Created attachment 84032 [details] simple .docx file that crashes Writer This happens on the latest from master, commit hash: ea4fc480c7317b16f4abbafacda3872bb7413357 writer crashes while opening this .docx file created by MS Office 2011. Here is the backtrace and the original .docx file is attached. Reading symbols for shared libraries . done libc++abi.dylib: terminate called throwing an exception Program received signal SIGABRT, Aborted. 0x95e52a6a in __pthread_kill () (gdb) bt #0 0x95e52a6a in __pthread_kill () #1 0x9022ab2f in pthread_kill () #2 0x902614ec in abort () #3 0x9141e7e0 in abort_message () #4 0x9141c249 in default_terminate () #5 0x9141c289 in safe_handler_caller () #6 0x9141c26e in unexpected_defaults_to_terminate () #7 0x9141c2cf in __cxxabiv1::__unexpected () #8 0x9141d1ad in __cxa_call_unexpected () #9 0x2887850a in WriterFilter::filter (this=0x2865b9b0, aDescriptor=@0xbfff5930) at /Users/sguo/lo/core/writerfilter/source/filter/ImportFilter.cxx:155 #10 0x28878559 in non-virtual thunk to WriterFilter::filter(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (this=0x2865b9c4, aDescriptor=@0xbfff5930) at /Users/sguo/lo/core/writerfilter/source/filter/ImportFilter.cxx:155 #11 0x01789cf5 in SfxObjectShell::ImportFrom (this=0x1300f380, rMedium=@0x1dcc2180, bInsert=false) at /Users/sguo/lo/core/sfx2/source/doc/objstor.cxx:2255 #12 0x0177d4ee in SfxObjectShell::DoLoad (this=0x1300f380, pMed=0x1dcc2180) at /Users/sguo/lo/core/sfx2/source/doc/objstor.cxx:752 #13 0x017d495b in SfxBaseModel::load (this=0x192745bc, seqArguments=@0xbfff6258) at /Users/sguo/lo/core/sfx2/source/doc/sfxbasemodel.cxx:1886 #14 0x017d59b9 in non-virtual thunk to SfxBaseModel::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (this=0x19274618, seqArguments=@0xbfff6258) at /Users/sguo/lo/core/sfx2/source/doc/sfxbasemodel.cxx:1962 #15 0x018d793b in SfxFrameLoader_Impl::load (this=0x1fad7bf4, rArgs=@0xbfff64c8, _rTargetFrame=@0xbfff6508) at /Users/sguo/lo/core/sfx2/source/view/frmload.cxx:597 #16 0x018d82e6 in non-virtual thunk to SfxFrameLoader_Impl::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) (this=0x1fad7c08, rArgs=@0xbfff64c8, _rTargetFrame=@0xbfff6508) at /Users/sguo/lo/core/sfx2/source/view/frmload.cxx:644 #17 0x1357cadf in framework::LoadEnv::impl_loadContent (this=0x1c2c5384) at /Users/sguo/lo/core/framework/source/loadenv/loadenv.cxx:1166 #18 0x135785e9 in framework::LoadEnv::startLoading (this=0x1c2c5384) at /Users/sguo/lo/core/framework/source/loadenv/loadenv.cxx:400 #19 0x134d9fc9 in framework::LoadDispatcher::impl_dispatch (this=0x1c2c5344, rURL=@0xbfff68b8, lArguments=@0xbfff6e28, xListener=@0xbfff6798) at /Users/sguo/lo/core/framework/source/dispatch/loaddispatcher.cxx:119 #20 0x134da645 in framework::LoadDispatcher::dispatchWithReturnValue (this=0x1c2c5344, rURL=@0xbfff68b8, lArguments=@0xbfff6e28) at /Users/sguo/lo/core/framework/source/dispatch/loaddispatcher.cxx:65 #21 0x134da6e8 in non-virtual thunk to framework::LoadDispatcher::dispatchWithReturnValue(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (this=0x1c2c535c, rURL=@0xbfff68b8, lArguments=@0xbfff6e28) at /Users/sguo/lo/core/framework/source/dispatch/loaddispatcher.cxx:66 #22 0x004eca8a in comphelper::SynchronousDispatch::dispatch (xStartPoint=@0xbfff6f20, sURL=@0xbfff6e10, sTarget=@0xbfff6e98, nFlags=0, lArguments=@0xbfff6e28) at /Users/sguo/lo/core/comphelper/source/misc/synchronousdispatch.cxx:69 #23 0x014342bc in SfxApplication::OpenDocExec_Impl (this=0x10662d90, rReq=@0xbfff78b8) at /Users/sguo/lo/core/sfx2/source/appl/appopen.cxx:1093 #24 0x01427004 in SfxStubSfxApplicationOpenDocExec_Impl (pShell=0x10662d90, rReq=@0xbfff78b8) at sfxslots.hxx:1208 #25 0x01553afa in SfxShell::CallExec (this=0x10662d90, pFunc=0x1426fe0 <SfxStubSfxApplicationOpenDocExec_Impl(SfxShell*, SfxRequest&)>, rReq=@0xbfff78b8) at shell.hxx:183 #26 0x0192d141 in SfxDispatcher::Call_Impl (this=0xeeb3ed0, rShell=@0x10662d90, rSlot=@0x1b5093c, rReq=@0xbfff78b8, bRecord=0 '\0') at /Users/sguo/lo/core/sfx2/source/control/dispatch.cxx:243 #27 0x0192fded in SfxDispatcher::_Execute (this=0xeeb3ed0, rShell=@0x10662d90, rSlot=@0x1b5093c, rReq=@0xbfff78b8, eCallMode=1) at /Users/sguo/lo/core/sfx2/source/control/dispatch.cxx:924 #28 0x019309ef in SfxDispatcher::Execute (this=0xeeb3ed0, nSlot=5501, eCall=1, nModi=0, rArgs=@0xb8e9380) at /Users/sguo/lo/core/sfx2/source/control/dispatch.cxx:1122 #29 0x019307d2 in SfxDispatcher::Execute (this=0xeeb3ed0, nSlot=5501, eCall=1, rArgs=@0xb8e9380) at /Users/sguo/lo/core/sfx2/source/control/dispatch.cxx:1094 #30 0x01431207 in SfxApplication::OpenDocExec_Impl (this=0x10662d90, rReq=@0xa1c1870) at /Users/sguo/lo/core/sfx2/source/appl/appopen.cxx:737 #31 0x01427004 in SfxStubSfxApplicationOpenDocExec_Impl (pShell=0x10662d90, rReq=@0xa1c1870) at sfxslots.hxx:1208 #32 0x01553afa in SfxShell::CallExec (this=0x10662d90, pFunc=0x1426fe0 <SfxStubSfxApplicationOpenDocExec_Impl(SfxShell*, SfxRequest&)>, rReq=@0xa1c1870) at shell.hxx:183 #33 0x0192d141 in SfxDispatcher::Call_Impl (this=0xeeb3ed0, rShell=@0x10662d90, rSlot=@0x1b5093c, rReq=@0xa1c1870, bRecord=1 '\001') at /Users/sguo/lo/core/sfx2/source/control/dispatch.cxx:243 #34 0x01930de2 in SfxDispatcher::PostMsgHandler (this=0xeeb3ed0, pReq=0xa1c1870) at /Users/sguo/lo/core/sfx2/source/control/dispatch.cxx:1222 #35 0x0192d674 in SfxDispatcher::LinkStubPostMsgHandler (pThis=0xeeb3ed0, pCaller=0xa1c1870) at /Users/sguo/lo/core/sfx2/source/control/dispatch.cxx:1193 #36 0x0012ea5a in Link::Call (this=0xeeb1ae8, pCaller=0xa1c1870) at link.hxx:123 #37 0x0183104d in GenLink::Call (this=0xeeb1ae8, pCaller=0xa1c1870) at genlink.hxx:45 #38 0x01830ec9 in SfxHintPoster::Event (this=0xeeb1ae0, pPostedHint=0xa1c1870) at /Users/sguo/lo/core/sfx2/source/notify/hintpost.cxx:62 #39 0x01830fd9 in SfxHintPoster::DoEvent_Impl (this=0xeeb1ae0, pPostedHint=0xa1c1870) at /Users/sguo/lo/core/sfx2/source/notify/hintpost.cxx:52 #40 0x01830e94 in SfxHintPoster::LinkStubDoEvent_Impl (pThis=0xeeb1ae0, pCaller=0xa1c1870) at /Users/sguo/lo/core/sfx2/source/notify/hintpost.cxx:56 #41 0x0012ea5a in Link::Call (this=0xa17aee0, pCaller=0xa1c1870) at link.hxx:123 #42 0x0585deaa in ImplHandleUserEvent (pSVEvent=0xa1931a0) at /Users/sguo/lo/core/vcl/source/window/winproc.cxx:1975 #43 0x0585aedb in ImplWindowFrameProc (pWindow=0xeeb57e0, nEvent=22, pEvent=0xa1931a0) at /Users/sguo/lo/core/vcl/source/window/winproc.cxx:2590 #44 0x0587dc76 in SalFrame::CallCallback (this=0xeeb5af0, nEvent=22, pEvent=0xa1931a0) at salframe.hxx:243 #45 0x0587b0b7 in AquaSalInstance::Yield (this=0xb8a8fa0, bWait=true, bHandleAllCurrentEvents=false) at /Users/sguo/lo/core/vcl/aqua/source/app/salinst.cxx:653 #46 0x052397b2 in ImplYield (i_bWait=true, i_bAllEvents=false) at /Users/sguo/lo/core/vcl/source/app/svapp.cxx:417 #47 0x052350ea in Application::Yield () at /Users/sguo/lo/core/vcl/source/app/svapp.cxx:451 #48 0x052350ab in Application::Execute () at /Users/sguo/lo/core/vcl/source/app/svapp.cxx:396 #49 0x0011ebd5 in desktop::Desktop::Main (this=0xbfff9a78) at /Users/sguo/lo/core/desktop/source/app/app.cxx:1720 #50 0x05245c01 in ImplSVMain () at /Users/sguo/lo/core/vcl/source/app/svmain.cxx:162 #51 0x0587a963 in AquaSalInstance::handleAppDefinedEvent (pEvent=0xa193f00) at /Users/sguo/lo/core/vcl/aqua/source/app/salinst.cxx:524 #52 0x058dccef in -[VCL_NSApplication sendEvent:] (self=0xa572fa0, _cmd=0x94e83db1, pEvent=0xa193f00) at /Users/sguo/lo/core/vcl/aqua/source/app/vclnsapp.mm:62 #53 0x9461d62c in -[NSApplication run] () #54 0x945c05f6 in NSApplicationMain () #55 0x05879726 in ImplSVMainHook (pnInit=0xbfff9a10) at /Users/sguo/lo/core/vcl/aqua/source/app/salinst.cxx:217 #56 0x052472ce in SVMain () at /Users/sguo/lo/core/vcl/source/app/svmain.cxx:195 #57 0x0018aac8 in soffice_main () at /Users/sguo/lo/core/desktop/source/app/sofficemain.cxx:81 #58 0x00001f5b in sal_main () at /Users/sguo/lo/core/desktop/source/app/main.c:48 #59 0x00001f40 in main (argc=5, argv=0xbfff9b20) at /Users/sguo/lo/core/desktop/source/app/main.c:47 (gdb)
Comment on attachment 84032 [details] simple .docx file that crashes Writer Mimetype fixed
On pc Debian x86-64 with master sources updated today, I reproduced the problem. With gdb session, I saw that the crash happened there: writerfilter/source/ooxml/OOXMLDocumentImpl.cxx at resolveFastSubStream(rStream, OOXMLStream::STYLES); package/source/xstor/xstorage.cxx there: 6047 xResult = m_pData->m_rHierarchyHolder->GetStreamHierarchically( 6048 ( m_pImpl->m_nStorageMode & embed::ElementModes::READWRITE ), 6049 aListPath, 6050 nOpenMode ); It's quite difficult to follow the code here, it seemed recursive to me.
I traced to the following code in package/source/xstor/xstorage.cxx, where the exception was thrown: SotElement_Impl* OStorage::OpenStreamElement_Impl( const OUString& aStreamName, sal_Int32 nOpenMode, sal_Bool bEncr ) { ::osl::MutexGuard aGuard( m_pData->m_rSharedMutexRef->GetMutex() ); OSL_ENSURE( !m_pData->m_bReadOnlyWrap || ( nOpenMode & embed::ElementModes::WRITE ) != embed::ElementModes::WRITE, "An element can not be opened for writing in readonly storage!\n" ); SotElement_Impl *pElement = m_pImpl->FindElement( aStreamName ); if ( !pElement ) { // element does not exist, check if creation is allowed if ( !( m_pImpl->m_nStorageMode & embed::ElementModes::WRITE ) || (( nOpenMode & embed::ElementModes::WRITE ) != embed::ElementModes::WRITE ) || ( nOpenMode & embed::ElementModes::NOCREATE ) == embed::ElementModes::NOCREATE ) throw io::IOException( OSL_LOG_PREFIX, uno::Reference< uno::XInterface >() ); // TODO: access_denied
Here is more gdb findings, the following statement: resolveFastSubStream(rStream, OOXMLStream::STYLES); caused the failure when trying to access "word/styles.xml" file in the zip storage. I checked the original a.docx file, it does not have that xml in it. It only has "word/stylesWithEffects.xml". I think we should not throw exception when "word/styles.xml" file is not present. Instead a default stream should be provided in case of missing that file.
Reddit: thank you for these debugging findings! Cédric/Michael: one for you?
hmm the document contains no styles.xml but a stylesWithEffects.xml, whatever that is. Cedric or Miklos may know if that requires additional handling. just catching the exception in the right place seems to prevent the crash. PS: lol, Mac OS X on Itanium :D
Michael Stahl committed a patch related to this issue. It has been pushed to "master": http://cgit.freedesktop.org/libreoffice/core/commit/?id=6e3ac01f850228afb5c6cb1a33b101693aea8712 fdo#68084: OOXML import: handle exceptions if stream is missing The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Michael Stahl committed a patch related to this issue. It has been pushed to "libreoffice-4-1": http://cgit.freedesktop.org/libreoffice/core/commit/?id=b697e302c1eb31afdcc3bbc916bd929ec96a6c70&h=libreoffice-4-1 fdo#68084: OOXML import: handle exceptions if stream is missing It will be available in LibreOffice 4.1.2. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Michael Stahl committed a patch related to this issue. It has been pushed to "libreoffice-4-0": http://cgit.freedesktop.org/libreoffice/core/commit/?id=5cc5a03d799434b51f67256a46d52b823870be94&h=libreoffice-4-0 fdo#68084: OOXML import: handle exceptions if stream is missing It will be available in LibreOffice 4.0.6. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
It's fixed on master. Thanks!