Bug 85032 - Crash on 4.4 master loading a particular file
Summary: Crash on 4.4 master loading a particular file
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
4.4.0.0.alpha0+ Master
Hardware: Other All
: high major
Assignee: Caolán McNamara
URL:
Whiteboard: BSA target:4.4.0
Keywords: haveBacktrace
Depends on:
Blocks:
 
Reported: 2014-10-15 07:25 UTC by Matthew Francis
Modified: 2014-10-15 12:52 UTC (History)
1 user (show)

See Also:
Crash report or crash signature:

Attachments
OSX backtrace (91.04 KB, text/plain)
2014-10-15 07:25 UTC, Matthew Francis 		Details
Linux backtrace (1.52 KB, text/plain)
2014-10-15 07:35 UTC, Matthew Francis 		Details
Linux memcheck log (2.82 MB, text/plain)
2014-10-15 07:50 UTC, Matthew Francis 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Matthew Francis 2014-10-15 07:25:04 UTC 
Loading https://www.libreoffice.org/bugzilla/attachment.cgi?id=107496 (from bug 84752) on 4.4 master leads to a crash. This appears to be a separate issue to the performance regression on the aforementioned bug

The same backtrace was observed on:
- OSX just from loading the file
- Linux when running under valgrind, but not otherwise
Comment 1 Matthew Francis 2014-10-15 07:25:59 UTC 
Created attachment 107852 [details]
OSX backtrace
Comment 2 Matthew Francis 2014-10-15 07:35:35 UTC 
Created attachment 107854 [details]
Linux backtrace

Annoyingly I can't yet reproduce this on Linux under memcheck - but callgrind did abort with the attached backtrace which is clearly the same as the OSX crash
Comment 3 Matthew Francis 2014-10-15 07:50:48 UTC 
Created attachment 107855 [details]
Linux memcheck log

Not sure how I failed to get this to work the first time, but here's a nice clear memcheck trace showing a bunch of invalid reads which relate to the backtrace of the crash
Comment 4 Caolán McNamara 2014-10-15 12:38:45 UTC 
I think this is going wrong in Edit::ImplDelete at the maText.remove line
Comment 5 Caolán McNamara 2014-10-15 12:43:44 UTC 
hmm, setting a SetMaxTextLen of -1, these used to be unsigned shorts, so that would have meant "max length" in the old days