Bug 138710 - Crash when deleting cell rows (multi_type_vector::position#1707: block position not found!) ( steps in comment 7 )
Summary: Crash when deleting cell rows (multi_type_vector::position#1707: block positi...
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
6.0 all versions
Hardware: All Linux (All)
: high major
Assignee: Eike Rathke
URL:
Whiteboard: target:7.2.0 target:7.1.0.2 target:7.0.5
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2020-12-07 11:18 UTC by Kevin Suo
Modified: 2020-12-21 20:18 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:


Attachments
test ods file (13.84 KB, application/vnd.oasis.opendocument.spreadsheet)
2020-12-07 11:18 UTC, Kevin Suo
Details
gdbtrace.log (14.37 KB, text/x-log)
2020-12-07 11:19 UTC, Kevin Suo
Details
screenshot showing steps to reproduce (69.17 KB, application/pdf)
2020-12-12 07:13 UTC, Kevin Suo
Details
bt with debug symbols (9.92 KB, text/plain)
2020-12-12 10:47 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Kevin Suo 2020-12-07 11:18:23 UTC Comment hidden (obsolete)
Comment 1 Kevin Suo 2020-12-07 11:19:14 UTC
Created attachment 167898 [details]
gdbtrace.log
Comment 2 Kevin Suo 2020-12-07 11:24:18 UTC
The special of this file is that it contains an un-merged cell in Sheet1.B5 which references to Sheet2, and then this unmerged cell is followed by a merged cell which also references to Sheet2.
Comment 3 Julien Nabet 2020-12-09 20:33:21 UTC Comment hidden (obsolete)
Comment 4 Julien Nabet 2020-12-09 20:40:36 UTC Comment hidden (obsolete)
Comment 5 Kevin Suo 2020-12-10 00:33:35 UTC Comment hidden (obsolete)
Comment 6 Xisco Faulí 2020-12-11 18:11:43 UTC Comment hidden (obsolete)
Comment 7 Kevin Suo 2020-12-12 07:05:02 UTC
Steps to Reproduce:

1. Go to Sheet2;
2. Click the top-left corner of the column and row labels *i.e., the place to the left of column A and on top of row 1), to select all.
3. Put cursor on the row labels (i.e., 1,2,3,4,5...), then right-click and select "Delete Rows".
--> Crash.


Terminal output:

terminate called after throwing an instance of 'std::out_of_range'
  what():  multi_type_vector::position#1707: block position not found! (logical pos=1048579, block size=4, logical size=1048576)

Fedora 32 gtk3 with X11

Version: 7.1.0.0.beta1+
Build ID: 8f7c26f166df33589f3522b43dbea4169a9ffd1e
CPU threads: 4; OS: Linux 5.9; UI render: default; VCL: gtk3
Locale: zh-CN (zh_CN.UTF-8); UI: en-US
Calc: threaded

Fedora 32 X11
Comment 8 Kevin Suo 2020-12-12 07:13:58 UTC
Created attachment 168087 [details]
screenshot showing steps to reproduce
Comment 9 Julien Nabet 2020-12-12 10:47:15 UTC
Created attachment 168094 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today, I could reproduce this.
I used in gdb:
catch throw

I disabled it until just before the last action "Delete Rows", since there are quite a lot of exceptions thrown.
Comment 10 Julien Nabet 2020-12-12 10:51:35 UTC
In addition to bt, I just noticed this on console:
warn:legacy.tools:147325:147325:svx/source/form/fmvwimp.cxx:436: FmXFormView::~FmXFormView: Window list not empty!
terminate called after throwing an instance of 'std::out_of_range'
  what():  multi_type_vector::position#1707: block position not found! (logical pos=1048579, block size=4, logical size=1048576)
warn:legacy.osl:147325:147325:framework/source/services/autorecovery.cxx:1948: need at document, at the very least

Kohei: I put you in cc in addition of Eike since it may interest you because may be related to mdds (I attached a bt)
Comment 11 Xisco Faulí 2020-12-14 09:41:18 UTC
Regression introduced by:

https://cgit.freedesktop.org/libreoffice/core/commit/?id=a962f1465a8db9b6c4dfdfd8fef9141f07d7fd06

author	Eike Rathke <erack@redhat.com>	2017-06-27 15:00:55 +0200
committer	Eike Rathke <erack@redhat.com>	2017-06-27 15:04:22 +0200
commit a962f1465a8db9b6c4dfdfd8fef9141f07d7fd06 (patch)
tree 747e4bd5f74039af7303664187b921b5234c43eb
parent b06657fca57b02ffb267a168bc9323780aeafbef (diff)
Resolves: tdf#108788 update references for deletions at end of sheet

Bisected with: bibisect-linux64-6.0

Adding Cc: to Eike Rathke
Comment 12 Eike Rathke 2020-12-18 17:51:03 UTC
Taking.
Comment 13 Eike Rathke 2020-12-18 18:45:23 UTC
One could assume that in sc/source/core/tool/sharedformula.cxx SharedFormulaUtil::splitFormulaCellGroups() this

    CellStoreType::position_type aPos = rCells.position(nRow);
    if (aPos.first == rCells.end())
        return false;

if nRow was invalid would result in an end iterator and thus return false, alas, the position() call prefers to throw instead..

Anyway, the cause is elsewhere.
Comment 14 Commit Notification 2020-12-18 21:47:57 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/121d4f610a2b4caa871aa0132eccbd4e12d13b3f

Resolves: tdf#138710 Do not push an out-of-bounds bound to boundaries

It will be available in 7.2.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 16 Commit Notification 2020-12-19 01:49:06 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "libreoffice-7-1":

https://git.libreoffice.org/core/commit/abecbc3eb6d6d9fa6b51c45a52c24a2001ded195

Resolves: tdf#138710 Do not push an out-of-bounds bound to boundaries

It will be available in 7.1.0.2.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 17 Commit Notification 2020-12-20 16:55:59 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "libreoffice-7-0":

https://git.libreoffice.org/core/commit/b22674e6283a624308d79a515e5b691f45c2338d

Resolves: tdf#138710 Do not push an out-of-bounds bound to boundaries

It will be available in 7.0.5.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 18 Commit Notification 2020-12-21 20:18:56 UTC
Xisco Fauli committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/b49522d96306933dfc94f9e42cc45190514b0af9

tdf#138710: sc_uicalc: Add unittest

It will be available in 7.2.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.