GNOME Bugzilla – Bug 159009
randomly crashes after importing text from terminal via Ctrl-V
Last modified: 2004-12-22 21:47:04 UTC
Distribution: Debian 3.1 Package: Gnumeric Severity: major Version: GNOME2.6.1 1.3.x Gnome-Distributor: Debian Synopsis: randomly crashes after importing text from terminal via Ctrl-V and graphing Bugzilla-Product: Gnumeric Bugzilla-Component: import/export Text Bugzilla-Version: 1.3.x BugBuddy-GnomeVersion: 2.0 (2.6.1.1) Description: Description of the crash: I have numerical data in a file, in two columns (x y). I display the data in a Gnome terminal window, the copy the data from the terminal and paste it into gnumeric, going through the text import wizard. At first I can use the data normally, making a graph from it. But then if I want to do more with the data, such as add further data from another file, gnumeric inevitably crashes. Steps to reproduce the crash: 1. Display first set of data on terminal, e.g. $ perl -e 'for($i=-51; $i<=5; $i++){ print $i . " " . $i*$i . "\n";}' 2. Highlight data in Gnome terminal, copy into copy&paste buffer (Ctrl-Shift-C). 3. Paste (Ctrl-V) in first cell in gnumeric (using 'import from text' wizard, select "See two separators as one". "general" or "number" format, behaviour seems to be the same) 4. With the two columns in gnumeric highlighted, use the graphing tool to create an X-Y graph (half a parabola) 5. Display second set of data e.g.perl -e 'for($i=0; $i<=100; $i++){ print $i . " " . $i*$i . "\n";}', copy into past buffer. 6. Go to bottom of data set, skip a couple of empty rows, paste new data in (use 'import from text' wizard again) 7. Select rows, from last few rows in first data set (x=1,2,3,4,5) to first rows in second data set (x=0). 8. Right click, choose "Delete rows" (so as to get one combined data set) --- at this point gnumeric crashes. Note I can skip Step 4 (graph of first data set), and thereby succeed with Step 8, but then the crash occurs at Step 9 (graph of combined data set) Expected Results: Should not crash when importing text. How often does this happen? Regularly. Does not seem to happen if I import from other sources, e.g. copying from an OpenOffice spreadsheet. Only seems to happen when importing from a terminal window (where it happens regularly). Additional Information: gnumeric v1.3.93 (Debian 1.3.93-2) I'm using the gnome terminal (2.6.1) and copying from it by highlighting with the mouse and copying with Ctrl-Shift-C. I'm not sure how to copy like this from xterm - the middle mouse button does not seem to copy into gnumeric. Debugging Information: Backtrace was generated from '/usr/bin/gnumeric' (no debugging symbols found) Using host libthread_db library "/lib/tls/libthread_db.so.1". (no debugging symbols found) `system-supplied DSO at 0xffffe000' has disappeared; keeping its symbols. (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) [Thread debugging using libthread_db enabled] [New Thread -1215882496 (LWP 4192)] [New Thread -1232381008 (LWP 4198)] [Thread debugging using libthread_db enabled] [New Thread -1215882496 (LWP 4192)] [New Thread -1232381008 (LWP 4198)] [New Thread -1232114768 (LWP 4197)] [New Thread -1222939728 (LWP 4196)] (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) 0xb7b1c431 in __waitpid_nocancel () from /lib/tls/libpthread.so.0
+ Trace 52396
Thread 1 (Thread -1215882496 (LWP 4192))
------- Bug moved to this database by unknown@bugzilla.gnome.org 2004-11-21 20:10 ------- Unknown platform unknown. Setting to default platform "Other". Unknown milestone "unknown" in product "Gnumeric". Setting to default milestone for this product, '---' The original reporter of this bug does not have an account here. Reassigning to the person who moved it here, unknown@bugzilla.gnome.org. Previous reporter was Drew.Parsons@anu.edu.au. Setting to default status "UNCONFIRMED". Setting qa contact to the default for this product. This bug either had no qa contact or an invalid one.
Thanks for the bug report. This appears to be a unique stack trace, according to the simple-dup-finder. It may belong filed against pango, due to the stack trace, but I'll leave that for someone else to decide.
This looks suspiciously similar to 159002...
Crash confirmed. Looks more like the graph system not linking having rows deleted underneath it. FMR: Free memory read This is occurring while in: style_format_unref [format.c:2647 pc=0xf5c34] go_format_unref [go-format.c:50 pc=0x2ccf98] gog_axis_update [gog-axis.c:1208 pc=0x293e2c] gog_object_update [gog-object.c:643 pc=0x285e2c] gog_object_update [gog-object.c:636 pc=0x285d40] gog_object_update [gog-object.c:636 pc=0x285d40] cb_graph_idle [gog-graph.c:456 pc=0x28b144] g_idle_dispatch [gmain.c:3821 pc=0xfa440f5c] g_main_dispatch [gmain.c:1947 pc=0xfa43b6f8] g_main_context_dispatch [gmain.c:2497 pc=0xfa43d6dc] g_main_context_iterate [gmain.c:2578 pc=0xfa43de00] g_main_loop_run [gmain.c:2782 pc=0xfa43e9bc] bonobo_main [bonobo-main.c:297 pc=0xfab2866c] main [main-application.c:358 pc=0x2022f0] _start [crt1.o pc=0x6b758] Reading 4 bytes from 0x7ab4c0 in the heap. Address 0x7ab4c0 is at the beginning of a freed block of 72 bytes. This block was allocated from: malloc [rtlib.o pc=0x73978] calloc [rtlib.o pc=0x74afc] g_malloc0 [gmem.c:154 pc=0xfa445f38] style_format_new_XL [format.c:2412 pc=0xf53b0] format_match_init [number-match.c:645 pc=0x140c8c] gnm_common_init [libgnumeric.c:141 pc=0x119864] main [main-application.c:267 pc=0x201f54] _start [crt1.o pc=0x6b758] There have been 56 frees since this block was freed from: free [rtlib.o pc=0x73cac] g_free [gmem.c:187 pc=0xfa446098] style_format_unref [format.c:2661 pc=0xf5cc0] go_format_unref [go-format.c:50 pc=0x2ccf98] gog_axis_update [gog-axis.c:1208 pc=0x293e2c] gog_object_update [gog-object.c:643 pc=0x285e2c] gog_object_update [gog-object.c:636 pc=0x285d40] gog_object_update [gog-object.c:636 pc=0x285d40] cb_graph_idle [gog-graph.c:456 pc=0x28b144] g_idle_dispatch [gmain.c:3821 pc=0xfa440f5c] g_main_dispatch [gmain.c:1947 pc=0xfa43b6f8] g_main_context_dispatch [gmain.c:2497 pc=0xfa43d6dc] g_main_context_iterate [gmain.c:2578 pc=0xfa43de00] g_main_loop_run [gmain.c:2782 pc=0xfa43e9bc] bonobo_main [bonobo-main.c:297 pc=0xfab2866c] main [main-application.c:358 pc=0x2022f0] _start [crt1.o pc=0x6b758] ABR: Array bounds read (12 times) This is occurring while in: rendered_value_render [rendered-value.c:114 pc=0x1766a4] rendered_value_new [rendered-value.c:230 pc=0x176ab4] cell_render_value [cell.c:557 pc=0xa53d0] row_calc_spans [cellspan.c:414 pc=0xa7394] item_grid_draw [item-grid.c:438 pc=0x11707c] foo_canvas_group_draw [foo-canvas.c:1497 pc=0x3057d0] foo_canvas_group_draw [foo-canvas.c:1497 pc=0x3057d0] foo_canvas_expose [foo-canvas.c:2890 pc=0x30a3d8] _gtk_marshal_BOOLEAN__BOXED [gtkmarshalers.c:83 pc=0xfaddef34] g_type_class_meta_marshal [gclosure.c:514 pc=0xfa87e100] g_closure_invoke [gclosure.c:437 pc=0xfa87dd40] signal_emit_unlocked_R [gsignal.c:2480 pc=0xfa8a6134] g_signal_emit_valist [gsignal.c:2211 pc=0xfa8a2cd8] g_signal_emit [gsignal.c:2245 pc=0xfa8a3188] gtk_widget_event_internal [gtkwidget.c:3587 pc=0xfaf954c4] gtk_widget_send_expose [gtkwidget.c:3427 pc=0xfaf95140] gtk_main_do_event [gtkmain.c:1342 pc=0xfaddb408] gdk_window_process_updates_internal [gdkwindow.c:2183 pc=0xfb3c5ce4] gdk_window_process_all_updates [gdkwindow.c:2247 pc=0xfb3c5ea4] gtk_container_idle_sizer [gtkcontainer.c:1117 pc=0xfacf8560] g_idle_dispatch [gmain.c:3821 pc=0xfa440f5c] g_main_dispatch [gmain.c:1947 pc=0xfa43b6f8] g_main_context_dispatch [gmain.c:2497 pc=0xfa43d6dc] g_main_context_iterate [gmain.c:2578 pc=0xfa43de00] g_main_loop_run [gmain.c:2782 pc=0xfa43e9bc] Reading 4 bytes from 0x7ab4e0 in the heap. Address 0x7ab4e0 is 241 bytes past end of a malloc'd block at 0x7ab3c8 of 40 bytes. This block was allocated from: malloc [rtlib.o pc=0x73978] g_malloc [gmem.c:137 pc=0xfa445e98] format_entry_ctor [format.c:467 pc=0xeefe0] format_compile [format.c:519 pc=0xef190] style_format_new_XL [format.c:2421 pc=0xf5458] format_match_init [number-match.c:645 pc=0x140c8c] gnm_common_init [libgnumeric.c:141 pc=0x119864] main [main-application.c:267 pc=0x201f54] _start [crt1.o pc=0x6b758]
Created attachment 34076 [details] [review] Remove extra unref
Jody: ok to commit? stf import is toast without this.
Commit.
looks like it's in