Bug 332012 – Crash when a worksheet with a double plot is exported as xls.

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 332012 - Crash when a worksheet with a double plot is exported as xls.


Summary:	Crash when a worksheet with a double plot is exported as xls.


Status:	RESOLVED FIXED

Product:	Gnumeric
Classification:	Applications
Component:	import/export MS Excel (tm)
Version:	1.6.x
Hardware:	Other All

Importance:	Normal critical
Target Milestone:	---
Assigned To:	Jean Bréfort
QA Contact:	Jody Goldberg

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2006-02-21 10:54 UTC by Peter Hopfgartner
Modified:	2006-03-21 19:12 UTC

See Also:
GNOME target:	---
GNOME version:	---

Attachments
Saving this as XLS crashes gnumeric 1.6.2 (3.12 KB, application/gnumeric) 2006-02-21 10:56 UTC, Peter Hopfgartner		Details
the fix (690 bytes, patch) 2006-03-21 14:32 UTC, Jean Bréfort	committed	Details \| Review

Description Peter Hopfgartner 2006-02-21 10:54:53 UTC

Steps to reproduce:
1. Create a worksheet with two XY Plots on one chart (see attached file)
2. save as Excel 97/2000/XP file
3. appication crashes with the following message on the console:

peter@bonobo: ~$ /usr/local/bin/gnumeric
Reading
file:///home/peter/projekte/2006%2000V%20Durfzentrum%20V%C3%B6ls/Auswertungen/gnumeric_crash-when-exported-as-xls.gnumeric
Writing
file:///home/peter/projekte/2006%2000V%20Durfzentrum%20V%C3%B6ls/Auswertungen/gnumeric_crash-when-exported-as-xls.xls
*** glibc detected *** free(): invalid pointer: 0xbfd1d7a8 ***
Aborted






Stack trace:
peter@bonobo: ~$ gdb /usr/local/bin/gnumeric
GNU gdb 6.3-debian
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i486-linux-gnu"...Using host libthread_db library
"/lib/tls/i686/cmov/libthread_db.so.1".

(gdb) run
Starting program: /usr/local/bin/gnumeric
[Thread debugging using libthread_db enabled]
[New Thread -1224001856 (LWP 4509)]
[New Thread -1231660112 (LWP 4513)]
[New Thread -1231938640 (LWP 4514)]
[New Thread -1232204880 (LWP 4515)]
Reading
file:///home/peter/projekte/2006%2000V%20Durfzentrum%20V%C3%B6ls/Auswertungen/gnumeric_crash-when-exported-as-xls.gnumeric
Writing
file:///home/peter/projekte/2006%2000V%20Durfzentrum%20V%C3%B6ls/Auswertungen/gnumeric_crash-when-exported-as-xls.xls
*** glibc detected *** free(): invalid pointer: 0xbf819c18 ***

Program received signal SIGABRT, Aborted.
[Switching to Thread -1224001856 (LWP 4509)]
0xffffe410 in __kernel_vsyscall ()
(gdb) thread apply all bt

+ Trace 66375

Thread 1 (Thread -1224001856 (LWP 4509))

#0 __kernel_vsyscall
#1 raise
from /lib/tls/i686/cmov/libc.so.6
#2 abort
from /lib/tls/i686/cmov/libc.so.6
#3 __fsetlocking
from /lib/tls/i686/cmov/libc.so.6
#4 malloc_trim
from /lib/tls/i686/cmov/libc.so.6
#5 free
from /lib/tls/i686/cmov/libc.so.6
#6 g_free
from /usr/lib/libglib-2.0.so.0
#7 chart_write_axis
at ms-chart.c line 3852
#8 ms_excel_chart_write
at ms-chart.c line 4195
#9 excel_write_objs_v8
at ms-excel-write.c line 3714
#10 excel_write_sheet
at ms-excel-write.c line 4524
#11 excel_write_workbook
at ms-excel-write.c line 5321
#12 excel_write_v8
at ms-excel-write.c line 5371
#13 excel_save
at boot.c line 245
#14 go_plugin_loader_module_func_file_save
at go-plugin-loader-module.c line 307
#15 go_plugin_file_saver_save
at go-plugin-service.c line 774
#16 go_file_saver_save
at file.c line 518
#17 wbv_save_to_uri
at workbook-view.c line 627
#18 wb_view_save_as
at workbook-view.c line 680
#19 gui_file_save_as
at gui-file.c line 529
#20 cb_file_save_as
at wbcg-actions.c line 133
#21 g_cclosure_marshal_VOID__VOID
from /usr/lib/libgobject-2.0.so.0
#22 g_closure_invoke
from /usr/lib/libgobject-2.0.so.0
#23 g_signal_stop_emission
from /usr/lib/libgobject-2.0.so.0
#24 g_signal_emit_valist
from /usr/lib/libgobject-2.0.so.0
#25 g_signal_emit
from /usr/lib/libgobject-2.0.so.0
#26 _gtk_action_emit_activate
from /usr/lib/libgtk-x11-2.0.so.0
#27 gtk_action_activate
from /usr/lib/libgtk-x11-2.0.so.0
#28 g_cclosure_marshal_VOID__VOID
from /usr/lib/libgobject-2.0.so.0
#29 g_closure_invoke
from /usr/lib/libgobject-2.0.so.0
#30 g_signal_stop_emission
from /usr/lib/libgobject-2.0.so.0
#31 g_signal_emit_valist
from /usr/lib/libgobject-2.0.so.0
#32 g_signal_emit
from /usr/lib/libgobject-2.0.so.0
#33 gtk_widget_activate
from /usr/lib/libgtk-x11-2.0.so.0
#34 gtk_menu_shell_activate_item
from /usr/lib/libgtk-x11-2.0.so.0
#35 gtk_menu_shell_activate_item
from /usr/lib/libgtk-x11-2.0.so.0
#36 gtk_menu_reorder_child
from /usr/lib/libgtk-x11-2.0.so.0
#37 _gtk_marshal_BOOLEAN__BOXED
from /usr/lib/libgtk-x11-2.0.so.0
#38 g_cclosure_new_swap
from /usr/lib/libgobject-2.0.so.0
#39 g_closure_invoke
from /usr/lib/libgobject-2.0.so.0
#40 g_signal_stop_emission
from /usr/lib/libgobject-2.0.so.0
#41 g_signal_emit_valist
from /usr/lib/libgobject-2.0.so.0
#42 g_signal_emit
from /usr/lib/libgobject-2.0.so.0
#43 gtk_widget_activate
from /usr/lib/libgtk-x11-2.0.so.0
#44 gtk_propagate_event
from /usr/lib/libgtk-x11-2.0.so.0
#45 gtk_main_do_event
from /usr/lib/libgtk-x11-2.0.so.0
#46 _gdk_events_queue
from /usr/lib/libgdk-x11-2.0.so.0
#47 g_main_context_dispatch
from /usr/lib/libglib-2.0.so.0
#48 g_main_context_check
from /usr/lib/libglib-2.0.so.0
#49 g_main_loop_run
from /usr/lib/libglib-2.0.so.0
#50 gtk_main
from /usr/lib/libgtk-x11-2.0.so.0
#51 main
at main-application.c line 485



Other information:

Comment 1 Peter Hopfgartner 2006-02-21 10:56:38 UTC

Created attachment 59834 [details]
Saving this as XLS crashes gnumeric 1.6.2

Comment 2 Morten Welinder 2006-02-24 14:32:34 UTC

For the record, I see no such problem with cvs HEAD under purify.

Comment 3 Jean Bréfort 2006-03-20 09:55:11 UTC

It does not occur with 1.6.1 either

Comment 4 Peter Hopfgartner 2006-03-21 08:33:41 UTC

The same file hangs (but no crash) gnumeric on Ubuntu Dapper Drake as of today (2006/03/21).

BTW: I compiled the GTK+-only version (no gnome dependencies) for the original bug report.

Comment 5 Jean Bréfort 2006-03-21 10:20:47 UTC

Which is the glib version? 2.10.0?

Comment 6 Jean Bréfort 2006-03-21 14:32:23 UTC

Created attachment 61691 [details] [review]
the fix

Oops, my fault. An uninitialized value :-(

Comment 7 Jody Goldberg 2006-03-21 15:44:41 UTC

commit commmit commit, 1.6.3 as soon as this lands.
both trees please.

Comment 8 Morten Welinder 2006-03-21 16:30:29 UTC

Aha!  I seem to have fixed in this cvs HEAD a month ago.  No wonder I didn't
see the crash anymore.

Comment 9 Jean Bréfort 2006-03-21 19:12:15 UTC

Commited to 1-6 branch