Download it now!
Bug 98729 - Crash when opening ODT with formulas
Summary: Crash when opening ODT with formulas
Status: RESOLVED DUPLICATE of bug 98622
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: graphics stack (show other bugs)
(earliest affected) Master
Hardware: All All
: high major
Assignee: Not Assigned
Keywords: bisected, haveBacktrace, regression
Depends on:
Reported: 2016-03-17 16:10 UTC by Pierre C
Modified: 2016-05-09 16:29 UTC (History)
6 users (show)

See Also:
Crash report or crash signature:

Test File (39.72 KB, application/vnd.oasis.opendocument.text)
2016-03-17 16:10 UTC, Pierre C
Crash Screenshot (112.32 KB, image/jpeg)
2016-03-17 16:12 UTC, Pierre C

Note You need to log in before you can comment on or make changes to this bug.
Description Pierre C 2016-03-17 16:10:34 UTC
Created attachment 123663 [details]
Test File

Just open the attached file -> Crash

QA French has confirmed the crash on different OS, but not always

If you can open the file, you may see that some formulas are invisible.

Workaround is easy, just double click on the formula and then click elsewhere. 

My OS : W10, tested with LO,, and today's build 5.1 branch (16/03/2016)
Comment 1 Pierre C 2016-03-17 16:12:25 UTC
Created attachment 123664 [details]
Crash Screenshot
Comment 2 Timur 2016-03-17 16:36:41 UTC
Confirmed. Should be checked for duplicates before setting as New. 

ModLoad: 0f2c0000 0f604000   S:\OFFICE\LO-OO-parallel\master\program\tklo.dll
ModLoad: 0f2c0000 0f604000   S:\OFFICE\LO-OO-parallel\master\program\tklo.dll
ModLoad: 61430000 6144a000   S:\OFFICE\LO-OO-parallel\master\program\ftransl.dll
ModLoad: 61590000 615a5000   S:\OFFICE\LO-OO-parallel\master\program\mcnttype.dll
(19b4.1c1c): C++ EH exception - code e06d7363 (first chance)
eax=00000000 ebx=0000014d ecx=00000000 edx=00000000 esi=77a92100 edi=77a920c0
eip=779afd02 esp=00d1c1d8 ebp=00d1c1f4 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
779afd02 83c404          add     esp,4

0:000> kb
ChildEBP RetAddr  Args to Child              
00d1c1d8 779e9c4e ffffffff 0000014d 00d1fbf8 ntdll!ZwTerminateProcess+0x12
00d1c1f4 76c279dc 00000000 77e8f3b0 ffffffff ntdll!RtlExitUserProcess+0x85
00d1c208 74783fac 0000014d 00d1c25c 7478427e kernel32!ExitProcessStub+0x12
00d1c214 7478427d 0000014d 95b76fe4 00d1fbf8 MSVCR120!__crtExitProcess+0x15 [f:\dd\vctools\crt\crtw32\startup\crt0dat.c @ 774]
00d1c25c 747cbbc7 0000014d 00000001 00000000 MSVCR120!doexit+0x115 [f:\dd\vctools\crt\crtw32\startup\crt0dat.c @ 678]
00d1c270 7417109b 0000014d 95b76a33 743ba7b4 MSVCR120!_exit+0xf [f:\dd\vctools\crt\crtw32\startup\crt0dat.c @ 433]
00d1c2b4 741758d7 00d1fa28 747697f2 00d1fbf8 sofficeapp!desktop::`anonymous namespace'::FatalError+0x10b [c:\cygwin\home\tinderbox\master\desktop\source\app\app.cxx @ 447]
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for S:\OFFICE\LO-OO-parallel\master\program\vcllo.dll - 
00d1fc04 6c9395fc 95b7533c 00d1fc3c 00000001 sofficeapp!desktop::Desktop::Main+0x1937 [c:\cygwin\home\tinderbox\master\desktop\source\app\app.cxx @ 1678]
WARNING: Stack unwind information not available. Following frames may be wrong.
00d1fc34 6c939a6f 00000000 00d1fcb4 741ad674 vcllo!DeInitVCL+0xecc
00d1fc40 741ad674 95b75433 7421674c 00000000 vcllo!SVMain+0x2f
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for S:\OFFICE\LO-OO-parallel\master\program\soffice.bin - 
00d1fcb4 012c100a 9566ad4a 00d1fccc 012c103a sofficeapp!soffice_main+0x74 [c:\cygwin\home\tinderbox\master\desktop\source\app\sofficemain.cxx @ 135]
00d1fcc0 012c103a 00278f38 00d1fce4 012c1078 soffice+0x100a
00d1fccc 012c1078 00000002 00278f38 00000002 soffice!main+0x1a
00d1fce4 012c12ce 012c0000 00000000 002141de soffice!main+0x58
00d1fd30 76c2337a 7efde000 00d1fd7c 779c9882 soffice!main+0x2ae
00d1fd3c 779c9882 7efde000 7680d44e 00000000 kernel32!BaseThreadInitThunk+0xe
00d1fd7c 779c9855 012c119f 7efde000 00000000 ntdll!__RtlUserThreadStart+0x70
00d1fd94 00000000 012c119f 7efde000 00000000 ntdll!_RtlUserThreadStart+0x1b

0:000> ~* kp

.  0  Id: 19b4.1c1c Suspend: 0 Teb: 7efdd000 Unfrozen
ChildEBP RetAddr  
00d1c1d8 779e9c4e ntdll!ZwTerminateProcess+0x12
00d1c1f4 76c279dc ntdll!RtlExitUserProcess+0x85
00d1c208 74783fac kernel32!ExitProcessStub+0x12
00d1c214 7478427d MSVCR120!__crtExitProcess(int status = <Value unavailable error>)+0x15 [f:\dd\vctools\crt\crtw32\startup\crt0dat.c @ 774]
00d1c25c 747cbbc7 MSVCR120!doexit(int code = 0n333, int quick = 0n1, int retcaller = 0n0)+0x115 [f:\dd\vctools\crt\crtw32\startup\crt0dat.c @ 678]
00d1c270 7417109b MSVCR120!_exit(int code = 0n333)+0xf [f:\dd\vctools\crt\crtw32\startup\crt0dat.c @ 433]
00d1c2b4 741758d7 sofficeapp!desktop::`anonymous namespace'::FatalError(class rtl::OUString * sMessage = 0x00d1fa28)+0x10b [c:\cygwin\home\tinderbox\master\desktop\source\app\app.cxx @ 447]
00d1fc04 6c9395fc sofficeapp!desktop::Desktop::Main(void)+0x1937 [c:\cygwin\home\tinderbox\master\desktop\source\app\app.cxx @ 1678]
WARNING: Stack unwind information not available. Following frames may be wrong.
00d1fc34 6c939a6f vcllo!DeInitVCL+0xecc
00d1fc40 741ad674 vcllo!SVMain+0x2f
00d1fcb4 012c100a sofficeapp!soffice_main(void)+0x74 [c:\cygwin\home\tinderbox\master\desktop\source\app\sofficemain.cxx @ 135]
00d1fcc0 012c103a soffice+0x100a
00d1fccc 012c1078 soffice!main+0x1a
00d1fce4 012c12ce soffice!main+0x58
00d1fd30 76c2337a soffice!main+0x2ae
00d1fd3c 779c9882 kernel32!BaseThreadInitThunk+0xe
00d1fd7c 779c9855 ntdll!__RtlUserThreadStart+0x70
00d1fd94 00000000 ntdll!_RtlUserThreadStart+0x1b
Comment 3 Pierre C 2016-03-17 17:01:30 UTC
All is fine With LO 4.4.7

With master dev 5.2 LO is very slow
Comment 4 Julien Nabet 2016-03-17 19:06:25 UTC
On pc Debian x86-64 with LO Debian package, no crash but formulaes 2, 3, 4, 5 and 6 are invisible at the opening (and visible after having applied the workaround described by the reporter).

On pc Debian x86-64 with master sources updated today, no crash and all formulaes visible at the opening.
Comment 5 royerjy 2016-03-17 19:43:55 UTC
I confirm the crash while opening the document with 5.1.3 64 bits on Linux.

Every thing is OK with Libo Version:
Build ID: 40m0(Build:2)
Locale : fr_FR
on the same machine.

Comment 6 raal 2016-03-17 19:52:25 UTC
No crash with win10>Version: (x64)
Build ID: 042f16a19e3d5f884759dae71264433b988df0e6
CPU Threads: 1; OS Version: Windows 6.1; UI Render: default; 
TinderBox: Win-x86_64@62-TDF, Branch:MASTER, Time: 2016-03-16_10:03:38
Crash in version

some formulas are invisible->  see bug 98667
Comment 7 tommy27 2016-03-20 19:31:02 UTC
tested under Win8.1 x64

LibO -> no crash
LibO -> crash after bad allocation error message
LibO alpha -> no crash

so this bug is a 5.1.x regression but it is fixed in 5.2.x and we can consider it as RESOLVED WORKSFORME

has anyone tried a recent 5.1.x daily build?
hopefully the issue is not present in future 5.1.2 release
but if the issue persists in 5.1.x branch a bibisect to identify the 5.2.x fixing committ should be attempted in order to backport it to 5.1.x
Comment 8 Pierre C 2016-03-20 22:18:28 UTC
As said in comment #0, bug is present in LO ; ; and what seems to be the latest 5.1 (16/03/2016)
Comment 9 tommy27 2016-03-21 06:17:56 UTC
thanks Pierre, I missed that.
so this reinforce the need of a reverse 5.2.x bibisect to backport to 5.1.
Comment 10 Terrence Enger 2016-04-06 19:33:46 UTC
I am changing keyword bibisectRequest to bisected.

Doing a *reverse* bibisect in the daily Win dbgutil bibisect
repository 5.2, I see, from `git bisect good` (newline added) ...

    8df61b71a38cbab777e01c47efdbdaaa1bd78b2f is the first bad commit
    commit 8df61b71a38cbab777e01c47efdbdaaa1bd78b2f
    Author: Norbert Thiebaud <>
    Date:   Fri Mar 18 23:52:12 2016 -0700

        source sha:c5bee7b8c1055e5052a261c8755bdb150fb27494

        source sha:c5bee7b8c1055e5052a261c8755bdb150fb27494

    :040000 040000 191f04fad31a645fcac64a4fc7c8a08fdeb440b1
    afc5c0c95cce761f M      instdir

and from `git bisect log` (newlines added) ..,

    # bad: [36d3af4cdd8285ce7a7d8db5088029686dea7368]
        source sha:f7a75a66fa46627aa6e
    # good: [1f670510f08cb800cbae2a1dd6ea70d3542e4721]
        source sha:49c2b9808df8a6b197
    git bisect start '36d3af4' 'oldest'
    # good: [246ffd82f06402d47674dd166825c9a8f7e7641e]
        source sha:0dfcb858c1e863f6df
    git bisect good 246ffd82f06402d47674dd166825c9a8f7e7641e
    # good: [0c01da0451c0040c5223a383452ee54fbad76049]
        source sha:0ba96ffcd8ee2296b5
    git bisect good 0c01da0451c0040c5223a383452ee54fbad76049
    # good: [ec163e0900b8419627b045624a6a6a17ec41fb9c]
        source sha:0ce8320eeb1df7eb4f
    git bisect good ec163e0900b8419627b045624a6a6a17ec41fb9c
    # bad: [aee8f9ea3aa4122ca04050cce006676cf6412b16]
        source sha:5de18e6a1fe643f1cf1
    git bisect bad aee8f9ea3aa4122ca04050cce006676cf6412b16
    # bad: [addad37cb62bc46f6c8b7ec4a747b16572dc9cd3]
        source sha:00fa85e701d4a8984cf
    git bisect bad addad37cb62bc46f6c8b7ec4a747b16572dc9cd3
    # bad: [14a7a9d7d9052d35e3250c8eb8d5bd6eb85dfdc9]
        source sha:5b3fee11f4019820cc1
    git bisect bad 14a7a9d7d9052d35e3250c8eb8d5bd6eb85dfdc9
    # bad: [8b4019841c4ac319b29b877bd6dfc731b686c702]
        source sha:4af2f26a955d172e8b7
    git bisect bad 8b4019841c4ac319b29b877bd6dfc731b686c702
    # bad: [8df61b71a38cbab777e01c47efdbdaaa1bd78b2f]
        source sha:c5bee7b8c1055e5052a
    git bisect bad 8df61b71a38cbab777e01c47efdbdaaa1bd78b2f
    # good: [ab39d3bd1481ea69213e7e6a6b6cae7566df747c]
        source sha:89e0663c55f7f17635
    git bisect good ab39d3bd1481ea69213e7e6a6b6cae7566df747c
    # good: [a95a9688c324d85a78a2950da8e102cb643d8c4b]
        source sha:d41c44f9048e1877c1
    git bisect good a95a9688c324d85a78a2950da8e102cb643d8c4b
    # good: [89b229b6430575a128cb817eb343a2ab7d7a1073]
        source sha:1edbb90c9e9296bec3
    git bisect good 89b229b6430575a128cb817eb343a2ab7d7a1073
    # good: [14e59a915a12742b0ef6152452692f6df23046d5]
        source sha:73443fd27881183765
    git bisect good 14e59a915a12742b0ef6152452692f6df23046d5
    # first bad commit: [8df61b71a38cbab777e01c47efdbdaaa1bd78b2f]
        source sha:c5bee7
Comment 11 Terrence Enger 2016-04-24 15:32:20 UTC
(In reply to Pierre C from comment #0)
> If you can open the file, you may see that some formulas are invisible.
> Workaround is easy, just double click on the formula and then click
> elsewhere. 

Let's keep comments about the temporary invisibilty of formulas in bug
99476, which reports just that problem.

Pierre C,
You can, of course, add yourself to the cc for bug 99476, if you care.
Comment 12 Michael Stahl (CIB) 2016-05-09 16:29:52 UTC
comment #10 points to

commit ceedd3c624873cd5dbdd76456a1540560a128a01
Author:     Noel Grandin <>
AuthorDate: Tue Mar 15 11:05:07 2016 +0200
Commit:     Miklos Vajna <>
CommitDate: Thu Mar 24 10:25:04 2016 +0000

    tdf#98600 and tdf#98622 fix metafile parsing
    regression from commit db17d3c1 "new loplugin: memoryvar"

=> already fixed in 5.1.3, resolving duplicate

*** This bug has been marked as a duplicate of bug 98622 ***