Bug 140754 - LibreOffice Calc crash when selecting filters (threaded)
Summary: LibreOffice Calc crash when selecting filters (threaded)
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
6.0 all versions
Hardware: x86-64 (AMD64) All
: medium normal
Assignee: Luboš Luňák
URL:
Whiteboard: target:7.2.0 target:7.1.2 target:7.0.6
Keywords: haveBacktrace
Depends on:
Blocks:
 
Reported: 2021-03-02 09:50 UTC by Alexander
Modified: 2021-03-11 12:13 UTC (History)
8 users (show)

See Also:
Crash report or crash signature:


Attachments
The file that causes the crash. (53.48 KB, application/vnd.oasis.opendocument.spreadsheet)
2021-03-02 09:50 UTC, Alexander
Details
Video demostrating the crash (2.05 MB, video/x-matroska)
2021-03-02 09:51 UTC, Alexander
Details
gdb bt (16.80 KB, text/plain)
2021-03-02 17:35 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander 2021-03-02 09:50:01 UTC
Description:
LibreOffice Calc will (with the attached file) crash when selecting filters. It crashes on GNU/Linux (ArchLinux) and on Windows 10 systems. On GNU/Linux it will fails with various error messages:

double free or corruption (!prev)
corrupted size vs. prev_size
corrupted double-linked list

Steps to Reproduce:
1. Open the bug.ods file
2. Try to play around selecting filter options

Actual Results:
The program will crash

Expected Results:
The program shouldn;t crash, and the selection of the filters should be executed. 


Reproducible: Always


User Profile Reset: No



Additional Info:
Version: 7.0.4.2
Build ID: 00(Build:2)
CPU threads: 4; OS: Linux 5.11; UI render: default; VCL: gtk3
Locale: el-GR (en_US.UTF-8); UI: en-US
7.0.4-1
Calc: threaded
Comment 1 Alexander 2021-03-02 09:50:55 UTC
Created attachment 170171 [details]
The file that causes the crash.

corrupted double-linked list.
Comment 2 Alexander 2021-03-02 09:51:43 UTC
Created attachment 170172 [details]
Video demostrating the crash

Video demostrating the crash
Comment 3 Alexander 2021-03-02 12:20:42 UTC
It also crashes with version 7.1.03

Version: 7.1.0.3 / LibreOffice Community
Build ID: 10(Build:3)
CPU threads: 4; OS: Linux 5.11; UI render: default; VCL: gtk3
Locale: el-GR (en_US.UTF-8); UI: en-US
7.1.0-1
Calc: threaded
Comment 4 mulla.tasanim 2021-03-02 15:50:59 UTC
Thank you for reporting the bug. 

I can confirm that the bug is present in

Version: 7.0.3.1 (x64)
Build ID: d7547858d014d4cf69878db179d326fc3483e082
CPU threads: 4; OS: Windows 6.3 Build 9600; UI render: Skia/Raster; VCL: win
Locale: nb-NO (en_US); UI: en-US
Calc: CL

Version: 7.2.0.0.alpha0+ (x64)
Build ID: 761a672d62df1891b9f4f367a499b220ab2b33fa
CPU threads: 4; OS: Windows 6.3 Build 9600; UI render: Skia/Raster; VCL: win
Locale: en-US (en_US); UI: en-US
Calc: CL
Comment 5 Alexander 2021-03-02 16:43:13 UTC
I can no logger reproduce the issue on Windows 10. It seems that the crash on windows was unrelated. After a system restart no more crashes.
Comment 6 Alexander 2021-03-02 16:47:20 UTC
Just saw that mulla.tasanim confirmed it for windows. It seems that on windows it is not always reproducible.
Comment 7 Julien Nabet 2021-03-02 17:35:18 UTC
Created attachment 170182 [details]
gdb bt

On pc Debian x86-64 with master sources updated today, I could reproduce this.

I attached console logs + bt
Comment 8 Julien Nabet 2021-03-02 17:36:56 UTC
Sometimes it crashes after having selected "All" for the first filter, sometimes it only crashes after having selected "All" for the second filter.
Comment 9 Alexander 2021-03-03 06:53:48 UTC
Don't know if it help, but it also crashes with version 6.4.7
Comment 10 Julien Nabet 2021-03-03 17:15:46 UTC
So not a new bug from 7.X branch
Comment 11 Julien Nabet 2021-03-03 17:17:55 UTC
Kohei: I put you in cc in addition to Eike because there's mdds in bt. Now perhaps it's just because LO part calls mdds wrongly.
Comment 12 Xisco Faulí 2021-03-08 19:46:13 UTC
This happens when threaded calculation is enabled. The bisection point to https://cgit.freedesktop.org/libreoffice/core/commit/?id=5222910f969390c64c18866834d9af53e7c4c189

@Tor, @Luboš, I thought you might be interested in this issue
Comment 13 Julien Nabet 2021-03-08 19:55:51 UTC
On pc Debian x86-64 with master sources updated today, I confirm I don't reproduce the crash if I disable "Enable multi-threaded calculation" option.
(I still can reproduce this if re enable the option).
Comment 14 Commit Notification 2021-03-09 10:13:28 UTC
Luboš Luňák committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/2fb274950e5207ca55f4f52325fb522bd44024e1

fix ScFlatBoolSegmentsImpl delayed setup with threads (tdf#140754)

It will be available in 7.2.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 15 Xisco Faulí 2021-03-09 21:25:31 UTC
Verified in

Version: 7.2.0.0.alpha0+ / LibreOffice Community
Build ID: 3dfe1df0f1084b06c7d4c95df387253b2e058cd6
CPU threads: 4; OS: Linux 5.7; UI render: default; VCL: gtk3
Locale: en-US (en_US.UTF-8); UI: en-US
Calc: threaded

@Luboš Luňák, thanks for the quick fix!!
Comment 16 Commit Notification 2021-03-09 21:26:01 UTC
Luboš Luňák committed a patch related to this issue.
It has been pushed to "libreoffice-7-1":

https://git.libreoffice.org/core/commit/fb232a8d8ff143410e17bfe9672207479697e3ef

fix ScFlatBoolSegmentsImpl delayed setup with threads (tdf#140754)

It will be available in 7.1.2.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 17 Commit Notification 2021-03-10 09:19:58 UTC
Luboš Luňák committed a patch related to this issue.
It has been pushed to "libreoffice-7-0":

https://git.libreoffice.org/core/commit/99890e4450ceae45f30da1667c85da73deabfdc9

fix ScFlatBoolSegmentsImpl delayed setup with threads (tdf#140754)

It will be available in 7.0.6.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 18 Commit Notification 2021-03-11 12:13:45 UTC
Xisco Fauli committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/feb4067be5d8e40902190dc58a7a634a21102f34

tdf#140754: sc: Add UItest

It will be available in 7.2.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.