Bug 160368 - Crash on save after deleting sheet
Summary: Crash on save after deleting sheet
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
6.2.0.3 release
Hardware: x86-64 (AMD64) All
: medium critical
Assignee: Caolán McNamara
URL:
Whiteboard: target:24.8.0 target:24.2.3
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks: Save Sheet Crash
  Show dependency tree / graph
 
Reported: 2024-03-25 23:10 UTC by Vlad-Mihai Sima
Modified: 2024-04-01 10:20 UTC (History)
8 users (show)

See Also:
Crash report or crash signature: ["ScFormulaGroupCycleCheckGuard::ScFormulaGroupCycleCheckGuard(ScRecursionHelper&, ScFormulaCell*)","ScRecursionHelper::PushFormulaGroup"]

Attachments
Spreadsheet that crashes if one sheet except PROBLEM is deleted and file saved (89.03 KB, application/vnd.oasis.opendocument.spreadsheet)
2024-03-25 23:10 UTC, Vlad-Mihai Sima 		Details
gdb trace (91.83 KB, text/x-log)
2024-03-25 23:11 UTC, Vlad-Mihai Sima 		Details
bt with console logs (9.49 KB, text/plain)
2024-03-26 12:35 UTC, Julien Nabet 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Vlad-Mihai Sima 2024-03-25 23:10:46 UTC 
Created attachment 193304 [details]
Spreadsheet that crashes if one sheet except PROBLEM is deleted and file saved

Steps to reproduce:
a) load bug.ods
b) delete one sheet for example "a" - except the one called "PROBLEM"
c) save -> this crashes for me (see gdbtrace.log).

Based on the trace, this seems similar to https://bugs.documentfoundation.org/show_bug.cgi?id=130435#c3

As with the mentioned bug, originally the spreadsheet was quite complex and with sensitive information, but I deleted all the sheets contents (could not delete the sheets as it would trigger the bug), and changed their names.

Does not seem to matter which sheet I delete (tried 3-4).

Bug also happens if I change the value in cell F8 in sheet "PROBLEM" (but might be because of autosave)

The sheet in question was created by duplicating another sheet in the same file, and doing some edits (deleting couple of columns and rows and changing a couple of formulas) but nothing too fancy.

I am using Arch Linux.
Comment 1 Vlad-Mihai Sima 2024-03-25 23:11:35 UTC 
Created attachment 193305 [details]
gdb trace
Comment 2 Telesto 2024-03-26 00:25:21 UTC 
Confirm
Version: 24.8.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: b38974391e8d4bf0d450abfaa86bbccbe1022995
CPU threads: 8; OS: macOS 14.3; UI render: Skia/Raster; VCL: osx
Locale: nl-NL (nl_NL.UTF-8); UI: en-US
Calc: threaded
Comment 3 m_a_riosv 2024-03-26 00:45:21 UTC 
Not reproducible:
Version: 24.2.2.2 (X86_64) / LibreOffice Community
Build ID: d56cc158d8a96260b836f100ef4b4ef25d6f1a01
CPU threads: 16; OS: Windows 10.0 Build 22631; UI render: default; VCL: win
Locale: es-ES (es_ES); UI: en-US
Calc: CL threaded
neither with
Version: 24.8.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 1344e6261a1d856c71eca1e0cc29215a586bf335
CPU threads: 16; OS: Windows 10.0 Build 22631; UI render: Skia/Raster; VCL: win
Locale: es-ES (es_ES); UI: en-US
Calc: CL threaded
Comment 4 Armondo Lopez 2024-03-26 00:59:49 UTC 
Thank you for reporting the bug. I can confirm that the bug is present in 

Version: 24.2.1.2 (X86_64) / LibreOffice Community
Build ID: db4def46b0453cc22e2d0305797cf981b68ef5ac
CPU threads: 8; OS: Windows 10.0 Build 19045; UI render: Skia/Vulkan; VCL: win
Locale: en-US (en_US); UI: en-US
Calc: threaded

as well as

Version: 24.8.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: a2265e8faa099d9652efd12392c2877c2df1d1eb
CPU threads: 8; OS: Windows 10.0 Build 19045; UI render: Skia/Vulkan; VCL: win
Locale: en-US (en_US); UI: en-US
Calc: threaded
Comment 5 m_a_riosv 2024-03-26 02:44:11 UTC 
Not reproduced without 'Force Skia software rendering'
Version: 24.8.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 1344e6261a1d856c71eca1e0cc29215a586bf335
CPU threads: 16; OS: Windows 10.0 Build 22631; UI render: Skia/Vulkan; VCL: win
Locale: es-ES (es_ES); UI: en-US Calc: CL threaded

Not reproduced without 'Skia'
Version: 24.8.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 1344e6261a1d856c71eca1e0cc29215a586bf335
CPU threads: 16; OS: Windows 10.0 Build 22631; UI render: default; VCL: win
Locale: es-ES (es_ES); UI: en-US Calc: CL threaded
Comment 6 Stéphane Guillou (stragu) 2024-03-26 04:13:27 UTC 
Reproduced with:

- 6.2.0.3, with "ScRecursionHelper::PushFormulaGroup": https://crashreport.libreoffice.org/stats/crash_details/b3abd5d1-0599-4ecf-93aa-4e6fdaadb61c
- 7.0.0.3, same: https://crashreport.libreoffice.org/stats/crash_details/a46f2520-7b8a-4a53-b1db-b5864c58e658
- 7.3.0.3, with signature "ScFormulaGroupCycleCheckGuard::ScFormulaGroupCycleCheckGuard(ScRecursionHelper&, ScFormulaCell*)": https://crashreport.libreoffice.org/stats/crash_details/693cd29c-7efa-46fb-986f-e9af472bb229
- 7.6.5.2, same: https://crashreport.libreoffice.org/stats/crash_details/ffe18139-799b-4745-b4dd-b3fee563fe59

And recent trunk build:

Version: 24.2.2.1 (X86_64) / LibreOffice Community
Build ID: bf759d854b5ab45b6ef0bfd22e51c6dc4fb8b882
CPU threads: 8; OS: Linux 6.5; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: threaded

No repro in 6.1.0.3 -> regression.
Comment 7 raal 2024-03-26 06:14:21 UTC 
This seems to have begun at the below commit in bibisect repository/OS bibisect-linux-64-6.2.
Adding Cc: to Dennis Francis ; Could you possibly take a look at this one?
Thanks
 e6038449324f806a26398b9b63306624158ade7a is the first bad commit
commit e6038449324f806a26398b9b63306624158ade7a
Author: Jenkins Build User <tdf@pollux.tdf>
Date:   Fri Jul 6 14:28:17 2018 +0200

    source 0f95580d392bb1a6f103f3a1543fb61a16f9f263

57004: Use cycle guard for calls to InterpretTail too | https://gerrit.libreoffice.org/c/core/+/57004
Comment 8 Julien Nabet 2024-03-26 12:35:04 UTC 
Created attachment 193320 [details]
bt with console logs

On pc Debian x86-64 with master sources updated today, I could reproduce this.
Comment 9 Julien Nabet 2024-03-26 12:38:35 UTC 
Michael: thought you might be interested in this one as the reviewer of the quoted patch (see comment 7)
Comment 10 Caolán McNamara 2024-03-29 09:26:49 UTC 
Using data, calculate, recalculate hard also reproduces the underlying issue (with an assert in dbgutil mode at least) and is an easier problem to trace
Comment 11 Caolán McNamara 2024-03-29 16:26:20 UTC 
https://gerrit.libreoffice.org/c/core/+/165510 makes this work
Comment 12 Commit Notification 2024-03-29 19:35:51 UTC 
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/18d0b7ac865f8d905a8b9afbe56677c89b1f406c

Resolves: tdf#160368 crash on save after deleting sheet

It will be available in 24.8.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 13 Caolán McNamara 2024-03-29 19:36:49 UTC 
merged to trunk now, backport to 24-2 in gerrit
Comment 14 Commit Notification 2024-04-01 10:16:50 UTC 
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-24-2":

https://git.libreoffice.org/core/commit/85603be2365e80d3f8a363e99ac6196eb24d61c6

Resolves: tdf#160368 crash on save after deleting sheet

It will be available in 24.2.3.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 15 Julien Nabet 2024-04-01 10:20:21 UTC 
On pc Debian x86-64 with master sources updated today, I don't reproduce this anymore.
Thank you Caolán! :-)