Bug Hunting Session
Bug 104919 - Calc will crash when Manual input column value and row value in navigator.
Summary: Calc will crash when Manual input column value and row value in navigator.
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
5.3.0.0.beta2
Hardware: x86-64 (AMD64) Windows (All)
: highest critical
Assignee: Caolán McNamara
URL:
Whiteboard: target:5.4.0 target:5.3.0.2
Keywords: bibisected, bisected, regression
Depends on:
Blocks:
 
Reported: 2016-12-25 09:13 UTC by odinatlas
Modified: 2017-02-15 14:34 UTC (History)
5 users (show)

See Also:
Crash report or crash signature: ["RowEdit::ExecuteRow()"]


Attachments
Calc will crashe when Manual input column value and row value in navigator (352.46 KB, image/png)
2016-12-25 09:20 UTC, odinatlas
Details

Note You need to log in before you can comment on or make changes to this bug.
Description odinatlas 2016-12-25 09:13:33 UTC
Description:
When open an ods file ,or create an ods file,Manual input column value and row value  in navigator

Steps to Reproduce:
1.open an ods file
2.show Calc navigator
3.Manual input column value and row value  in navigator

Actual Results:  
Calc will crash.

Expected Results:
Calc should not crash.


Reproducible: Always

User Profile Reset: No

Additional Info:


User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0
Comment 1 odinatlas 2016-12-25 09:20:23 UTC
Created attachment 129935 [details]
Calc will crashe when Manual input column value and row value in navigator
Comment 2 m.a.riosv 2016-12-25 21:04:52 UTC
Reproducible.
crashreport.libreoffice.org/stats/crash_details/08117e3b-db6d-492e-9f3a-20db37e92f6b
Version: 5.3.0.0.beta2 (x64)
Build ID: a7e30712ad6d8bc9286007b37aa581983e0caba3
CPU Threads: 4; OS Version: Windows 6.19; UI Render: default; Layout Engine: new; 
Locale: es-ES (es_ES); Calc: group

Not reproducible.
Version: 5.2.4.1 (x64)
Build ID: 9b50003582f07ac674d6451e411e9b77cccd2b22
CPU Threads: 4; OS Version: Windows 6.19; UI Render: default; 
Locale: es-ES (es_ES); Calc: group
Comment 3 raal 2016-12-27 16:48:48 UTC
This seems to have begun at the below commit.
Adding Cc: to Caolán McNamara; Could you possibly take a look at this one? Thanks

84c034f01a254710c6a9120065015e7f27b420c5 is the first bad commit
commit 84c034f01a254710c6a9120065015e7f27b420c5
Author: Norbert Thiebaud <nthiebaud@gmail.com>
Date:   Fri Oct 7 18:06:46 2016 -0700

    source sha:141a4ac1d21121a4e46470c797c6fce741151fee
	
author	Caolán McNamara <caolanm@redhat.com>	2016-10-07 11:09:24 (GMT)
committer	Caolán McNamara <caolanm@redhat.com>	2016-10-07 20:16:56 (GMT)
commit	141a4ac1d21121a4e46470c797c6fce741151fee (patch)
tree	48a884e20b422433577f5e481067576246ec0b66
parent	6e14f159b4fd13f8760ab19496f1e465a19c28e8 (diff)
convert calc navigator to .ui format
Comment 4 Julien Nabet 2016-12-27 20:58:26 UTC
On pc Debian x86-64 with master sources updated today, I could reproduce this.

part of bt:
#0  0x00002aaad53237f8 in rtl::Reference<ColumnEdit>::get (this=0x2b8) at /home/julien/lo/libreoffice/include/rtl/ref.hxx:169
#1  0x00002aaad5322e5e in VclPtr<ColumnEdit>::operator-> (this=0x2b8) at /home/julien/lo/libreoffice/include/vcl/vclptr.hxx:159
#2  0x00002aaad531cb25 in RowEdit::ExecuteRow (this=0x5555587e1bc0) at /home/julien/lo/libreoffice/sc/source/ui/navipi/navipi.cxx:301
#3  0x00002aaad531c9e5 in RowEdit::EventNotify (this=0x5555587e1bc0, rNEvt=...) at /home/julien/lo/libreoffice/sc/source/ui/navipi/navipi.cxx:275

(gdb) frame 2
#2  0x00002aaad531cb25 in RowEdit::ExecuteRow (this=0x5555587e1bc0) at /home/julien/lo/libreoffice/sc/source/ui/navipi/navipi.cxx:301
301	    SCCOL nCol = xDlg->aEdCol->GetCol();
(gdb) p xDlg
$1 = {m_rInnerRef = empty rtl::Reference}
Comment 5 Commit Notification 2017-01-05 16:10:58 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=f91dc0342de13e648dba5d9a93c01db23ae83533

Resolves: tdf#104919 crash with empty ScNavigatorDlg member

It will be available in 5.4.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 6 Commit Notification 2017-01-05 16:13:30 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-5-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=d4b57240aabece5550cc9ac448ff90301ed6ec3d&h=libreoffice-5-3

Resolves: tdf#104919 crash with empty ScNavigatorDlg member

It will be available in 5.3.0.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.