachball)

com.sun.star.uno.RuntimeExceptionScriptProtocolHandler::createScriptProvider(),  Unable to obtain document content factory!

So bug still there. After a wait, the app crashes with :

# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0x0000000104a464fb, pid=54194, tid=42247
#
# JRE version: Java(TM) SE Runtime Environment (8.0_40-b25) (build 1.8.0_40-b25)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (25.40-b25 mixed mode bsd-amd64 compressed oops)
# Problematic frame:
# C  [libuno_cppuhelpergcc3.dylib.3+0x534fb]  _ZN4cppu24OInterfaceIteratorHelperC2ERNS_25OInterfaceContainerHelperE+0xeb
#
# Failed to write core dump. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# An error report file with more information is saved as:
# /Users/alex/hs_err_pid54194.log
#
# If you would like to submit a bug report, please visit:
#   http://bugreport.java.com/bugreport/crash.jsp
#
Abort trap: 6
Comment 15 Alex Thurgood 2015-04-01 16:32:17 UTC
Version: 4.5.0.0.alpha0+
Build ID: 09f83e1f409853a6c6e4300287c4e50bad5b9d0b
Locale: fr_

Tested version as above.
Comment 16 Julien Nabet 2015-04-01 19:04:10 UTC
Alex: could you attach /Users/alex/hs_err_pid54194.log ? It may contain useful info.
Comment 17 tommy27 2016-04-16 07:27:19 UTC Comment hidden (obsolete)
Comment 18 Commit Notification 2016-06-03 08:32:29 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=9334aa604f73bf659088c6a1cacba854cfdee5e4

Resolves: tdf#55566 opening two docs with open document macro events can crash

It will be available in 5.3.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 19 Commit Notification 2016-06-03 08:33:57 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-5-2":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=63c54ea482ad11b5fcb883f1583c62456cf34ba5&h=libreoffice-5-2

Resolves: tdf#55566 opening two docs with open document macro events can crash

It will be available in 5.2.0.1.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 20 Commit Notification 2016-06-03 08:51:26 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-5-1":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=f6ffb68e7fe9183bc7406341934bc8c55b3192df&h=libreoffice-5-1

Resolves: tdf#55566 opening two docs with open document macro events can crash

It will be available in 5.1.5.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.