An OpenXML document with embedded Alternative Format chunk crashes (with smart tags inside)

Question

Hi,

I am creating Word documents programmatically and I have come across a weird document that causes MS Word to crash.

I run MS Office Professional Plus 2010, version 14.0.6112.5000 (64 bits).

I use Open XML SDK 2 Productivity Tool to open and compare the files.

Steps to reproduce:

• I create an OpenXML Word document called Aggregate.docx
• I add an Alternative Format part to this document, called chunk.docx
• I open Aggregate.docx in Word.

The OpenXML for Aggregate.docx looks like this:

<?xml version="1.0" encoding="utf-8" standalone="yes"?> <w:document xmlns:wpc="http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas"  xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"  xmlns:o="urn:schemas-microsoft-com:office:office"  xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships"  xmlns:m="http://schemas.openxmlformats.org/officeDocument/2006/math"  xmlns:v="urn:schemas-microsoft-com:vml"  xmlns:wp14="http://schemas.microsoft.com/office/word/2010/wordprocessingDrawing"  xmlns:wp="http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing"  xmlns:w10="urn:schemas-microsoft-com:office:word"  xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"  xmlns:w14="http://schemas.microsoft.com/office/word/2010/wordml"  xmlns:wpg="http://schemas.microsoft.com/office/word/2010/wordprocessingGroup"  xmlns:wpi="http://schemas.microsoft.com/office/word/2010/wordprocessingInk"  xmlns:wne="http://schemas.microsoft.com/office/word/2006/wordml"  xmlns:wps="http://schemas.microsoft.com/office/word/2010/wordprocessingShape" mc:Ignorable="w14 wp14">

<w:body>

<w:p>

<w:r>

<w:t>Empty Template.</w:t>

</w:r>

<w:bookmarkStart w:name="_GoBack" w:id="0" />

<w:bookmarkEnd w:id="0" />

</w:p>

<w:p>

<w:pPr>

<w:sectPr>

<w:pgSz w:w="11906" w:h="16838" />

<w:pgMar w:top="1440" w:right="1440" w:bottom="1440" w:left="1440" w:header="708" w:footer="708" w:gutter="0" />

<w:cols w:space="708" />

<w:docGrid w:linePitch="360" />

</w:sectPr>

</w:pPr>

</w:p>

<w:altChunk r:id="AltChunkId1">

<w:altChunkPr>

<w:matchSrc w:val="true" />

</w:altChunkPr>

</w:altChunk>

<w:sectPr>

<w:pgSz w:w="12240" w:h="15840" />

<w:pgMar w:top="1440" w:right="1800" w:bottom="1440" w:left="1800" w:header="720" w:footer="720" w:gutter="0" />

<w:cols w:space="720" />

<w:docGrid w:linePitch="360" />

</w:sectPr>

</w:body>

</w:document>

The 4 files can be seen here:

http://dl.dropbox.com/u/78484676/Aggregate30.docx

http://dl.dropbox.com/u/78484676/chunk30.dotx

http://dl.dropbox.com/u/78484676/Aggregate31.docx

http://dl.dropbox.com/u/78484676/chunk31.dotx

Scenario 1:

see Aggregate30.docx which contains the Alternative Format chunk30.docx

This crashes Word.

Scenario 2:

I simply opened chunk30.docx in MS Word, and deleted the words "A" and "Corporation" in the original text "A Florida Corporation". Then saved this as chunk31.docx.

see Aggregate31.docx which contains chunk31.docx

This opens fine.

Question:

When compared in the Productivity Tool, Aggregate30 and Aggregate31 are almost identical. The only differences are in the ids used.

But when comparing the embedded chunks, we can see a difference between chunk30.docx and chunk31.docx:

Chunk30 has Smart Tags around the word "Florida".

Does this cause the crash in Word? Why is it crashing? Opening the chunks individually in Word works fine. It's only when they are embedded as altChunk that causes a problem.

This is the error from the Event Log:

Faulting application name: WINWORD.EXE, version: 14.0.6024.1000, time stamp: 0x4d83e2f6

Faulting module name: wwlib.dll, version: 14.0.6024.1000, time stamp: 0x4d83e39e

Exception code: 0xc0000005

Fault offset: 0x00000000002fd206

Faulting process id: 0x1c50

Faulting application start time: 0x01cd328331ed0c99

Faulting application path: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Faulting module path: C:\Program Files\Microsoft Office\Office14\wwlib.dll

Report Id: 6fd43f19-9e76-11e1-92cb-002564aba296

Followed by another event:

Fault bucket , type 0

Event Name: APPCRASH

Response: Not available

Cab Id: 0

Problem signature:

P1: WINWORD.EXE

P2: 14.0.6024.1000

P3: 4d83e2f6

P4: wwlib.dll

P5: 14.0.6024.1000

P6: 4d83e39e

P7: c0000005

P8: 00000000002fd206

P9:

P10:

Attached files:

C:\Users\XXXXXX\AppData\Local\Temp\12115412.cvr

C:\XXXXX\Aggregate30.docx

C:\Users\XXXXXX\AppData\Local\Temp\CVRD1D2.tmp.cvr

These files may be available here:

C:\Users\XXXXXX\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_WINWORD.EXE_645e3e8ac5a55d624a7abd913a2e1c6b3c46f5_23fcea32

Analysis symbol:

Rechecking for solution: 0

Report Id: 6ce63954-9e79-11e1-92cb-002564aba296

Report Status: 0

And this is the only file found in the AppCrash folder Report.wer:

Version=1

EventType=APPCRASH

EventTime=129815516163154251

ReportType=2

Consent=1

ReportIdentifier=6ce63955-9e79-11e1-92cb-002564aba296

IntegratorReportIdentifier=6ce63954-9e79-11e1-92cb-002564aba296

Response.type=4

Sig[0].Name=Application Name

Sig[0].Value=WINWORD.EXE

Sig[1].Name=Application Version

Sig[1].Value=14.0.6024.1000

Sig[2].Name=Application Timestamp

Sig[2].Value=4d83e2f6

Sig[3].Name=Fault Module Name

Sig[3].Value=wwlib.dll

Sig[4].Name=Fault Module Version

Sig[4].Value=14.0.6024.1000

Sig[5].Name=Fault Module Timestamp

Sig[5].Value=4d83e39e

Sig[6].Name=Exception Code

Sig[6].Value=c0000005

Sig[7].Name=Exception Offset

Sig[7].Value=00000000002fd206

DynamicSig[1].Name=OS Version

DynamicSig[1].Value=6.1.7601.2.1.0.256.48

DynamicSig[2].Name=Locale ID

DynamicSig[2].Value=2057

UI[2]=C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

UI[3]=Microsoft Word has stopped working

UI[4]=Windows can check online for a solution to the problem and try to recover your information.

UI[5]=Check online for a solution and close the program

UI[6]=Check online for a solution later and close the program

UI[7]=Close the program

LoadedModule[0]=C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

LoadedModule[1]=C:\Windows\SYSTEM32\ntdll.dll

LoadedModule[2]=C:\Windows\system32\kernel32.dll

LoadedModule[3]=C:\Windows\system32\KERNELBASE.dll

LoadedModule[4]=C:\Windows\system32\ADVAPI32.dll

LoadedModule[5]=C:\Windows\system32\msvcrt.dll

LoadedModule[6]=C:\Windows\SYSTEM32\sechost.dll

LoadedModule[7]=C:\Windows\system32\RPCRT4.dll

LoadedModule[8]=C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

LoadedModule[9]=C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\Comctl32.dll

LoadedModule[10]=C:\Windows\system32\GDI32.dll

LoadedModule[11]=C:\Windows\system32\USER32.dll

LoadedModule[12]=C:\Windows\system32\LPK.dll

LoadedModule[13]=C:\Windows\system32\USP10.dll

LoadedModule[14]=C:\Windows\system32\IMM32.DLL

LoadedModule[15]=C:\Windows\system32\MSCTF.dll

LoadedModule[16]=C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~2.DLL

LoadedModule[17]=C:\Windows\system32\PSAPI.DLL

LoadedModule[18]=C:\Program Files\Microsoft Office\Office14\wwlib.dll

LoadedModule[19]=C:\Windows\system32\ole32.dll

LoadedModule[20]=C:\Windows\system32\OLEAUT32.dll

LoadedModule[21]=C:\Program Files\Microsoft Office\Office14\gfx.dll

LoadedModule[22]=C:\Windows\system32\WTSAPI32.dll

LoadedModule[23]=C:\Windows\system32\MSIMG32.dll

LoadedModule[24]=C:\Program Files\Microsoft Office\Office14\oart.dll

LoadedModule[25]=C:\Program Files\Common Files\Microsoft Shared\office14\mso.dll

LoadedModule[26]=C:\Windows\system32\msi.dll

LoadedModule[27]=C:\Windows\system32\SHLWAPI.dll

LoadedModule[28]=C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\Comctl32.dll

LoadedModule[29]=C:\Program Files\Common Files\Microsoft Shared\office14\Cultures\office.odf

LoadedModule[30]=C:\Program Files\Microsoft Office\Office14\1033\wwintl.dll

LoadedModule[31]=C:\Windows\system32\uxtheme.dll

LoadedModule[32]=C:\Windows\system32\dwmapi.dll

LoadedModule[33]=C:\Program Files\Common Files\Microsoft Shared\office14\1033\MSOINTL.DLL

LoadedModule[34]=C:\Program Files\Common Files\Microsoft Shared\office14\MSORES.DLL

LoadedModule[35]=C:\Windows\system32\CRYPTBASE.dll

LoadedModule[36]=C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSPTLS.DLL

LoadedModule[37]=C:\Program Files\Common Files\Microsoft Shared\office14\riched20.dll

LoadedModule[38]=C:\Windows\system32\mscoree.dll

LoadedModule[39]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll

LoadedModule[40]=C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL

LoadedModule[41]=C:\Windows\system32\Winspool.DRV

LoadedModule[42]=C:\Windows\system32\SHELL32.DLL

LoadedModule[43]=C:\Windows\system32\VERSION.dll

LoadedModule[44]=C:\Windows\system32\SETUPAPI.dll

LoadedModule[45]=C:\Windows\system32\CFGMGR32.dll

LoadedModule[46]=C:\Windows\system32\DEVOBJ.dll

LoadedModule[47]=C:\Windows\system32\CLBCatQ.DLL

LoadedModule[48]=C:\Windows\system32\propsys.dll

LoadedModule[49]=C:\Windows\system32\ntmarta.dll

LoadedModule[50]=C:\Windows\system32\WLDAP32.dll

LoadedModule[51]=C:\Windows\system32\CRYPTSP.dll

LoadedModule[52]=C:\Windows\system32\rsaenh.dll

LoadedModule[53]=C:\Windows\system32\RpcRtRemote.dll

LoadedModule[54]=C:\Windows\System32\msxml6.dll

LoadedModule[55]=C:\Windows\system32\profapi.dll

LoadedModule[56]=C:\Windows\system32\SXS.DLL

LoadedModule[57]=C:\Program Files (x86)\Microsoft Visual Studio 10.0\Visual Studio Tools for Office\x64\VSTOWordAdaptor.dll

LoadedModule[58]=C:\Windows\system32\MSVCR100.dll

LoadedModule[59]=C:\Windows\system32\urlmon.dll

LoadedModule[60]=C:\Windows\system32\WININET.dll

LoadedModule[61]=C:\Windows\system32\iertutil.dll

LoadedModule[62]=C:\Windows\system32\CRYPT32.dll

LoadedModule[63]=C:\Windows\system32\MSASN1.dll

LoadedModule[64]=C:\Windows\system32\SspiCli.dll

LoadedModule[65]=C:\Program Files\Common Files\Microsoft Shared\OFFICE14\USP10.DLL

LoadedModule[66]=C:\Windows\system32\apphelp.dll

Sec[0].Key=LCID

Sec[0].Value=1033

Sec[1].Key=skulcid

Sec[1].Value=2057

FriendlyEventName=Stopped working

ConsentKey=APPCRASH

AppName=Microsoft Word

AppPath=C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Answer 1

maybe because smart tags are no longer supported?

Answer 2

Further to my post above, one of the differences between chunk30 and chunk31 is in the file /word/settings.xml contained in chunk30.docx, which seem to cause a crash. It has the following lines:

<w:smartTagType w:namespaceuri="urn:schemas-microsoft-com:office:smarttags" w:name="place"/>

<w:smartTagType w:namespaceuri="urn:schemas-microsoft-com:office:smarttags" w:name="State"/>

And it's amazing, but if I simply delete these 2 lines from the file, and run my tests again, all works fine, and Word doesn't crash.

The question remains. Why is Word crashing?