soffice.bin crashed with SIGSEGV in shared_count()

[Toby Smithe]

I'm trying to open a docx file (attached), which consistently produces this crash instantly.

WORKAROUND: Use AbiWord.

apt-cache policy abiword
abiword:
  Installed: 3.0.0~svn20130523-1ubuntu2
  Candidate: 3.0.0~svn20130523-1ubuntu2
  Version table:
 *** 3.0.0~svn20130523-1ubuntu2 0
        500 http://us.archive.ubuntu.com/ubuntu/ saucy/universe amd64 Packages
        100 /var/lib/dpkg/status

ProblemType: Crash
DistroRelease: Ubuntu 14.04
Package: libreoffice-core 1:4.1.2~rc3-0ubuntu2
Uname: Linux 3.11-6.dmz.1-liquorix-amd64 x86_64
ApportVersion: 2.12.6-0ubuntu1
Architecture: amd64
Date: Tue Nov 5 17:10:11 2013
EcryptfsInUse: Yes
ExecutablePath: /usr/lib/libreoffice/program/soffice.bin
ExecutableTimestamp: 1382386729
MarkForUpload: True
ProcCmdline: /usr/lib/libreoffice/program/soffice.bin --headless --accept=socket,port=8100;urp;
ProcCwd: /tmp
SegvAnalysis:
 Segfault happened at: 0x7f33624954af <_ZN12writerfilter7dmapper12DomainMapper8lcl_sprmERNS_4SprmE+47>: mov -0x8(%rax),%rbx
 PC (0x7f33624954af) ok
 source "-0x8(%rax)" (0x000001f8) not located in a known VMA region (needed readable region)!
 destination "%rbx" ok
 Stack memory exhausted (SP below stack segment)
SegvReason: reading NULL VMA
Signal: 11
SourcePackage: libreoffice
StacktraceTop:
 writerfilter::dmapper::DomainMapper::lcl_sprm(writerfilter::Sprm&) () from /usr/lib/libreoffice/program/../program/libwriterfilterlo.so
 ?? () from /usr/lib/libreoffice/program/../program/libwriterfilterlo.so
 ?? () from /usr/lib/libreoffice/program/../program/libwriterfilterlo.so
 writerfilter::dmapper::DomainMapper::lcl_props(boost::shared_ptr<writerfilter::Reference<writerfilter::Properties> >) () from /usr/lib/libreoffice/program/../program/libwriterfilterlo.so
 writerfilter::LoggedStream::props(boost::shared_ptr<writerfilter::Reference<writerfilter::Properties> >) () from /usr/lib/libreoffice/program/../program/libwriterfilterlo.so
Title: soffice.bin crashed with SIGSEGV in writerfilter::dmapper::DomainMapper::lcl_sprm()
UpgradeStatus: Upgraded to trusty on 2013-05-04 (184 days ago)
UserGroups: adm cdrom dip libvirtd lpadmin plugdev sambashare sudo tty vboxusers video

[Apport retracing service (apport)]

StacktraceTop:
 shared_count (r=..., this=<optimized out>) at /usr/include/boost/smart_ptr/detail/shared_count.hpp:377
 shared_ptr (r=..., this=<synthetic pointer>) at /usr/include/boost/smart_ptr/shared_ptr.hpp:397
 getTableManager (this=0x7f3368311f90) at /build/buildd/libreoffice-4.1.2~rc3/writerfilter/source/dmapper/DomainMapper_Impl.hxx:593
 writerfilter::dmapper::DomainMapper::lcl_sprm (this=0x7f336830f370, rSprm=...) at /build/buildd/libreoffice-4.1.2~rc3/writerfilter/source/dmapper/DomainMapper.cxx:1469
 writerfilter::ooxml::OOXMLPropertyImpl::resolve (this=0x7f33683b3360, rProperties=...) at /build/buildd/libreoffice-4.1.2~rc3/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx:170

[penalvch (penalvch)]

Toby Smithe, thank you for taking the time to report this bug and helping to make Ubuntu better. The issue you are reporting is an upstream one. It would be nice if somebody having it could send the bug to the developers of the software by following the instructions verbatim at http://wiki.documentfoundation.org/BugReport . If you have done so, please tell us the number of the upstream bug (or the link), so we can add a bugwatch that will inform us about the status. Thanks in advance.

Helpful bug reporting tips:
https://help.ubuntu.com/community/ReportingBugs

[Libreoffice-w (libreoffice-w)]

Trying to open a docx file immediately produces a crash. I'm forwarding the bug that I reported downstream in Ubuntu: https://bugs.launchpad.net/ubuntu/+source/libreoffice/+bug/1248263

The file that causes the crash is at https://bugs.launchpad.net/ubuntu/+source/libreoffice/+bug/1248263/+attachment/3900796/+files/aq131310162720369.docx

A stacktrace is available at https://launchpadlibrarian.net/155895337/Stacktrace.txt
Operating System: Ubuntu
Version: 4.1.2.3 release

[Toby Smithe (tsmithe)]

I have forwarded the bug upstream -- https://www.libreoffice.org/bugzilla/show_bug.cgi?id=71298

[julien2412 (serval2412-6)]

Created attachment 88938
console + bt

On pc Debian x86-64 with master sources updated today, I reproduced the crash.
I attached console logs + bt

[julien2412 (serval2412-6)]

Miklos: one for you?

[Caolanm (caolanm)]

Fixed on 4-3 and master branches now