Bug 161891 - Cell with formula, Cut+Paste, crash throwing an instance of 'std::out_of_range', block position not found (STR comment 9)
Summary: Cell with formula, Cut+Paste, crash throwing an instance of 'std::out_of_rang...
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
5.3.0.3 release
Hardware: All All
: medium critical
Assignee: Not Assigned
URL:
Whiteboard:
Keywords: bibisected, bisected, regression
Depends on:
Blocks: Paste Cell-Formula Crash
  Show dependency treegraph
 
Reported: 2024-07-03 23:18 UTC by Pat Finnegan
Modified: 2024-07-11 15:13 UTC (History)
4 users (show)

See Also:
Crash report or crash signature: ["ntdll.dll","libc.so.6","std::out_of_range::out_of_range(std::basic_string<char,std::char_traits<char>,std::allocator<char> > const &)"]


Attachments
Calc file as Requested (40.27 KB, application/vnd.oasis.opendocument.spreadsheet)
2024-07-04 11:45 UTC, Pat Finnegan
Details
updated calc file for debugging (41.06 KB, application/vnd.oasis.opendocument.spreadsheet)
2024-07-08 20:45 UTC, Pat Finnegan
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Pat Finnegan 2024-07-03 23:18:09 UTC
Description:
I use the sum function in Calc a LOT with no problem for many years now. Since yesterday (2nd July) a very simple sum caused multiple crashes. Today I installed the latest LibreOffice update, restarted the entire computer and the Sum function in Calc is STILL causing a crash. Existing sums are also showing up false. Here are the crash reports as sent:

https://crashreport.libreoffice.org/stats/crash_details/d7a2824e-a111-4285-be19-29afbcb828e2


https://crashreport.libreoffice.org/stats/crash_details/8f980070-1fbf-4ec6-83ad-d7219d6a5d02


https://crashreport.libreoffice.org/stats/crash_details/16a37987-bd97-4e83-bd47-1438e3e886ce


Steps to Reproduce:
1.Create a column of numbers
2.Sum new numbers, then cut 
3.Try to add cut sum to another already existing column of numbers in same sheet

Actual Results:
Calc crashes and recovered version has defective existing sums in existing columns

Expected Results:
The new sum should be able to add safely into a blank cell in an existing column of numbers which is already summed and the new total should display accurately


Reproducible: Always


User Profile Reset: No

Additional Info:
I have used Sum, Cut, Add, in Calc for very many years on a multiple times per day basis. I have never known it fail before
Comment 1 m_a_riosv 2024-07-04 01:12:33 UTC Comment hidden (obsolete)
Comment 2 Xisco Faulí 2024-07-04 08:17:55 UTC Comment hidden (obsolete)
Comment 3 Pat Finnegan 2024-07-04 11:28:04 UTC Comment hidden (obsolete)
Comment 4 Pat Finnegan 2024-07-04 11:45:53 UTC Comment hidden (obsolete)
Comment 5 m_a_riosv 2024-07-04 12:10:11 UTC Comment hidden (obsolete)
Comment 6 Julien Nabet 2024-07-06 19:12:57 UTC Comment hidden (obsolete)
Comment 7 ady 2024-07-08 04:19:53 UTC Comment hidden (obsolete)
Comment 8 Pat Finnegan 2024-07-08 20:45:59 UTC Comment hidden (obsolete)
Comment 9 ady 2024-07-08 22:42:59 UTC
I am changing the Summary field according to the relevant test and behavior, from:

"Sum function in Calc not working and causing crashes"

...to:

"Cell with formula, Cut+Paste, crash"


STR:
1. Open attachment 195175 [details].
2. Click on cell F239.
3. [CTRL]+[X] to cut cell F239.
4. Click on cell F268.
5. [CTRL]+[V] to paste the clipboard.


Actual results:
Calc Crash. Calc suggests the possibility to attempt recovery of the file. After recovery, AutoCalculate is OFF for the recovered file (but it was ON before the crash).

Same crash when starting LO in Safe Mode.

OpenCL: OFF.


* First; Not reproduced with:

** LibreOffice 3.3.0 
OOO330m19 (Build:6)
tag libreoffice-3.3.0.4

** AOO4115m2(Build:9813)  -  Rev. 5f13fa0070

   -> Regression.

* Reproduced, but showing error message before Calc closes itself, without a recovery attempt, and with a different fatal error (IIUC, but please double check):

** Version: 7.0.4.2 (x86)
Build ID: dcf040e67528d9187c66b2379df5ea4407429775
CPU threads: 4; OS: Windows 10.0 Build 19045; UI render: Skia/Raster; VCL: win
Locale: en-US (es_AR); UI: en-US
Calc: CL


* Crash reproduced with:

** Version: 24.8.0.0.beta1+ (X86_64) / LibreOffice Community
Build ID: 12b0d0dd2e22a1abc955a11bfe4ae87631409622
CPU threads: 4; OS: Windows 10 X86_64 (10.0 build 19045); UI render: Skia/Raster; VCL: win
Locale: en-US (es_AR); UI: en-US
Calc: threaded

** Version: 24.8.0.0.beta1+ (X86_64) / LibreOffice Community
Build ID: 12b0d0dd2e22a1abc955a11bfe4ae87631409622
CPU threads: 4; OS: Windows 10 X86_64 (10.0 build 19045); UI render: default; VCL: win
Locale: en-US (es_AR); UI: en-US
Calc: threaded

Version: 7.1.2.2 (x86) / LibreOffice Community
Build ID: 8a45595d069ef5570103caea1b71cc9d82b2aae4
CPU threads: 4; OS: Windows 10.0 Build 19045; UI render: default; VCL: win
Locale: en-US (es_AR); UI: en-US
Calc: threaded


Setting Version field to 7.1, since older version behaves differently.
Comment 10 ady 2024-07-08 23:02:32 UTC Comment hidden (obsolete)
Comment 11 m_a_riosv 2024-07-08 23:54:42 UTC
It happens cutting from the range F36:F240 and pasting on the range F262:F268
Comment 12 Stéphane Guillou (stragu) 2024-07-09 02:07:18 UTC
Thanks for clarifying.

No crash in 5.2.0.4.

In 5.3.0.3 and 5.4.0.2, crash with Fatal Error message:

multi_type_vector::position#1491: block position not found! (logical pos=18446744073709551598, block size=17, logical size=1048576)

Later, direct crash with no error message:
- signature "libc.so.6" in
   - 6.0: https://crashreport.libreoffice.org/stats/crash_details/629f5ee3-a082-4728-a03c-3fcc78d5b7e2
   - 7.0: https://crashreport.libreoffice.org/stats/crash_details/20c2c69c-9ca2-4139-a67a-7ed51053aefb
   - 7.1: https://crashreport.libreoffice.org/stats/crash_details/5e409624-e601-43de-93d4-9d28d842fa4a
   - 7.2: https://crashreport.libreoffice.org/stats/crash_details/8d5b030e-53e4-46fa-9127-fd442bab4fc9
   - 7.6: https://crashreport.libreoffice.org/stats/crash_details/8692e92e-f75b-4127-8833-a700a3ba34eb
   - 24.2.4.2: https://crashreport.libreoffice.org/stats/crash_details/0fea636d-59e7-4ba4-96c5-aa9398831cba

But as the terminal shows for 24.8 beta1, the issue hasn't changed:

terminate called after throwing an instance of 'std::out_of_range'
  what():  multi_type_vector::position#490: block position not found! (logical pos=18446744073709551598, block size=17, logical size=1048576)

Bibisected with linux-64-5.3 repo to first bad build [4467a22f4544cd2d5c637dd909f828ed3e99edb6] which is:

commit dfa92e106f7eaa8c3fc6cda034001197ecc53a8f
author	Eike Rathke 	Wed Oct 19 23:04:34 2016 +0200
committer	Eike Rathke 	Wed Oct 19 23:05:44 2016 +0200
Resolves: tdf#97968 adjust references during Cut&Paste of formula groups
Comment 13 Caolán McNamara 2024-07-11 15:13:57 UTC
seems a bit odd that a 2024-07-03 bug report about something reported to recently starting to fail then bisects to a 2016 commit

but fwiw catch throw std::out_of_range

gives:

#0  0x00007ffff74b5201 in __cxa_throw () at /lib64/libstdc++.so.6
#1  0x00007fff9549bf6a in mdds::mtv::detail::throw_block_position_not_found
    (method_sig=0x7fff972a9c41 "multi_type_vector::position", line=490, pos=18446744073709551598, block_size=17, container_size=1048576)
    at workdir/UnpackedTarball/mdds/include/mdds/multi_type_vector/soa/../util.hpp:153
#2  0x00007fff95595049 in mdds::mtv::soa::multi_type_vector<sc::CellStoreTraits>::position (this=0x1b9f460, pos=18446744073709551598)
    at workdir/UnpackedTarball/mdds/include/mdds/multi_type_vector/soa/main_def.inl:489
#3  0x00007fff961d9a80 in sc::SharedFormulaUtil::splitFormulaCellGroups (rDoc=..., rCells=..., rBounds=std::__debug::vector of length 3, capacity 4 = {...})
    at /home/caolan/LibreOffice/core/sc/source/core/tool/sharedformula.cxx:129
#4  0x00007fff9557f113 in ScColumn::UpdateReference (this=0x1b9f230, rCxt=..., pUndoDoc=0x6ffe940) at /home/caolan/LibreOffice/core/sc/source/core/data/column.cxx:2392
#5  0x00007fff95c07e03 in ScTable::UpdateReference (this=0x23b88e0, rCxt=..., pUndoDoc=0x6ffe940, bIncludeDraw=false, bUpdateNoteCaptionPos=true)
    at /home/caolan/LibreOffice/core/sc/source/core/data/table1.cxx:1875
#6  0x00007fff9578c10a in ScDocument::UpdateReference (this=0x2380190, rCxt=..., pUndoDoc=0x6ffe940, bIncludeDraw=false, bUpdateNoteCaptionPos=true)
    at /home/caolan/LibreOffice/core/sc/source/core/data/documen3.cxx:1074
#7  0x00007fff95816e2f in ScDocument::CopyBlockFromClip (this=0x2380190, rCxt=..., nCol1=5, nRow1=267, nCol2=5, nRow2=267, rMark=..., nDx=0, nDy=29)
    at /home/caolan/LibreOffice/core/sc/source/core/data/document.cxx:2736
#8  0x00007fff958181f3 in ScDocument::CopyFromClip
    (this=0x2380190, rDestRange=..., rMark=..., nInsFlag=18815, pRefUndoDoc=0x6ffe940, pClipDoc=0x61d8ef0, bResetCut=true, bAsLink=false, bIncludeFiltered=true, bSkipEmptyCells=false, pDestRanges=0x7fffffff4118) at /home/caolan/LibreOffice/core/sc/source/core/data/document.cxx:2980
#9  0x00007fff96ff0aa1 in ScViewFunc::PasteFromClip
    (this=0x551df38, nFlags=InsertDeleteFlags::ALL, pClipDoc=0x61d8ef0, nFunction=ScPasteFunc::NONE, bSkipEmptyCells=false, bTranspose=false, bAsLink=false, eMoveMode=INS_NONE, nUndoExtraFlags=InsertDeleteFlags::NONE, bAllowDialogs=true) at sc/source/ui/view/viewfun3.cxx:1329
#10 0x00007fff96d56034 in ScClipUtil::PasteFromClipboard (rViewData=..., pTabViewShell=0x551dc10, bShowDialog=true) at sc/source/ui/view/cliputil.cxx:110

and in ScColumn::UpdateReference there is aBounds of {-18, 10, 11} so it seems to be that -18 which is causing the problem.