soffice.bin crashed with SIGSEGV in shared_count()

Bug #1248263 reported by Toby Smithe on 2013-11-05
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Fix Released
libreoffice (Ubuntu)

Bug Description

I'm trying to open a docx file (attached), which consistently produces this crash instantly.


apt-cache policy abiword
  Installed: 3.0.0~svn20130523-1ubuntu2
  Candidate: 3.0.0~svn20130523-1ubuntu2
  Version table:
 *** 3.0.0~svn20130523-1ubuntu2 0
        500 saucy/universe amd64 Packages
        100 /var/lib/dpkg/status

ProblemType: Crash
DistroRelease: Ubuntu 14.04
Package: libreoffice-core 1:4.1.2~rc3-0ubuntu2
Uname: Linux 3.11-6.dmz.1-liquorix-amd64 x86_64
ApportVersion: 2.12.6-0ubuntu1
Architecture: amd64
Date: Tue Nov 5 17:10:11 2013
EcryptfsInUse: Yes
ExecutablePath: /usr/lib/libreoffice/program/soffice.bin
ExecutableTimestamp: 1382386729
MarkForUpload: True
ProcCmdline: /usr/lib/libreoffice/program/soffice.bin --headless --accept=socket,port=8100;urp;
ProcCwd: /tmp
 Segfault happened at: 0x7f33624954af <_ZN12writerfilter7dmapper12DomainMapper8lcl_sprmERNS_4SprmE+47>: mov -0x8(%rax),%rbx
 PC (0x7f33624954af) ok
 source "-0x8(%rax)" (0x000001f8) not located in a known VMA region (needed readable region)!
 destination "%rbx" ok
 Stack memory exhausted (SP below stack segment)
SegvReason: reading NULL VMA
Signal: 11
SourcePackage: libreoffice
 writerfilter::dmapper::DomainMapper::lcl_sprm(writerfilter::Sprm&) () from /usr/lib/libreoffice/program/../program/
 ?? () from /usr/lib/libreoffice/program/../program/
 ?? () from /usr/lib/libreoffice/program/../program/
 writerfilter::dmapper::DomainMapper::lcl_props(boost::shared_ptr<writerfilter::Reference<writerfilter::Properties> >) () from /usr/lib/libreoffice/program/../program/
 writerfilter::LoggedStream::props(boost::shared_ptr<writerfilter::Reference<writerfilter::Properties> >) () from /usr/lib/libreoffice/program/../program/
Title: soffice.bin crashed with SIGSEGV in writerfilter::dmapper::DomainMapper::lcl_sprm()
UpgradeStatus: Upgraded to trusty on 2013-05-04 (184 days ago)
UserGroups: adm cdrom dip libvirtd lpadmin plugdev sambashare sudo tty vboxusers video

Toby Smithe (tsmithe) wrote :

 shared_count (r=..., this=<optimized out>) at /usr/include/boost/smart_ptr/detail/shared_count.hpp:377
 shared_ptr (r=..., this=<synthetic pointer>) at /usr/include/boost/smart_ptr/shared_ptr.hpp:397
 getTableManager (this=0x7f3368311f90) at /build/buildd/libreoffice-4.1.2~rc3/writerfilter/source/dmapper/DomainMapper_Impl.hxx:593
 writerfilter::dmapper::DomainMapper::lcl_sprm (this=0x7f336830f370, rSprm=...) at /build/buildd/libreoffice-4.1.2~rc3/writerfilter/source/dmapper/DomainMapper.cxx:1469
 writerfilter::ooxml::OOXMLPropertyImpl::resolve (this=0x7f33683b3360, rProperties=...) at /build/buildd/libreoffice-4.1.2~rc3/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx:170

Changed in libreoffice (Ubuntu):
importance: Undecided → Medium
summary: - soffice.bin crashed with SIGSEGV in
- writerfilter::dmapper::DomainMapper::lcl_sprm()
+ soffice.bin crashed with SIGSEGV in shared_count()
tags: removed: need-amd64-retrace
description: updated

Toby Smithe, thank you for taking the time to report this bug and helping to make Ubuntu better. The issue you are reporting is an upstream one. It would be nice if somebody having it could send the bug to the developers of the software by following the instructions verbatim at . If you have done so, please tell us the number of the upstream bug (or the link), so we can add a bugwatch that will inform us about the status. Thanks in advance.

Helpful bug reporting tips:

description: updated
tags: added: saucy
Changed in libreoffice (Ubuntu):
status: New → Triaged
Toby Smithe (tsmithe) on 2013-11-06
information type: Private → Public

Trying to open a docx file immediately produces a crash. I'm forwarding the bug that I reported downstream in Ubuntu:

The file that causes the crash is at

A stacktrace is available at
Operating System: Ubuntu
Version: release

Toby Smithe (tsmithe) wrote :
Changed in df-libreoffice:
importance: Unknown → Critical
status: Unknown → Confirmed

Created attachment 88938
console + bt

On pc Debian x86-64 with master sources updated today, I reproduced the crash.
I attached console logs + bt

Miklos: one for you?

Fixed on 4-3 and master branches now

Changed in df-libreoffice:
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.