Bug 478552 – Crash trying to print a spreadsheet

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 478552 - Crash trying to print a spreadsheet


Summary:	Crash trying to print a spreadsheet


Status:	RESOLVED FIXED

Product:	Gnumeric
Classification:	Applications
Component:	Printing
Version:	git master
Hardware:	Other All

Importance:	High critical
Target Milestone:	---
Assigned To:	Andreas J. Guelzow
QA Contact:	Jody Goldberg

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2007-09-20 10:54 UTC by ses
Modified:	2007-10-28 15:01 UTC

See Also:
GNOME target:	---
GNOME version:	2.17/2.18

Description ses 2007-09-20 10:54:48 UTC

Version: 1.7.11

What were you doing when the application crashed?
Trying to print a spreadsheet.


Distribution: Unknown
Gnome Release: 2.18.3 2007-08-14 (FreeBSD GNOME Project)
BugBuddy Version: 2.18.1

System: FreeBSD 6.2-STABLE FreeBSD 6.2-STABLE #0: Wed Apr 18 21:57:44 CEST 2007     root@ses2.uni.to:/usr/obj/usr/src/sys/GENERIC i386
X Vendor: The X.Org Foundation
X Vendor Release: 70200000
Selinux: No
Accessibility: Disabled
GTK+ Theme: Clearlooks
Icon Theme: gnome

Memory status: size: 39188 vsize: 39188 resident: 28280 share: 33512666 rss: 28280 rss_rlim: 7070
CPU usage: start_time: 0 rtime: 133 utime: 0 stime: 0 cutime:0 cstime: 0 timeout: 0 it_real_value: 0 frequency: 133

Backtrace was generated from '/usr/local/bin/gnumeric'

(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...[New LWP 100173]
(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...[Switching to LWP 100173]
0x2934c4d9 in wait4 () from /lib/libc.so.6

+ Trace 164100

Thread 1 (LWP 100173)

#0 wait4
from /lib/libc.so.6
#1 waitpid
from /lib/libc.so.6
#2 waitpid
from /lib/libpthread.so.2
#3 libgnomeui_module_info_get
from /usr/local/lib/libgnomeui-2.so.0
#4 sigaction
from /lib/libpthread.so.2
#5 ??
#6 ??
#7 ??
#8 ??
#9 ??
#10 sigaction
from /lib/libpthread.so.2
#11 abort
from /lib/libc.so.6
#12 g_logv
from /usr/local/lib/libglib-2.0.so.0
#13 g_log
from /usr/local/lib/libglib-2.0.so.0
#14 g_assert_warning
from /usr/local/lib/libglib-2.0.so.0
#15 pango_layout_line_get_pixel_extents
from /usr/local/lib/libpango-1.0.so.0
#16 pango_layout_get_line_count
from /usr/local/lib/libpango-1.0.so.0
#17 gnm_rendered_value_recontext
from /usr/local/lib/libspreadsheet-1.7.11.so
#18 print_cell_gtk
from /usr/local/lib/libspreadsheet-1.7.11.so
#19 gnm_gtk_print_cell_range
from /usr/local/lib/libspreadsheet-1.7.11.so
#20 gnm_draw_page_cb
from /usr/local/lib/libspreadsheet-1.7.11.so
#21 gtk_marshal_VOID__UINT_STRING
from /usr/local/lib/libgtk-x11-2.0.so.0
#22 g_closure_invoke
from /usr/local/lib/libgobject-2.0.so.0
#23 g_signal_has_handler_pending
from /usr/local/lib/libgobject-2.0.so.0
#24 g_signal_emit_valist
from /usr/local/lib/libgobject-2.0.so.0
#25 g_signal_emit
from /usr/local/lib/libgobject-2.0.so.0
#26 gtk_print_operation_is_finished
from /usr/local/lib/libgtk-x11-2.0.so.0
#27 gtk_print_operation_is_finished
from /usr/local/lib/libgtk-x11-2.0.so.0
#28 g_child_watch_add
from /usr/local/lib/libglib-2.0.so.0
#29 g_main_context_dispatch
from /usr/local/lib/libglib-2.0.so.0
#30 g_main_context_acquire
from /usr/local/lib/libglib-2.0.so.0
#31 g_main_loop_run
from /usr/local/lib/libglib-2.0.so.0
#32 gtk_print_operation_cancel
from /usr/local/lib/libgtk-x11-2.0.so.0
#33 gtk_print_operation_run
from /usr/local/lib/libgtk-x11-2.0.so.0
#34 gnm_print_sheet
from /usr/local/lib/libspreadsheet-1.7.11.so
#35 cb_file_print
from /usr/local/lib/libspreadsheet-1.7.11.so
#36 g_cclosure_marshal_VOID__VOID
from /usr/local/lib/libgobject-2.0.so.0
#37 g_closure_invoke
from /usr/local/lib/libgobject-2.0.so.0
#38 g_signal_has_handler_pending
from /usr/local/lib/libgobject-2.0.so.0
#39 g_signal_emit_valist
from /usr/local/lib/libgobject-2.0.so.0
#40 g_signal_emit
from /usr/local/lib/libgobject-2.0.so.0
#41 gtk_action_create_menu_item
from /usr/local/lib/libgtk-x11-2.0.so.0
#42 gtk_action_activate
from /usr/local/lib/libgtk-x11-2.0.so.0
#43 g_cclosure_marshal_VOID__VOID
from /usr/local/lib/libgobject-2.0.so.0
#44 g_closure_invoke
from /usr/local/lib/libgobject-2.0.so.0
#45 g_signal_has_handler_pending
from /usr/local/lib/libgobject-2.0.so.0
#46 g_signal_emit_valist
from /usr/local/lib/libgobject-2.0.so.0
#47 g_signal_emit_by_name
from /usr/local/lib/libgobject-2.0.so.0
#48 gtk_tool_button_get_type
from /usr/local/lib/libgtk-x11-2.0.so.0
#49 g_cclosure_marshal_VOID__VOID
from /usr/local/lib/libgobject-2.0.so.0
#50 g_closure_invoke
from /usr/local/lib/libgobject-2.0.so.0
#51 g_signal_has_handler_pending
from /usr/local/lib/libgobject-2.0.so.0
#52 g_signal_emit_valist
from /usr/local/lib/libgobject-2.0.so.0
#53 g_signal_emit
from /usr/local/lib/libgobject-2.0.so.0
#54 gtk_button_clicked
from /usr/local/lib/libgtk-x11-2.0.so.0
#55 gtk_button_get_alignment
from /usr/local/lib/libgtk-x11-2.0.so.0
#56 g_cclosure_marshal_VOID__VOID
from /usr/local/lib/libgobject-2.0.so.0
#57 g_cclosure_new_swap
from /usr/local/lib/libgobject-2.0.so.0
#58 g_closure_invoke
from /usr/local/lib/libgobject-2.0.so.0
#59 g_signal_has_handler_pending
from /usr/local/lib/libgobject-2.0.so.0
#60 g_signal_emit_valist
from /usr/local/lib/libgobject-2.0.so.0
#61 g_signal_emit
from /usr/local/lib/libgobject-2.0.so.0
#62 gtk_button_released
from /usr/local/lib/libgtk-x11-2.0.so.0
#63 gtk_button_set_relief
from /usr/local/lib/libgtk-x11-2.0.so.0
#64 gtk_marshal_VOID__UINT_STRING
from /usr/local/lib/libgtk-x11-2.0.so.0
#65 g_cclosure_new_swap
from /usr/local/lib/libgobject-2.0.so.0
#66 g_closure_invoke
from /usr/local/lib/libgobject-2.0.so.0
#67 g_signal_has_handler_pending
from /usr/local/lib/libgobject-2.0.so.0
#68 g_signal_emit_valist
from /usr/local/lib/libgobject-2.0.so.0
#69 g_signal_emit
from /usr/local/lib/libgobject-2.0.so.0
#70 gtk_widget_activate
from /usr/local/lib/libgtk-x11-2.0.so.0
#71 gtk_propagate_event
from /usr/local/lib/libgtk-x11-2.0.so.0
#72 gtk_main_do_event
from /usr/local/lib/libgtk-x11-2.0.so.0
#73 gdk_event_get_graphics_expose
from /usr/local/lib/libgdk-x11-2.0.so.0
#74 g_main_context_dispatch
from /usr/local/lib/libglib-2.0.so.0
#75 g_main_context_acquire
from /usr/local/lib/libglib-2.0.so.0
#76 g_main_loop_run
from /usr/local/lib/libglib-2.0.so.0
#77 bonobo_main
from /usr/local/lib/libbonobo-2.so.0
#78 main



----------- .xsession-errors ---------------------
(gnumeric:82231): Pango-CRITICAL **: pango_layout_get_single_paragraph_mode: assertion `PANGO_IS_LAYOUT (layout)' failed
(gnumeric:82231): Pango-CRITICAL **: pango_layout_get_wrap: assertion `PANGO_IS_LAYOUT (layout)' failed
(gnumeric:82231): Pango-CRITICAL **: pango_layout_get_auto_dir: assertion `PANGO_IS_LAYOUT (layout)' failed
(gnumeric:82231): Pango-CRITICAL **: pango_layout_get_ellipsize: assertion `PANGO_IS_LAYOUT (layout)' failed
(gnumeric:82231): Pango-CRITICAL **: pango_layout_get_font_description: assertion `PANGO_IS_LAYOUT (layout)' failed
Pango-ERROR **: file pango-layout.c: line 3557 (pango_layout_check_lines): assertion failed: (!layout->log_attrs)
aborting...
warning: Unable to get location for thread creation breakpoint: generic error
--------------------------------------------------

Comment 1 Morten Welinder 2007-09-20 13:51:29 UTC

Does this happen with any sheet or a specific one?  If specific, may we
have a copy?

Comment 2 ses 2007-09-20 14:13:40 UTC

You cannot get the sheet since it contains confidential information.

It only happens sometimes and with different sheets.

Would it help if I build gnumeric with debugging symbols and tried to produce another crash?

Comment 3 Morten Welinder 2007-09-20 15:58:48 UTC

That might help, or perhaps you could prune the sheet down to whatever cell
it is that is causing problems.  I.e.,

1 make a copy of the file and work on the copy.
2 delete half of the contents.
3 try printing
4 if crash, go to step 1
5 if no crash, restore the previous sheet and try deleting the other half

etc...

That should, hopefully, leave you with a single cell or two that has some
strange formatting which we don't get right during printing.

Comment 4 Andreas J. Guelzow 2007-09-20 16:36:04 UTC

According to this:

+ Trace 164167

#10 sigaction
from /lib/libpthread.so.2
#11 abort
from /lib/libc.so.6
#12 g_logv
from /usr/local/lib/libglib-2.0.so.0
#13 g_log
from /usr/local/lib/libglib-2.0.so.0
#14 g_assert_warning
from /usr/local/lib/libglib-2.0.so.0
#15 pango_layout_line_get_pixel_extents
from /usr/local/lib/libpango-1.0.so.0


you should be getting some warnings printed if you run gnumeric from a terminal window. What are those warnings. (It also looks to me that gnumeric only crashes because you seem to have made warnings critical. Why did you do that?)

In any case this happens inside pango not gnumeric.

Comment 5 Morten Welinder 2007-09-20 16:45:51 UTC

Andreas: there are 5 pango criticals listed above.  I am fairly certain
that we are throwing a NULL layout at pango.

Comment 6 Andreas J. Guelzow 2007-09-20 19:10:17 UTC

Morten: sorry, apparently I can't read.

Comment 7 Jody Goldberg 2007-10-20 18:03:28 UTC

Any progress on a sample file to help reproduce this ?
If possible you could also send the file to me directly in encrypted form and I would apply our standard confidentiality protocols.

Comment 8 sum1 2007-10-28 13:34:24 UTC

I believe I'm seeing this same crash with gnumeric/samples/excel12/cellstyle.xlsx.

Version: r16026

Steps to reproduce:
- Run Gnumeric
- Import gnumeric/samples/excel12/cellstyle.xlsx
- Press the Print Preview toolbar button to crash Gnumeric

Console output:

(gnumeric:28599): Pango-CRITICAL **: pango_layout_get_text: assertion `PANGO_IS_LAYOUT (layout)' failed

(gnumeric:28599): Pango-CRITICAL **: pango_layout_set_text: assertion `length == 0 || text != NULL' failed

(gnumeric:28599): Pango-CRITICAL **: pango_layout_get_attributes: assertion `PANGO_IS_LAYOUT (layout)' failed

(gnumeric:28599): Pango-CRITICAL **: pango_layout_get_single_paragraph_mode: assertion `PANGO_IS_LAYOUT (layout)' failed

(gnumeric:28599): Pango-CRITICAL **: pango_layout_get_wrap: assertion `PANGO_IS_LAYOUT (layout)' failed

(gnumeric:28599): Pango-CRITICAL **: pango_layout_get_auto_dir: assertion `PANGO_IS_LAYOUT (layout)' failed

(gnumeric:28599): Pango-CRITICAL **: pango_layout_get_ellipsize: assertion `PANGO_IS_LAYOUT (layout)' failed

(gnumeric:28599): Pango-CRITICAL **: pango_layout_get_font_description: assertion `PANGO_IS_LAYOUT (layout)' failed

Comment 9 Morten Welinder 2007-10-28 14:28:01 UTC

Confirmed.  It is also triggered by

./ssconvert ../samples/excel12/cellstyle.xlsx /tmp/ppp.pdf

The trace is:

+ Trace 173440

#0 gnm_rendered_value_recontext
at rendered-value.c line 475
#1 print_cell_gtk
at print-cell.c line 96
#2 gnm_gtk_print_cell_range
at print-cell.c line 490
#3 gnm_draw_page_cb
at print.c line 177

Comment 10 Morten Welinder 2007-10-28 14:31:52 UTC

It is not a NULL layout problem.

==15487== Invalid read of size 2
==15487==    at 0x40E3DA7: gnm_rendered_value_recontext (rendered-value.c:459)
==15487==    by 0x41592E6: print_cell_gtk (print-cell.c:96)
==15487==    by 0x415A082: gnm_gtk_print_cell_range (print-cell.c:490)
==15487==    by 0x4158016: gnm_draw_page_cb (print.c:177)
==15487==    by 0x472E030: (within /usr/lib/libgtk-x11-2.0.so.0.1200.0)
==15487==    by 0x538B918: g_closure_invoke (in /usr/lib/libgobject-2.0.so.0.140
0.1)
==15487==    by 0x539E9EC: (within /usr/lib/libgobject-2.0.so.0.1400.1)
==15487==    by 0x53A063E: g_signal_emit_valist (in /usr/lib/libgobject-2.0.so.0.1400.1)
==15487==    by 0x53A0988: g_signal_emit (in /usr/lib/libgobject-2.0.so.0.1400.1)
==15487==    by 0x475FC89: (within /usr/lib/libgtk-x11-2.0.so.0.1200.0)
==15487==    by 0x476017C: (within /usr/lib/libgtk-x11-2.0.so.0.1200.0)
==15487==    by 0x496A87A: (within /usr/lib/libgdk-x11-2.0.so.0.1200.0)
==15487==  Address 0x61CD726 is 22 bytes inside a block of size 24 free'd
==15487==    at 0x402243F: free (in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
==15487==    by 0x53F3BD0: g_free (in /usr/lib/libglib-2.0.so.0.1400.1)
==15487==    by 0x40E39A8: gnm_rendered_value_destroy (rendered-value.c:450)
==15487==    by 0x407BC75: cell_finish_layout (cell-draw.c:262)
==15487==    by 0x41592D7: print_cell_gtk (print-cell.c:93)
==15487==    by 0x415A082: gnm_gtk_print_cell_range (print-cell.c:490)
==15487==    by 0x4158016: gnm_draw_page_cb (print.c:177)
==15487==    by 0x472E030: (within /usr/lib/libgtk-x11-2.0.so.0.1200.0)
==15487==    by 0x538B918: g_closure_invoke (in /usr/lib/libgobject-2.0.so.0.1400.1)
==15487==    by 0x539E9EC: (within /usr/lib/libgobject-2.0.so.0.1400.1)
==15487==    by 0x53A063E: g_signal_emit_valist (in /usr/lib/libgobject-2.0.so.0.1400.1)
==15487==    by 0x53A0988: g_signal_emit (in /usr/lib/libgobject-2.0.so.0.1400.1)

Comment 11 Morten Welinder 2007-10-28 15:01:17 UTC

This problem has been fixed in the development version. The fix will be available in the next major software release. Thank you for your bug report.