Bug 106089 - Crash when creating a chart
Summary: Crash when creating a chart
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
4.3 all versions
Hardware: All All
: highest critical
Assignee: Eike Rathke
QA Contact:
URL:
Whiteboard: target:5.4.0 target:5.3.1 target:5.2.6
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2017-02-19 13:28 UTC by tvataire
Modified: 2017-03-02 15:58 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description tvataire 2017-02-19 13:28:18 UTC
On Debian x86-64 and Windows 7 x86, got a crash when creating a chart under certain circumstances.

Step to reproduce : 
- open a brand new Calc file
- go to Tools > Options... > LibreOffice Calc > Formula > Formula Options and select "Excel A1" in the menu "Formula syntax"
- click OK button
- put two values in two contiguous cells
- move the cell cursor on one of theses value (do not highlight the cell)
- click on the chart icon

Actual Results: 
A "Fatal error" dialog without message appears.
LibreOffice crashes when the OK button is clicked in the dialog.

Expected Results:
No fatal error
No crash

Reproducible: Always

User Profile Reset: Yes

Additional Info:
The problem only appears when : 
- the formula syntax is "Excel A1"
- there are several contiguous cells of data but no cells are highlighted, so calc auto-selects data to use to create the chart (equivalent to CTRL + *).
Comment 1 tvataire 2017-02-19 13:38:27 UTC
This bug yet exists in LibreOffice 5.2.5.1 an LibreOffice 5.3.0.3.
Comment 2 Julien Nabet 2017-02-19 13:55:37 UTC
On pc Debian x86-64 with master sources updated yesterday, I could reproduce this.

For the moment, I only get a stack from the error message and I don't know how to locate the root cause.
Comment 3 Julien Nabet 2017-02-19 14:48:44 UTC
I finally got this:
#0  0x00007ffff6b05240 in __cxa_throw () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#1  0x00007fffcd0a4ff4 in ScChart2DataProvider::createDataSource (this=0x55555c331b60, aArguments=...) at /home/julien/lo/libreoffice/sc/source/ui/unoobj/chart2uno.cxx:1475
#2  0x00007fffc540f55c in chart::ChartModel::setArguments (this=0x55555c2ab2f0, aArguments=uno::Sequence of length 4 = {...})
    at /home/julien/lo/libreoffice/chart2/source/model/main/ChartModel.cxx:868
#3  0x00007fffccf78ec6 in (anonymous namespace)::lcl_ChartInit (xObj=uno::Reference to (OCommonEmbeddedObject *) 0x55555c29b9a0, pViewData=pViewData@entry=0x55555799b148, 
    rRangeParam="") at /home/julien/lo/libreoffice/sc/source/ui/drawfunc/fuins2.cxx:188
#4  0x00007fffccf7a9e5 in FuInsertChart::FuInsertChart (this=0x7fffffff4540, pViewSh=0x55555799b0d0, pWin=<optimized out>, pViewP=<optimized out>, pDoc=<optimized out>, 
    rReq=...) at /home/julien/lo/libreoffice/sc/source/ui/drawfunc/fuins2.cxx:558

(I used break __cxa_throw and retrieved lots of bts until the one just before the message box)
Comment 4 Julien Nabet 2017-02-19 16:49:31 UTC
some debug traces:
1) With Excel notation
Thread 1 "soffice.bin" hit Breakpoint 1, ScRefTokenHelper::compileRangeRepresentation (rRefTokens=std::__debug::vector of length 0, capacity 0, rRangeStr="$Sheet1.$A$1:$B$1", 
    pDoc=0x555557830850, cSep=59 u';', eGrammar=formula::FormulaGrammar::GRAM_NATIVE_XL_A1, bOnly3DRef=true)
pArray = 3

2) With Calc notation:
Thread 1 "soffice.bin" hit Breakpoint 1, ScRefTokenHelper::compileRangeRepresentation (rRefTokens=std::__debug::vector of length 0, capacity 0, rRangeStr="$Sheet1.$A$1:$B$1", 
    pDoc=0x555557832230, cSep=59 u';', eGrammar=formula::FormulaGrammar::GRAM_NATIVE, bOnly3DRef=true) at /home/julien/lo/libreoffice/sc/source/core/tool/reftokenhelper.cxx:41
pArray = 1
Comment 5 Julien Nabet 2017-02-20 10:27:34 UTC
Eike: thought you might be interested in this one. It seems there's a problem with dealing notation/grammar/convention here. (see my previous comments)
Comment 6 Julien Nabet 2017-02-20 10:37:59 UTC
2 remarks:
1) if both cells are selected, there's no crash.
I noticed that in this case, aRangeString is already filled (and correctly for this convention, Sheet1!$A$1:$B$1) before calling lcl_ChartInit

2) There's the same problem with the third notation, R1C1
Comment 7 Xisco Faulí 2017-02-20 16:28:43 UTC
I can't reproduce it in

Version 4.1.0.0.alpha0+ (Build ID: efca6f15609322f62a35619619a6d5fe5c9bd5a)
Comment 8 Xisco Faulí 2017-02-20 16:44:52 UTC
Regression introduced by:

author	Markus Mohrhard <markus.mohrhard@collabora.co.uk>	2014-04-09 02:55:48 (GMT)
committer	Markus Mohrhard <markus.mohrhard@googlemail.com>	2014-04-09 02:58:14 (GMT)
commit	34669e634d7cb18099e8d27eed10e5b816237411 (patch)
tree	c20aa5cd35045d7d8795425c37c7d5db05f74c6b
parent	d9cde132b5a98dee61e0d0ce228e5008e699f37d (diff)
preserve selection if chart creation is cancelled, cp#1000052

Adding Cc: to Markus Mohrhard
Comment 9 Eike Rathke 2017-02-20 21:22:22 UTC
Taking.
Comment 10 Commit Notification 2017-02-20 21:33:59 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=0200677891c6d592a12343f0d6f82c569cd7a9e0

Resolves: tdf#106089 catch legal IllegalArgumentException on bad range string

It will be available in 5.4.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 11 Commit Notification 2017-02-20 22:09:43 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=3ec3d7ead0f2e47a4e24ba0d6953fea0f49815ed

Related: tdf#106089 generate range string with current address convention

It will be available in 5.4.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 12 Eike Rathke 2017-02-20 22:36:55 UTC
Pending review
https://gerrit.libreoffice.org/34496 for 5-3
https://gerrit.libreoffice.org/34497 for 5-2
https://gerrit.libreoffice.org/34498 for 5-2-6
Comment 13 Julien Nabet 2017-02-21 22:12:35 UTC
With master sources updated today, I don't reproduce the crash.
Let's put this one to VERIFIED
Thank you Eike!
Comment 14 Commit Notification 2017-02-21 22:14:54 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "libreoffice-5-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=69bc288b0aac0672cf560dec2c4c946e9620ea62&h=libreoffice-5-3

Resolves: tdf#106089 generate range string with current address convention

It will be available in 5.3.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 15 Commit Notification 2017-02-22 13:37:34 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "libreoffice-5-2-6":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=e0f2340927f5c7f734a4d4774badf729cafc1386&h=libreoffice-5-2-6

Resolves: tdf#106089 generate range string with current address convention

It will be available in 5.2.6.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 16 Commit Notification 2017-02-23 00:26:55 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "libreoffice-5-2":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=22f80362336f2332984ee2bccddd6eb39abfdea0&h=libreoffice-5-2

Resolves: tdf#106089 generate range string with current address convention

It will be available in 5.2.7.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 17 Julien Nabet 2017-02-23 06:11:35 UTC
Simplify targets a bit
Comment 18 Commit Notification 2017-02-28 11:56:23 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "libreoffice-5-3-1":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=0c6d6106a9914b9de16634ee4f55f14a44344bbc&h=libreoffice-5-3-1

Resolves: tdf#106089 generate range string with current address convention

It will be available in 5.3.1.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 19 tvataire 2017-03-02 15:58:01 UTC
Tested in 5.2.6.1 and libreoffice-5-2~2017-02-27_13.52.25_LibreOfficeDev_5.2.7.0.0 under Debian x86_64 and everything seems ok.
Thank you everybody  :)