Bug 97033 - EDITING - Malformed ODB file crashes when editing tables, queries, forms in master dbgutil
Summary: EDITING - Malformed ODB file crashes when editing tables, queries, forms in m...
Status: RESOLVED WORKSFORME
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Base (show other bugs)
Version:
(earliest affected)
5.2.0.0.alpha0+
Hardware: All All
: highest critical
Assignee: Not Assigned
URL:
Whiteboard:
Keywords: haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2016-01-11 08:20 UTC by Alex Thurgood
Modified: 2016-06-02 19:52 UTC (History)
5 users (show)

See Also:
Crash report or crash signature:


Attachments
test odb file (508.43 KB, application/vnd.oasis.opendocument.database)
2016-01-11 08:20 UTC, Alex Thurgood
Details
backtrace (29.90 KB, text/plain)
2016-01-11 08:21 UTC, Alex Thurgood
Details
Screenshot with a table open (80.88 KB, image/png)
2016-01-11 09:01 UTC, m_a_riosv
Details
Screen with table edited (73.36 KB, image/png)
2016-01-11 11:51 UTC, m_a_riosv
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Alex Thurgood 2016-01-11 08:20:10 UTC
Created attachment 121843 [details]
test odb file

This is a clone of bug 96938 which affects current master builds

LibreOffice crashes when editing the attached .odb file.  Base will open the file but as soon as I try do anything (access a table, query, form...), all LibreOffice windows will close without any error message, and a restart ofLibreOffice opens in recovery mode.

If I open this ODB file in my master build with lldb running, I see this :

warn:unoxml:45295:13:unoxml/source/dom/documentbuilder.cxx:296: libxml2 error: Extra content at the end of the document
Line: 544
Column: 1

Note that I see this after having attempted to change the first record in the very first table and seein LOdev bomb out on me when I tried to save the change or close the table window (I ignored the auto-recovery).

This is the output when attempting to save a change to the first record of the first table :
warn:vcl:45295:1:vcl/source/window/mouse.cxx:472: Window::ReleaseMouse(): window doesn't have the mouse capture
warn:legacy.osl:45295:1:include/cppuhelper/interfacecontainer.h:479: object is disposed
warn:legacy.osl:45295:1:include/cppuhelper/interfacecontainer.h:479: object is disposed
warn:legacy.osl:45295:9:connectivity/source/drivers/hsqldb/HStorageAccess.cxx:369: No Seekable stream!
warn:legacy.osl:45295:9:connectivity/source/drivers/hsqldb/HStorageAccess.cxx:221: Input stream is NULL!
2016-01-07T15:41:48.504+0100  SEVERE  DataFileCache.setFileModified
java.io.IOException: Stream is not valid
	at com.sun.star.sdbcx.comp.hsqldb.NativeStorageAccess.read(Native Method)
	at com.sun.star.sdbcx.comp.hsqldb.StorageAccess.readInt(StorageAccess.java:66)
	at org.hsqldb.persist.RAStorageWrapper.readInt(Unknown Source)
	at org.hsqldb.persist.DataFileCache.setFileModified(Unknown Source)
	at org.hsqldb.persist.DataFileCache.saveRows(Unknown Source)
	at org.hsqldb.persist.Cache.saveRows(Unknown Source)
	at org.hsqldb.persist.Cache.saveAll(Unknown Source)
	at org.hsqldb.persist.DataFileCache.defrag(Unknown Source)
	at org.hsqldb.persist.Log.defrag(Unknown Source)
	at org.hsqldb.persist.Log.checkpoint(Unknown Source)
	at org.hsqldb.persist.Logger.checkpointInternal(Unknown Source)
	at org.hsqldb.persist.Logger.checkpoint(Unknown Source)
	at org.hsqldb.StatementCommand.getResult(Unknown Source)
	at org.hsqldb.StatementCommand.execute(Unknown Source)
	at org.hsqldb.Session.executeCompiledStatement(Unknown Source)
	at org.hsqldb.Session.executeDirectStatement(Unknown Source)
	at org.hsqldb.Session.execute(Unknown Source)
	at org.hsqldb.jdbc.JDBCStatement.fetchResult(Unknown Source)
	at org.hsqldb.jdbc.JDBCStatement.execute(Unknown Source)


Process 45295 stopped
* thread #1: tid = 0x61b20a, 0x00000001067c717e libtllo.dylib`DbgUnhandledException(com::sun::star::uno::Any const&, char const*, char const*) + 926, queue = 'com.apple.main-thread', stop reason = signal SIGSEGV
    frame #0: 0x00000001067c717e libtllo.dylib`DbgUnhandledException(com::sun::star::uno::Any const&, char const*, char const*) + 926
libtllo.dylib`DbgUnhandledException(com::sun::star::uno::Any const&, char const*, char const*):
->  0x1067c717e <+926>: movq   0x8(%rcx), %rcx
    0x1067c7182 <+930>: movq   %rcx, -0x80(%rbp)
    0x1067c7186 <+934>: leaq   0xb5935(%rip), %rsi       ; "\ncontext: "
    0x1067c718d <+941>: leaq   -0x88(%rbp), %rdi
Comment 1 Alex Thurgood 2016-01-11 08:21:01 UTC
Created attachment 121844 [details]
backtrace
Comment 2 Alex Thurgood 2016-01-11 08:22:24 UTC
Confirmed by Julien in comment 14 of bug 96938
Comment 3 m_a_riosv 2016-01-11 09:01:06 UTC
Created attachment 121846 [details]
Screenshot with a table open

Hi @Alex,
I can't reproduce, with or without OpenGL enable.
Win10x64
Version: 5.2.0.0.alpha0+
Build ID: 22e5170af74c635cf55d089f97946b6dc86f82ad
CPU Threads: 4; OS Version: Windows 6.2; UI Render: default; 
TinderBox: Win-x86@62-merge-TDF, Branch:MASTER, Time: 2016-01-05_23:41:26

Java 1.8.0_66 x86.

Attached screenshot with a table open. No issue open queries or forms, but first report give 'General error' and others seems a bit slow.
Comment 4 Alex Thurgood 2016-01-11 11:45:07 UTC
@m.a.risov : It isn't the opening that is the problem, it is trying to edit any of the data in the records. What heppens when you try to edit the first text field of the first row of that table, then attempt to save the change, either by closing the table without clicking on the disk icon, or by clicking on the disk icon and then closing the table ?
Comment 5 m_a_riosv 2016-01-11 11:51:21 UTC
Created attachment 121855 [details]
Screen with table edited

Hi @Alex, sorry but nothing special happens.

As you can see in the screenshot, edited the first record, for text and number. I can close the table, close the DB, open it again and modified data is there.
Comment 6 m_a_riosv 2016-01-11 11:53:44 UTC
For confirmation, is verified that it's not a profile issue?
Comment 7 Julien Nabet 2016-01-11 20:58:54 UTC
Alex: your file seems corrupted.
Here's the result of a command (from pc Debian testing x86-64):
zip -T test.zip
reports/Obj11/settings.xml  bad CRC 6ca9dad9  (should be 0e002e59)
  error:  invalid compressed data to inflate forms/Obj61/Configurations2/accelerator/current.xml
Comment 8 Alex Thurgood 2016-01-14 09:24:41 UTC
Can you guys try this file :

http://bugs.documentfoundation.org/attachment.cgi?id=121759

this is the one I originally used to test, and as Julien says, the file I attached to this current bug report seems to have been corrupted by LO master (the XML stream must be missing a tag somewhere, or has had an unmatched tag inserted, when it crashed.

That being said, LO shouldn't crash on a malformed XML stream (especially, if it is one that it has created itself, e.g. due to a crash of the app.)
Comment 9 Alex Thurgood 2016-01-14 09:28:18 UTC
(In reply to Alex Thurgood from comment #8)
> Can you guys try this file :
> 
> http://bugs.documentfoundation.org/attachment.cgi?id=121759
> 
> this is the one I originally used to test, and as Julien says, the file I
> attached to this current bug report seems to have been corrupted by LO
> master (the XML stream must be missing a tag somewhere, or has had an
> unmatched tag inserted, when it crashed.
> 
> That being said, LO shouldn't crash on a malformed XML stream (especially,
> if it is one that it has created itself, e.g. due to a crash of the app.)

Oh, forget it, that file is already corrupt too. However, as I mentioned in bug 96938, LO5032 on Mac opens this corrupted file fine, whereas my master dbgutil build crashes when I try to edit anything in the same file (hence this particular bug report).
Comment 10 Alex Thurgood 2016-01-14 09:39:09 UTC
In lldb, the file is indicated as corrupt by this message :

warn:unoxml:45295:13:unoxml/source/dom/documentbuilder.cxx:296: libxml2 error: Extra content at the end of the document
Line: 544
Column: 1
Comment 11 Julien Nabet 2016-01-16 15:25:19 UTC
(In reply to Alex Thurgood from comment #10)
> In lldb, the file is indicated as corrupt by this message :
> 
> warn:unoxml:45295:13:unoxml/source/dom/documentbuilder.cxx:296: libxml2
> error: Extra content at the end of the document
> Line: 544
> Column: 1

About this error, it could linked to update checking process, see the bugtracker I created tdf#97175
Comment 12 Michael Stahl (allotropia) 2016-02-05 16:11:36 UTC
in a current Linux master build i've opened every table, query, form and report
in the document  http://bugs.documentfoundation.org/attachment.cgi?id=121759
but the only problem i've found is an assert that doesn't match the attached
backtrace at all, fixed with commit 7e349c0eee15fa0f9d8d71a3c9e311d2da62e670.

oh, one report didn't open with "general error", suppose that's the wrong CRC issue in the zip file.
Comment 13 Stephan Bergmann 2016-02-10 14:45:36 UTC
Cannot reproduce any problem opening attachment 121843 [details], opening "Book List" table, editing the first row's "Title" entry (by appending "1"), then clicking the "Save current record" icon; with a local 64-bit, --enable-dbgutil master build on Mac OS X 10.11.
Comment 14 Caolán McNamara 2016-06-02 19:52:14 UTC
no one can apparently reproduce this in master