Bug 100852 - crash undoing deletion of a column ...
Summary: crash undoing deletion of a column ...
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
4.2.0.4 release
Hardware: All All
: medium normal
Assignee: Eike Rathke
URL:
Whiteboard: target:5.3.0 target:5.2.2
Keywords:
Depends on:
Blocks:
 
Reported: 2016-07-11 15:17 UTC by Michael Meeks
Modified: 2022-02-03 06:15 UTC (History)
1 user (show)

See Also:
Crash report or crash signature:


Attachments
reduced test-case. (15.28 KB, application/vnd.oasis.opendocument.spreadsheet)
2016-07-11 15:18 UTC, Michael Meeks
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Meeks 2016-07-11 15:17:55 UTC
Steps:

   Load the attached sample;
   select column C
   right-click - delete columns
   undo

bang =) console output is:

/usr/include/c++/4.8/debug/safe_iterator.h:225:error: attempt to copy from 
    a singular iterator.

Objects involved in the operation:
iterator "this" @ 0x0x4ad9ad8 {
type = N11__gnu_debug14_Safe_iteratorIN9__gnu_cxx17__normal_iteratorIPPN4mdds17multi_type_vectorINS3_3mtv18custom_block_func1INS5_33noncopyable_managed_element_blockILi50E14SvtBroadcasterEEEENS3_6detail14mtv_event_funcEE5blockENSt9__cxx19986vectorISF_SaISF_EEEEENSt7__debug6vectorISF_SJ_EEEE (mutable iterator);
  state = singular;
  references sequence with type `NSt7__debug6vectorIPN4mdds17multi_type_vectorINS1_3mtv18custom_block_func1INS3_33noncopyable_managed_element_blockILi50E14SvtBroadcasterEEEENS1_6detail14mtv_event_funcEE5blockESaISD_EEE' @ 0x0x4ad9ad8
}
iterator "other" @ 0x0x7fff30696608 {
type = N11__gnu_debug14_Safe_iteratorIN9__gnu_cxx17__normal_iteratorIPPN4mdds17multi_type_vectorINS3_3mtv18custom_block_func1INS5_33noncopyable_managed_element_blockILi50E14SvtBroadcasterEEEENS3_6detail14mtv_event_funcEE5blockENSt9__cxx19986vectorISF_SaISF_EEEEENSt7__debug6vectorISF_SJ_EEEE (mutable iterator);
  state = singular;
  references sequence with type `NSt7__debug6vectorIPN4mdds17multi_type_vectorINS1_3mtv18custom_block_func1INS3_33noncopyable_managed_element_blockILi50E14SvtBroadcasterEEEENS1_6detail14mtv_event_funcEE5blockESaISD_EEE' @ 0x0x7fff30696608
}

Help->About reads:

Version: 5.3.0.0.alpha0+
Build ID: 2659a7d29f6beae770ee848c436bb73bc091a22e
CPU Threads: 4; OS Version: Linux 3.16; UI Render: default; 
Locale: en-US (en_GB.UTF-8); Calc: single
Comment 1 Michael Meeks 2016-07-11 15:18:15 UTC
Created attachment 126167 [details]
reduced test-case.
Comment 2 Michael Meeks 2016-07-11 15:20:33 UTC
Trace looks like this:

#13 0x00007f4ef61320a7 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#14 0x00007f4ef6133458 in __GI_abort () at abort.c:78
#15 0x00007f4ef5879295 in __gnu_debug::_Error_formatter::_M_error() const () at /usr/lib64/libstdc++.so.6
#16 0x00007f4eb5a6bdb5 in __gnu_debug::_Safe_iterator<__gnu_cxx::__normal_iterator<mdds::multi_type_vector<mdds::mtv::custom_block_func1<mdds::mtv::noncopyable_managed_element_block<50, SvtBroadcaster> >, mdds::detail::mtv_event_func>::block**, std::__cxx1998::vector<mdds::multi_type_vector<mdds::mtv::custom_block_func1<mdds::mtv::noncopyable_managed_element_block<50, SvtBroadcaster> >, mdds::detail::mtv_event_func>::block*, std::allocator<mdds::multi_type_vector<mdds::mtv::custom_block_func1<mdds::mtv::noncopyable_managed_element_block<50, SvtBroadcaster> >, mdds::detail::mtv_event_func>::block*> > >, std::__debug::vector<mdds::multi_type_vector<mdds::mtv::custom_block_func1<mdds::mtv::noncopyable_managed_element_block<50, SvtBroadcaster> >, mdds::detail::mtv_event_func>::block*, std::allocator<mdds::multi_type_vector<mdds::mtv::custom_block_func1<mdds::mtv::noncopyable_managed_element_block<50, SvtBroadcaster> >, mdds::detail::mtv_event_func>::block*> > >::operator=(__gnu_debug::_Safe_iterator<__gnu_cxx::__normal_iterator<mdds::multi_type_vector<mdds::mtv::custom_block_func1<mdds::mtv::noncopyable_managed_element_block<50, SvtBroadcaster> >, mdds::detail::mtv_event_func>::block**, std::__cxx1998::vector<mdds::multi_type_vector<mdds::mtv::custom_block_func1<mdds::mtv::noncopyable_managed_element_block<50, SvtBroadcaster> >, mdds::detail::mtv_event_func>::block*, std::allocator<mdds::multi_type_vector<mdds::mtv::custom_block_func1<mdds::mtv::noncopyable_managed_element_block<50, SvtBroadcaster> >, mdds::detail::mtv_event_func>::block*> > >, std::__debug::vector<mdds::multi_type_vector<mdds::mtv::custom_block_func1<mdds::mtv::noncopyable_managed_element_block<50, SvtBroadcaster> >, mdds::detail::mtv_event_func>::block*, std::allocator<mdds::multi_type_vector<mdds::mtv::custom_block_func1<mdds::mtv::noncopyable_managed_element_block<50, SvtBroadcaster> >, mdds::detail::mtv_event_func>::block*> > > const&) (this=0x47d30b8, __x=) at /usr/include/c++/4.8/debug/safe_iterator.h:221
#17 0x00007f4eb5a63314 in mdds::__mtv::iterator_common_base<mdds::multi_type_vector<mdds::mtv::custom_block_func1<mdds::mtv::noncopyable_managed_element_block<50, SvtBroadcaster> >, mdds::detail::mtv_event_func>::iterator_trait>::operator=(mdds::__mtv::iterator_common_base<mdds::multi_type_vector<mdds::mtv::custom_block_func1<mdds::mtv::noncopyable_managed_element_block<50, SvtBroadcaster> >, mdds::detail::mtv_event_func>::iterator_trait> const&) (this=0x47d3068, other=...) at /data/opt/libreoffice/master/workdir/UnpackedTarball/mdds/include/mdds/multi_type_vector_itr.hpp:224
#18 0x00007f4eb5a60625 in mdds::__mtv::iterator_base<mdds::multi_type_vector<mdds::mtv::custom_block_func1<mdds::mtv::noncopyable_managed_element_block<50, SvtBroadcaster> >, mdds::detail::mtv_event_func>::iterator_trait, mdds::__mtv::private_data_forward_update<mdds::__mtv::iterator_value_node<unsigned long, mdds::mtv::base_element_block> > >::operator=(mdds::__mtv::iterator_base<mdds::multi_type_vector<mdds::mtv::custom_block_func1<mdds::mtv::noncopyable_managed_element_block<50, SvtBroadcaster> >, mdds::detail::mtv_event_func>::iterator_trait, mdds::__mtv::private_data_forward_update<mdds::__mtv::iterator_value_node<unsigned long, mdds::mtv::base_element_block> > > const&) (this=0x47d3068) at /data/opt/libreoffice/master/workdir/UnpackedTarball/mdds/include/mdds/multi_type_vector_itr.hpp:241
#19 0x00007f4eb5a6066a in sc::ColumnBlockPosition::operator=(sc::ColumnBlockPosition const&) (this=0x47d2ff0) at /data/opt/libreoffice/master/sc/inc/mtvelements.hxx:108
#20 0x00007f4eb5a4de04 in (anonymous namespace)::CopyByCloneHandler::~CopyByCloneHandler() (this=0x7fff8a015940, __in_chrg=<optimized out>) at /data/opt/libreoffice/master/sc/source/core/data/column.cxx:1509
#21 0x00007f4eb5a4f196 in ScColumn::CopyToColumn(sc::CopyToDocContext&, int, int, InsertDeleteFlags, bool, ScColumn&, ScMarkData const*, bool, bool) const (this=0x5a74fa0, rCxt=..., nRow1=0, nRow2=1048575, nFlags=2807, bMarked=false, rColumn=..., pMarkData=0x0, bAsLink=false, bGlobalNamesToLocal=false) at /data/opt/libreoffice/master/sc/source/core/data/column.cxx:1693
#22 0x00007f4eb5dce2dc in ScTable::CopyToTable(sc::CopyToDocContext&, short, int, short, int, InsertDeleteFlags, bool, ScTable*, ScMarkData const*, bool, bool, bool) (this=0x5d7c070, rCxt=..., nCol1=2, nRow1=0, nCol2=2, nRow2=1048575, nFlags=2815, bMarked=false, pDestTab=0x38ae9a0, pMarkData=0x0, bAsLink=false, bColRowFlags=true, bGlobalNamesToLocal=false) at /data/opt/libreoffice/master/sc/source/core/data/table2.cxx:1103
#23 0x00007f4eb5bcdcf6 in ScDocument::CopyToDocument(short, int, short, short, int, short, InsertDeleteFlags, bool, ScDocument*, ScMarkData const*, bool) (this=0x5b80200, nCol1=2, nRow1=0, nTab1=0, nCol2=2, nRow2=1048575, nTab2=0, nFlags=2815, bOnlyMarked=false, pDestDoc=0x3bc8888, pMarks=0x0, bColRowFlags=true) at /data/opt/libreoffice/master/sc/source/core/data/document.cxx:2037
#24 0x00007f4eb65ca247 in ScUndoDeleteCells::DoChange(bool) (this=0x437ce40, bUndo=true) at /data/opt/libreoffice/master/sc/source/ui/undo/undoblk.cxx:410
#25 0x00007f4eb65ca9ae in ScUndoDeleteCells::Undo() (this=0x437ce40) at /data/opt/libreoffice/master/sc/source/ui/undo/undoblk.cxx:502
#26 0x00007f4ef14099c7 in SfxUndoManager::ImplUndo(SfxUndoContext*) (this=0x37ee5f0, i_contextOrNull=0x0) at /data/opt/libreoffice/master/svl/source/undo/undo.cxx:783
#27 0x00007f4ef1409775 in SfxUndoManager::Undo() (this=0x37ee5f0) at /data/opt/libreoffice/master/svl/source/undo/undo.cxx:743
#28 0x00007f4ef0521ad7 in SdrUndoManager::Undo() (this=0x37ee5f0) at /data/opt/libreoffice/master/svx/source/svdraw/sdrundomanager.cxx:60
#29 0x00007f4eb68be425 in ScTabViewShell::ExecuteUndo(SfxRequest&) (this=0x4f90420, rReq=...) at /data/opt/libreoffice/master/sc/source/ui/view/tabvwshb.cxx:509
#30 0x00007f4eb68a924d in SfxStubScTabViewShellExecuteUndo(SfxShell*, SfxRequest&) (pShell=0x4f90420, rReq=...) at /data/opt/libreoffice/master/workdir/SdiTarget/sc/sdi/scslots.hxx:1537

HTH.
Comment 3 Caolán McNamara 2016-07-11 15:47:04 UTC
despite the horror template foo these tend to be "mundane" bugs FWIW e.g. 2511e272481172b439d167fd8b09d14c755f223d and dd7a2c95b86d158be8d0637bdff13b9a0ed9954b
Comment 4 Commit Notification 2016-08-15 19:27:25 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=7b768dd9a78d2a979eb4d1b1b5b33a4f01a1a98a

Resolves: tdf#100852 update miBroadcasterPos before copying it

It will be available in 5.3.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 5 Eike Rathke 2016-08-15 20:16:07 UTC
Pending review
https://gerrit.libreoffice.org/28151 for 5-2

Problem probably was there since 4.2 but manifests only with debug STL. Other than that no harm as the singular iterator wasn't used afterwards.
Comment 6 Commit Notification 2016-08-16 09:23:51 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=50e88b1dec896236b6d7653a767028d0bed1c857

update miBroadcasterPos before copying it, tdf#100852 related

It will be available in 5.3.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 7 Commit Notification 2016-08-16 20:03:16 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "libreoffice-5-2":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=328d0fcbe2a9dbcb3431d6142073bfe0ea6792cb&h=libreoffice-5-2

Resolves: tdf#100852 update miBroadcasterPos before copying it

It will be available in 5.2.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 8 Timur 2016-08-17 09:35:01 UTC
Is this related to Bug 92117?
Comment 9 Eike Rathke 2016-08-17 10:01:49 UTC
Doesn't look like.