[Libreoffice-bugs] [Bug 73294] Segmentation fault in libsvllo.so

[bugzilla-daemon]

https://bugs.documentfoundation.org/show_bug.cgi?id=73294

Jim Avera  changed:

   What|Removed |Added

 Status|NEEDINFO|RESOLVED
 Resolution|--- |WORKSFORME

--- Comment #23 from Jim Avera  ---
The 2nd demo (from comment #9) does not crash with 5.1.3.2

However there are some strange warnings written to the terminal about "Icons
too large" and "Unknown event notification".   I'll try on Master and file a
separate bug report if they persist.

Thanks for following up.  This bug report can be closed.

-- 
You are receiving this mail because:
You are the assignee for the bug.___
Libreoffice-bugs mailing list
Libreoffice-bugs@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs

[Libreoffice-bugs] [Bug 73294] Segmentation fault in libsvllo.so

[bugzilla-daemon]

https://bugs.documentfoundation.org/show_bug.cgi?id=73294

Julien Nabet  changed:

   What|Removed |Added

 Status|NEW |NEEDINFO

--- Comment #22 from Julien Nabet  ---
On pc Debian x86-64 with LO Debian package 5.1.4.1 (RC1), I don't reproduce
this now.

Jim: could you give a new try with recent LO version (last stable one is
5.1.3)?

-- 
You are receiving this mail because:
You are the assignee for the bug.___
Libreoffice-bugs mailing list
Libreoffice-bugs@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs

[Libreoffice-bugs] [Bug 73294] Segmentation fault in libsvllo.so

[bugzilla-daemon]

https://bugs.freedesktop.org/show_bug.cgi?id=73294

--- Comment #17 from Jim Avera jim.av...@gmail.com ---
I've got a cleaner valgrind run, and got the attached trace.  The main thing of
interest is:

Conditional jump or move depends on uninitialised value(s)
==12738==at 0x158DEF48: ??? (in
/usr/lib/libreoffice/program/libvclplug_gtklo.so)


To reproduce: 
 1. Copy instdir/program/soffice to soffice_patched in the same directory.
 2. At line 107 or thereabouts, add --track-origins=yes --free-fill=DE to
the valgrind command line, so it looks like this:

VALGRINDCHECK=valgrind --tool=$VALGRIND --trace-children=yes
$valgrind_skip --num-callers=50 --error-limit=no --track-origins=yes
--free-fill=DE

  3. Download the tickers.csv and t2.ods demo files from this bug
  4. instdir/program/soffice_patched --valgrind t2.ods log 21
  5. (patience...) Click the yellow button.   Repeat when everything stops.
 Hopefully it will segfault, but if not a valgrind error will be reported.

 If a pop-up says a copy/paste did not work, click 'Retry' (this occurs
when some Basic macro code thinks an operation it just performed had no effect
-- which might or might not be an LO bug, but in any case this does not usually
happen when not running under valgrind)

After a long while, look in the log file for valgrind errors

-- 
You are receiving this mail because:
You are the assignee for the bug.
___
Libreoffice-bugs mailing list
Libreoffice-bugs@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs

[Libreoffice-bugs] [Bug 73294] Segmentation fault in libsvllo.so

[bugzilla-daemon]

https://bugs.freedesktop.org/show_bug.cgi?id=73294

--- Comment #18 from Jim Avera jim.av...@gmail.com ---
Created attachment 110805
  -- https://bugs.freedesktop.org/attachment.cgi?id=110805action=edit
valgrind log showing conditional jump depending on uninit data

-- 
You are receiving this mail because:
You are the assignee for the bug.
___
Libreoffice-bugs mailing list
Libreoffice-bugs@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs

[Libreoffice-bugs] [Bug 73294] Segmentation fault in libsvllo.so

[bugzilla-daemon]

https://bugs.freedesktop.org/show_bug.cgi?id=73294

Jim Avera jim.av...@gmail.com changed:

   What|Removed |Added

 Attachment #110805|0   |1
is obsolete||

--- Comment #19 from Jim Avera jim.av...@gmail.com ---
Created attachment 110806
  -- https://bugs.freedesktop.org/attachment.cgi?id=110806action=edit
valgrind log showing conditional jump depending on uninit data

-- 
You are receiving this mail because:
You are the assignee for the bug.
___
Libreoffice-bugs mailing list
Libreoffice-bugs@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs

[Libreoffice-bugs] [Bug 73294] Segmentation fault in libsvllo.so

[bugzilla-daemon]

https://bugs.freedesktop.org/show_bug.cgi?id=73294

--- Comment #20 from Julien Nabet serval2...@yahoo.fr ---
Created attachment 110823
  -- https://bugs.freedesktop.org/attachment.cgi?id=110823action=edit
Valgrind trace with master sources

On pc Debian x86-64 with master sources updated today, I retrieved a Valgrind
trace with symbols.

-- 
You are receiving this mail because:
You are the assignee for the bug.
___
Libreoffice-bugs mailing list
Libreoffice-bugs@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs

[Libreoffice-bugs] [Bug 73294] Segmentation fault in libsvllo.so

[bugzilla-daemon]

https://bugs.freedesktop.org/show_bug.cgi?id=73294

--- Comment #14 from Julien Nabet serval2...@yahoo.fr ---
On pc Debian x86-64 with master sources updated today, I got a crash at first
click, here's main part of bt:
#3  0x2f5fd639 in
__gnu_debug::_Safe_iterator__gnu_cxx::__normal_iteratorSvtListener**,
std::__cxx1998::vectorSvtListener*, std::allocatorSvtListener*  ,
std::__debug::vectorSvtListener*, std::allocatorSvtListener* 
::_Safe_iterator (this=0x7fff0180, 
__i=error reading variable: Cannot access memory at address
0x, __seq=0x75405a0) at
/usr/include/c++/4.9/debug/safe_iterator.h:149
#4  0x2f5fbfdc in std::__debug::vectorSvtListener*,
std::allocatorSvtListener* ::end (this=0x75405a0) at
/usr/include/c++/4.9/debug/vector:236
#5  0x2f5fab18 in SvtBroadcaster::Normalize (this=0x7540598) at
/home/julien/compile-libreoffice/libreoffice/svl/source/notify/broadcast.cxx:28
#6  0x2f5fb9ca in SvtBroadcaster::Broadcast (this=0x7540598, rHint=...)
at
/home/julien/compile-libreoffice/libreoffice/svl/source/notify/broadcast.cxx:124
#7  0x2aaace1881a2 in ScBroadcastAreaSlotMachine::BulkBroadcastGroupAreas
(this=0x2c4ead0)
at
/home/julien/compile-libreoffice/libreoffice/sc/source/core/data/bcaslot.cxx:1236
#8  0x2aaace187cbc in ScBroadcastAreaSlotMachine::LeaveBulkBroadcast
(this=0x2c4ead0) at
/home/julien/compile-libreoffice/libreoffice/sc/source/core/data/bcaslot.cxx:1196
#9  0x2aaace3a18df in ScBulkBroadcast::~ScBulkBroadcast
(this=0x7fff0570, __in_chrg=optimized out)
at
/home/julien/compile-libreoffice/libreoffice/sc/source/core/inc/bcaslot.hxx:372
#10 0x2aaace5f8352 in ScTable::DeleteSelection (this=0x2aaadc872010,
nDelFlag=..., rMark=..., bBroadcast=true)
at
/home/julien/compile-libreoffice/libreoffice/sc/source/core/data/table2.cxx:455
#11 0x2aaace41650d in ScDocument::DeleteSelection (this=0x2c45f68,
nDelFlag=..., rMark=..., bBroadcast=true)
at
/home/julien/compile-libreoffice/libreoffice/sc/source/core/data/document.cxx:5569
#12 0x2aaaceb34f76 in ScDocFunc::DeleteContents (this=0x2b0b5c0, rMark=...,
nFlags=..., bRecord=true, bApi=false)
at
/home/julien/compile-libreoffice/libreoffice/sc/source/ui/docshell/docfunc.cxx:635
#13 0x2aaacf01d5f7 in ScViewFunc::DeleteContents (this=0x30a2378,
nFlags=..., bRecord=true)
at
/home/julien/compile-libreoffice/libreoffice/sc/source/ui/view/viewfunc.cxx:1788

-- 
You are receiving this mail because:
You are the assignee for the bug.
___
Libreoffice-bugs mailing list
Libreoffice-bugs@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs

[Libreoffice-bugs] [Bug 73294] Segmentation fault in libsvllo.so

[bugzilla-daemon]

https://bugs.freedesktop.org/show_bug.cgi?id=73294

Julien Nabet serval2...@yahoo.fr changed:

   What|Removed |Added

   Keywords||have-backtrace
 CC||serval2...@yahoo.fr

-- 
You are receiving this mail because:
You are the assignee for the bug.
___
Libreoffice-bugs mailing list
Libreoffice-bugs@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs

[Libreoffice-bugs] [Bug 73294] Segmentation fault in libsvllo.so

[bugzilla-daemon]

https://bugs.freedesktop.org/show_bug.cgi?id=73294

Julien Nabet serval2...@yahoo.fr changed:

   What|Removed |Added

 CC||er...@redhat.com

--- Comment #15 from Julien Nabet serval2...@yahoo.fr ---
Eike: I noticed broadcast part on bt but in svl, any idea?

-- 
You are receiving this mail because:
You are the assignee for the bug.
___
Libreoffice-bugs mailing list
Libreoffice-bugs@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs

[Libreoffice-bugs] [Bug 73294] Segmentation fault in libsvllo.so

[bugzilla-daemon]

https://bugs.freedesktop.org/show_bug.cgi?id=73294

--- Comment #16 from Jim Avera jim.av...@gmail.com ---
Running with valgrind discloses a couple of problems, both of which I think
indicate real bugs:

1. Valgrind reports some 8-byte reads which extend 4 bytes beyond the end of
malloc'd space.  This would cause unpredictable garbage to be returend in the
last 4 bytes, and might possibly explain some Basic macro bugs I've been
chasing which vanish when print statements are put in.   The 8 vs. 4 byte
lengths might indicate a bug in some low-level casts related to platform
word-size.  

This was previously reported but rejected as NOTABUG because the offending
code is somewhere in Phython bindings.  I don't see how it can not be a bug.

Please see https://bugs.freedesktop.org/show_bug.cgi?id=78513

2. Today I re-ran the test for the present bug under Valgring using the option
--free-fill=DE, which causes all free'd heap block to be filled with 0xDE
values.  Doing this made the demo behave very differently -- I got several
Basic errors I never saw before.   The implication is that LO is referencing
memory *after* it has been freed onto the heap. 


In summary, I strongly recommend running under valgrind and tracking down and
removing all references to undefined (i.e., not currently allocated) memory.

-- 
You are receiving this mail because:
You are the assignee for the bug.
___
Libreoffice-bugs mailing list
Libreoffice-bugs@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs

[Libreoffice-bugs] [Bug 73294] Segmentation fault in libsvllo.so

[bugzilla-daemon]

https://bugs.freedesktop.org/show_bug.cgi?id=73294

Jim Avera jim.av...@gmail.com changed:

   What|Removed |Added

Summary|signal 7 in |Segmentation fault in
   |ScFormulaCell::SetCellGroup |libsvllo.so
   |() when sort() called from  |
   |Basic   |

-- 
You are receiving this mail because:
You are the assignee for the bug.
___
Libreoffice-bugs mailing list
Libreoffice-bugs@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs