Bug Hunting Session
Bug 90228 - ODT file crashes on load (dbgutil)
Summary: ODT file crashes on load (dbgutil)
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
4.5.0.0.alpha0+ Master
Hardware: Other All
: high major
Assignee: Caolán McNamara
URL:
Whiteboard: target:5.0.0 target:4.4.3
Keywords: haveBacktrace
Depends on:
Blocks:
 
Reported: 2015-03-25 13:36 UTC by Matthew Francis
Modified: 2015-04-16 21:11 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:


Attachments
console bt (15.69 KB, text/plain)
2015-03-25 20:52 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Matthew Francis 2015-03-25 13:36:16 UTC
Loading the ODT from attachment 114122 [details] (bug 89987) crashes since the below date:

commit e4365895727b3bee7db81df4b22463c03550d764
Author: Miklos Vajna <vmiklos@collabora.co.uk>
Date:   Wed Jan 14 05:25:14 2015 +0100

    2015-01-14: source-hash-066103b8a4e4930c72152f9af66022a25938dc1e

with

soffice.bin: /home/vmiklos/git/libreoffice/master/vcl/source/outdev/map.cxx:391: long int ImplLogicToPixel(long int, long int, long int, long int, long int): Assertion `std::abs(n) < std::numeric_limits<long>::max() / nMapNum / nDPI' failed.


This seems most likely to be a result of:

commit 482c57264708f783e70667fb1ac2d641cd25114a
Author: Stephan Bergmann <sbergman@redhat.com>
Date:   Tue Jan 13 10:07:34 2015 +0100

    Improve ImplLogicToPixel overflow check
    
    Change-Id: Ib0554f6d489e410527d7bf4dc77f76db1bdbf1fc
Comment 1 Julien Nabet 2015-03-25 20:52:29 UTC
Created attachment 114354 [details]
console bt

On pc Debian x86-64 with master sources updated yesterday, I could reproduce this.
Comment 2 Julien Nabet 2015-03-25 21:00:05 UTC
Considering ImplLogicToPixel (n=240, nDPI=96, nMapNum=920138888888889, nMapDenom=1250000000000000000, nThres=48), it seems Stephan's commit unhides a bug rather than triggers one.
If yes, I'd put Caolan and Chris on cc, if I'm wrong, I'd put Stephan in cc.
What do you think?
Comment 3 Matthew Francis 2015-03-30 07:27:07 UTC
(In reply to Julien Nabet from comment #2)
> Considering ImplLogicToPixel (n=240, nDPI=96, nMapNum=920138888888889,
> nMapDenom=1250000000000000000, nThres=48), it seems Stephan's commit unhides
> a bug rather than triggers one.

I think you're right about that - if you have an opinion on which of the above would be effective to Cc, then please feel free (which Chris?)
Comment 4 Julien Nabet 2015-03-30 07:44:09 UTC
Caolan/Chris: one for you? (bt shows a problem in vcl part)
Comment 5 Commit Notification 2015-03-31 12:39:31 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=2ec9d9dd81f3f4ee6785ba938f9a79395972b71e

Resolves: tdf#90228 1.06 turns into a monster

It will be available in 4.5.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 6 Commit Notification 2015-04-16 16:11:43 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=d5fdff3e8984c40435bc1093c8ca6820bd635f5a

Resolves: tdf#90228 1.06 turns into a monster

It will be available in 5.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 7 Adolfo Jayme 2015-04-16 16:16:10 UTC
The last commit was pushed to 4-3-7, not master.
Comment 8 Adolfo Jayme 2015-04-16 16:18:28 UTC
I meant 4-4-3. Sorry…
Comment 9 Commit Notification 2015-04-16 21:11:13 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=aec373f9f43a032e465bb4ef61a6d15557f50399

Resolves: tdf#90228 1.06 turns into a monster

It will be available in 5.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.