Bug Hunting Session
Bug 66141 - CRASH (OOM) while scrolling through a specific document
Summary: CRASH (OOM) while scrolling through a specific document
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
3.6.3.2 release
Hardware: x86-64 (AMD64) Windows (All)
: medium normal
Assignee: Mike Kaganski
URL:
Whiteboard: target:5.0.0
Keywords: haveBacktrace
Depends on:
Blocks:
 
Reported: 2013-06-25 05:17 UTC by Mike Kaganski
Modified: 2015-04-30 08:32 UTC (History)
2 users (show)

See Also:
Crash report or crash signature:


Attachments
Buggy document (65.12 KB, application/vnd.oasis.opendocument.text)
2013-06-25 05:17 UTC, Mike Kaganski
Details
Bug 66141 - WinDbg session with FAILED_SOURCE_CODE (9.05 KB, text/plain)
2013-06-25 09:33 UTC, bfoman (inactive)
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Mike Kaganski 2013-06-25 05:17:15 UTC
Created attachment 81382 [details]
Buggy document

The attached document is a part of a large document created in LO 3.6.3. Suddenly it began to hang for a minute, then crash. The process monitor shows continuous consumption of memory in the frozen state until it reaches 1.7 GB.

If I select all and clear direct formatting, then the problem disappears.
Comment 1 bfoman (inactive) 2013-06-25 09:33:38 UTC
Created attachment 81401 [details]
Bug 66141 - WinDbg session with FAILED_SOURCE_CODE

Confirmed with:
LO 4.2.0.0.alfa0
Build ID: 2013-06-24 own debug build 
Windows 7 Professional SP1 64 bit

Crash at 1,7 GB memory usage after opening the file.

Attached full WinDbg session with FAILED_SOURCE_CODE.
Comment 2 bfoman (inactive) 2013-06-25 09:34:19 UTC
NEW as bug confirmed and bt attached.
Comment 3 Mike Kaganski 2013-06-25 10:43:15 UTC
The problem disappears if I comment out the following lines in content.xml:

<!--
    <style:style style:name="Таблица428.A" style:family="table-column">
      <style:table-column-properties style:column-width="2.044cm" style:rel-column-width="7485*"/>
    </style:style>

    <style:style style:name="Таблица428.B" style:family="table-column">
      <style:table-column-properties style:column-width="9.005cm" style:rel-column-width="32974*"/>
    </style:style>

    <style:style style:name="Таблица428.C" style:family="table-column">
      <style:table-column-properties style:column-width="6.629cm" style:rel-column-width="24274*"/>
    </style:style>
    
    <style:style style:name="Таблица428.D" style:family="table-column">
      <style:table-column-properties style:column-width="0.219cm" style:rel-column-width="802*"/>
    </style:style>
-->
Comment 4 Julien Nabet 2013-06-26 21:09:38 UTC
On pc Debian x86-64 with master sources, no problem with the file.
However with 4.0.3 Debian packages, it hangs at the opening.

To complete information, could you give a try to 4.0.4 and, if you still have the problem, give a try to pre release 4.1 RC1 (see http://www.libreoffice.org/download/pre-releases/)?
Comment 5 Mike Kaganski 2013-06-26 21:50:25 UTC
4.0.4 is affected, too.

As shown in comment #1, 4.2.0.0 alfa0 displays the same problem. Both under Windows x64.

I just wanted to clarify how to reproduce this hang. The document may be open without error, but if you scroll down the document, and then scroll up to top, then this problem happens. As I found out (it is noted in Comment #3), the problematic is the first table (it has the identifier "Таблица428"), and specifically the direct formatting of its columns (which looks absolutely innocent in the source xml).

I'll try to check with 4.1 ASAP (however, Comment #1 seems to make this useless).
Comment 6 Mike Kaganski 2013-06-27 01:57:22 UTC
4.1.0.1 hangs and crashes at 1.7 GB, as expected.
Comment 7 Julien Nabet 2013-06-27 05:31:31 UTC
Mike: thank you for the feedback, i put it back to NEW
Comment 8 Mike Kaganski 2013-07-27 21:57:12 UTC
AOO 4.0 is affected, too.
Comment 9 Mike Kaganski 2014-02-03 00:31:31 UTC
In 4.2.0.4, it hangs and crashes without scrolling - right after opening.
Comment 10 Mike Kaganski 2015-04-26 15:48:18 UTC
Submitted patch to gerrit - https://gerrit.libreoffice.org/15542
Comment 11 Commit Notification 2015-04-30 08:28:48 UTC
Mike committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=8a08f68669f9acfe98dadcca4af6519164a17000

tdf#66141: SwTxtFrm::FormatQuick(bool) endless loop

It will be available in 5.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 12 Caolán McNamara 2015-04-30 08:32:08 UTC
"If no ones going to fixes my bug then I'll just have to fix it myself" :-)