Download it now!
Bug 66141 - CRASH (OOM) while scrolling through a specific document
Summary: CRASH (OOM) while scrolling through a specific document
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
(earliest affected) release
Hardware: x86-64 (AMD64) Windows (All)
: medium normal
Assignee: Mike Kaganski
Whiteboard: target:5.0.0
Keywords: haveBacktrace
Depends on:
Reported: 2013-06-25 05:17 UTC by Mike Kaganski
Modified: 2015-04-30 08:32 UTC (History)
2 users (show)

See Also:
Crash report or crash signature:

Buggy document (65.12 KB, application/vnd.oasis.opendocument.text)
2013-06-25 05:17 UTC, Mike Kaganski
Bug 66141 - WinDbg session with FAILED_SOURCE_CODE (9.05 KB, text/plain)
2013-06-25 09:33 UTC, bfoman (inactive)

Note You need to log in before you can comment on or make changes to this bug.
Description Mike Kaganski 2013-06-25 05:17:15 UTC
Created attachment 81382 [details]
Buggy document

The attached document is a part of a large document created in LO 3.6.3. Suddenly it began to hang for a minute, then crash. The process monitor shows continuous consumption of memory in the frozen state until it reaches 1.7 GB.

If I select all and clear direct formatting, then the problem disappears.
Comment 1 bfoman (inactive) 2013-06-25 09:33:38 UTC
Created attachment 81401 [details]
Bug 66141 - WinDbg session with FAILED_SOURCE_CODE

Confirmed with:
Build ID: 2013-06-24 own debug build 
Windows 7 Professional SP1 64 bit

Crash at 1,7 GB memory usage after opening the file.

Attached full WinDbg session with FAILED_SOURCE_CODE.
Comment 2 bfoman (inactive) 2013-06-25 09:34:19 UTC
NEW as bug confirmed and bt attached.
Comment 3 Mike Kaganski 2013-06-25 10:43:15 UTC
The problem disappears if I comment out the following lines in content.xml:

    <style:style style:name="Таблица428.A" style:family="table-column">
      <style:table-column-properties style:column-width="2.044cm" style:rel-column-width="7485*"/>

    <style:style style:name="Таблица428.B" style:family="table-column">
      <style:table-column-properties style:column-width="9.005cm" style:rel-column-width="32974*"/>

    <style:style style:name="Таблица428.C" style:family="table-column">
      <style:table-column-properties style:column-width="6.629cm" style:rel-column-width="24274*"/>
    <style:style style:name="Таблица428.D" style:family="table-column">
      <style:table-column-properties style:column-width="0.219cm" style:rel-column-width="802*"/>
Comment 4 Julien Nabet 2013-06-26 21:09:38 UTC
On pc Debian x86-64 with master sources, no problem with the file.
However with 4.0.3 Debian packages, it hangs at the opening.

To complete information, could you give a try to 4.0.4 and, if you still have the problem, give a try to pre release 4.1 RC1 (see
Comment 5 Mike Kaganski 2013-06-26 21:50:25 UTC
4.0.4 is affected, too.

As shown in comment #1, alfa0 displays the same problem. Both under Windows x64.

I just wanted to clarify how to reproduce this hang. The document may be open without error, but if you scroll down the document, and then scroll up to top, then this problem happens. As I found out (it is noted in Comment #3), the problematic is the first table (it has the identifier "Таблица428"), and specifically the direct formatting of its columns (which looks absolutely innocent in the source xml).

I'll try to check with 4.1 ASAP (however, Comment #1 seems to make this useless).
Comment 6 Mike Kaganski 2013-06-27 01:57:22 UTC hangs and crashes at 1.7 GB, as expected.
Comment 7 Julien Nabet 2013-06-27 05:31:31 UTC
Mike: thank you for the feedback, i put it back to NEW
Comment 8 Mike Kaganski 2013-07-27 21:57:12 UTC
AOO 4.0 is affected, too.
Comment 9 Mike Kaganski 2014-02-03 00:31:31 UTC
In, it hangs and crashes without scrolling - right after opening.
Comment 10 Mike Kaganski 2015-04-26 15:48:18 UTC
Submitted patch to gerrit -
Comment 11 Commit Notification 2015-04-30 08:28:48 UTC
Mike committed a patch related to this issue.
It has been pushed to "master":

tdf#66141: SwTxtFrm::FormatQuick(bool) endless loop

It will be available in 5.0.0.

The patch should be included in the daily builds available at in the next 24-48 hours. More
information about daily builds can be found at:
Affected users are encouraged to test the fix and report feedback.
Comment 12 Caolán McNamara 2015-04-30 08:32:08 UTC
"If no ones going to fixes my bug then I'll just have to fix it myself" :-)