soffice.bin crashed with SIGABRT in __libc_message()

[Felix Möller]

Hope this generates a good backtrace, I do not know how to reproduce.

ProblemType: Crash
DistroRelease: Ubuntu 12.10
Package: libreoffice-core 1:3.6.2~rc2-0ubuntu3
ProcVersionSignature: Ubuntu 3.5.0-17.28-generic 3.5.5
Uname: Linux 3.5.0-17-generic x86_64
ApportVersion: 2.6.1-0ubuntu3
Architecture: amd64
CrashCounter: 1
Date: Wed Oct 17 23:20:07 2012
ExecutablePath: /usr/lib/libreoffice/program/soffice.bin
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Beta amd64 (20120331)
ProcCmdline: /usr/lib/libreoffice/program/soffice.bin --writer --splash-pipe=6
ProcEnviron:
 PATH=(custom, user)
 LANG=de_DE.UTF-8
 SHELL=/bin/bash
Signal: 6
SourcePackage: libreoffice
StacktraceTop:
 raise () from /lib/x86_64-linux-gnu/libc.so.6
 abort () from /lib/x86_64-linux-gnu/libc.so.6
 ?? () from /lib/x86_64-linux-gnu/libc.so.6
 ?? () from /lib/x86_64-linux-gnu/libc.so.6
 ?? () from /usr/lib/ure/lib/introspection.uno.so
Title: soffice.bin crashed with SIGABRT in raise()
UpgradeStatus: Upgraded to quantal on 2012-08-02 (75 days ago)
UserGroups: adm cdrom dip lpadmin plugdev sambashare sudo
XsessionErrors:
 gnome-session[4822]: WARNING: Could not parse desktop file /home/fm/.config/autostart/sparkleshare.desktop: Diese Datei ist keine gültige .desktop-Datei
 gnome-session[4822]: WARNING: could not read /home/fm/.config/autostart/sparkleshare.desktop

[Apport retracing service (apport)]

StacktraceTop:
 __libc_message (do_abort=2, fmt=0x7fb03587d028 "*** glibc detected *** %s: %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:201
 malloc_printerr (action=3, str=0x7fb035879933 "free(): invalid pointer", ptr=<optimized out>) at malloc.c:5007
 deallocate (__p=0x27d04b0, this=<optimized out>) at /usr/include/c++/4.7/ext/new_allocator.h:100
 deallocate (__p=0x27d04b0, __a=..., __n=<optimized out>) at /usr/include/c++/4.7/bits/alloc_traits.h:375
 delete_node (n=0x27d04b0, this=<optimized out>) at /usr/include/boost/unordered/detail/buckets.hpp:398

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Björn Michaelsen (bjoern-michaelsen)]

this looks quite suspiciously similar to bug 1017125.

@Doko: Your take on this?

[Björn Michaelsen (bjoern-michaelsen)]

We do use the assumed to be bad boost::unordered_map::erase() from boost-1.49 here too:
https://gerrit.libreoffice.org/gitweb?p=core.git;a=blob;f=stoc/source/inspect/introspection.cxx;h=c0417cb2472ccf69465919103fcbc7ff4b2aad99;hb=da8c1e62c79033f0c895f81e019d23ce79aa6834#l2037

http://opengrok.libreoffice.org/xref/core/stoc/source/inspect/introspection.cxx#2015

[Björn Michaelsen (bjoern-michaelsen)]

This shows an initial spike on 2012-05-23:
https://errors.ubuntu.com/bucket/?id=%2Fusr%2Flib%2Flibreoffice%2Fprogram%2Fsoffice.bin%3A***%20glibc%20detected%20***%20%2Fusr%2Flib%2Flibreoffice%2Fprogram%2Fsoffice.bin%3A%20free%28%29%3A%20invalid%20pointer%3A%20ADDR%20***

Which is _before_ the boost update on 2012-05-25 and far from the libreoffice upload on 2012-05-11 (per quantal-changes list). However, suspiciously eglibc 2.15-0ubuntu12 and gcc-4.7 4.7.0-7ubuntu4 have been uploaded at that point in time.

I cant think of how eglibc is used in boosts data structures. but maybe libc and boost do not play nice together here?

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[anonymous mouse (eeefafe)]

I just had the crash reporter tell me that this bug is responsible for a crash. bug #1017125 says it's fixed. But obviously it isn't for me. I'm commenting here just to say I posted a document that crashes LibreOffice at that other bug.

[penalvch (penalvch)]

anonymous mouse, please post to 1017125 directly with your specific release.