Bug 66496 - FILEOPEN: Crash when opening .docx
Summary: FILEOPEN: Crash when opening .docx
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: LibreOffice (show other bugs)
Version:
(earliest affected)
4.0.3.3 release
Hardware: x86-64 (AMD64) Linux (All)
: high major
Assignee: Caolán McNamara
URL:
Whiteboard: target:4.4.0 target:4.3.3
Keywords: haveBacktrace
Depends on:
Blocks:
 
Reported: 2013-07-02 09:57 UTC by Tristan Miller
Modified: 2014-09-16 08:54 UTC (History)
5 users (show)

See Also:
Crash report or crash signature:


Attachments
.docx file which causes LibreOffice to crash on file open (19.81 KB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2013-07-02 09:57 UTC, Tristan Miller
Details
Error report file referenced in bug report (144.06 KB, text/plain)
2013-07-02 09:59 UTC, Tristan Miller
Details
console + bt with symbols on master sources (33.48 KB, text/plain)
2013-07-02 19:39 UTC, Julien Nabet
Details
some changes (2.24 KB, text/plain)
2013-07-02 19:42 UTC, Julien Nabet
Details
bt with symbols (23.32 KB, text/plain)
2013-12-29 08:50 UTC, Julien Nabet
Details
console_bt with master sources (23.99 KB, application/octet-stream)
2014-07-29 20:16 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Tristan Miller 2013-07-02 09:57:52 UTC
Created attachment 81862 [details]
.docx file which causes LibreOffice to crash on file open

LibreOffice crashes when opening the attached .docx file:

$ libreoffice foo.docx 
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0x00007f7e475643e4, pid=7882, tid=140181179169152
#
# JRE version: 7.0_21-b02
# Java VM: OpenJDK 64-Bit Server VM (23.7-b01 mixed mode linux-amd64 compressed oops)
# Problematic frame:
# C  [libswlo.so+0x4fc3e4]  SwTxtNode::IsCollapse() const+0x9004
#
# Core dump written. Default location: /home/miller/Windows/core or core.7882
#
# An error report file with more information is saved as:
# /home/miller/Windows/hs_err_pid7882.log
#
# If you would like to submit a bug report, please include
# instructions on how to reproduce the bug and visit:
#   http://icedtea.classpath.org/bugzilla
#
Comment 1 Tristan Miller 2013-07-02 09:59:16 UTC
Created attachment 81863 [details]
Error report file referenced in bug report
Comment 2 Tristan Miller 2013-07-02 10:01:17 UTC
I can also provide the core file referenced in the previous comment, though it's too large to upload to Bugzilla (about 11 MB compressed).
Comment 3 Julien Nabet 2013-07-02 19:39:06 UTC
Created attachment 81903 [details]
console + bt with symbols on master sources

On pc Debian x86-64 with master sources updated today, I reproduced the crash.

I attached console logs + bt
Comment 4 Julien Nabet 2013-07-02 19:42:13 UTC
Created attachment 81904 [details]
some changes

I tried change after change to fix this (see attachment) but still have a segfault, here's the last bt I get:
 Program received signal SIGSEGV, Segmentation fault.
0x00007ffad9124002 in ViewShell::Imp (this=0x2e6e65646e) at /home/julien/compile-libreoffice/libreoffice/sw/inc/viewsh.hxx:200
200	          SwViewImp *Imp() { return mpImp; }
(gdb) bt
#0  0x00007ffad9124002 in ViewShell::Imp (this=0x2e6e65646e) at /home/julien/compile-libreoffice/libreoffice/sw/inc/viewsh.hxx:200
#1  0x00007ffad956dc78 in SwFlowFrm::MoveSubTree (this=0x62b8ba0, pParent=0x62bf630, pSibling=0x0)
    at /home/julien/compile-libreoffice/libreoffice/sw/source/core/layout/flowfrm.cxx:606
#2  0x00007ffad95a201b in SwCntntFrm::MoveFtnCntFwd (this=0x62b8ac0, bMakePage=1 '\001', pOldBoss=0x353dac0)
    at /home/julien/compile-libreoffice/libreoffice/sw/source/core/layout/ftnfrm.cxx:3082
#3  0x00007ffad95713ac in SwFlowFrm::MoveFwd (this=0x62b8ba8, bMakePage=1 '\001', bPageBreak=0 '\000', bMoveAlways=0 '\000')
    at /home/julien/compile-libreoffice/libreoffice/sw/source/core/layout/flowfrm.cxx:1941
#4  0x00007ffad962b4a2 in SwTabFrm::MakeAll (this=0x62b8ac0) at /home/julien/compile-libreoffice/libreoffice/sw/source/core/layout/tabfrm.cxx:2576
#5  0x00007ffad95584c4 in SwFrm::PrepareMake (this=0x62b8ac0) at /home/julien/compile-libreoffice/libreoffice/sw/source/core/layout/calcmove.cxx:362
...
Comment 5 Julien Nabet 2013-07-02 19:43:02 UTC
Cédric/Michael: one for you? (bt attached + some changes proposed)
Comment 6 Jorendc 2013-12-29 00:26:43 UTC
Tested using Windows 8.1 with LibreOffice Version: 4.1.4.2
Build ID: 0a0440ccc0227ad9829de5f46be37cfb6edcf72 the document does NOT crash.

@Julien, Tristan: Still an issue on Linux (Linux only :) ? )
Comment 7 Julien Nabet 2013-12-29 08:50:31 UTC
Created attachment 91270 [details]
bt with symbols

With master sources updated 2 days ago, I had a crash too (attached bt)

I also got a crash with Debian LO package (4.1.3.2).
Comment 8 Julien Nabet 2014-07-29 20:16:27 UTC
Created attachment 103656 [details]
console_bt with master sources

On pc Debian x86-64 with master sources updated today, I could still reproduce this.
Comment 9 Julien Nabet 2014-07-29 20:19:38 UTC
Increase a bit importance since crash.

Miklos: noticing http://cgit.freedesktop.org/libreoffice/core/commit/?id=ad913681c0e0cdaaa706329f518f59ee54b86d43, I thought you might be interested in this one. (didn't say the commit triggered the problem! :-) Just meant you'd perhaps have an idea of the problem)
Comment 11 Commit Notification 2014-09-16 08:54:04 UTC
Caolan McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-4-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=6da201e1cb5fc1cb9d0f3c27270f98fd2eb03eef&h=libreoffice-4-3

Resolves: fdo#66496 don't crash on loading specific .docx


It will be available in LibreOffice 4.3.3.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.