Bug 161891 - Cell with formula, Cut+Paste, crash throwing an instance of 'std::out_of_range', block position not found (STR comment 9)
Summary: Cell with formula, Cut+Paste, crash throwing an instance of 'std::out_of_rang...
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
5.3.0.3 release
Hardware: All All
: medium critical
Assignee: Not Assigned
URL:
Whiteboard:
Keywords: bibisected, bisected, regression
Depends on:
Blocks: Paste Cell-Formula Crash
  Show dependency treegraph
 
Reported: 2024-07-03 23:18 UTC by Pat Finnegan
Modified: 2026-07-12 03:13 UTC (History)
4 users (show)

See Also:
Crash report or crash signature: ["ntdll.dll","libc.so.6","std::out_of_range::out_of_range(std::basic_string<char,std::char_traits<char>,std::allocator<char> > const &)"]


Attachments
Calc file as Requested (40.27 KB, application/vnd.oasis.opendocument.spreadsheet)
2024-07-04 11:45 UTC, Pat Finnegan
Details
updated calc file for debugging (41.06 KB, application/vnd.oasis.opendocument.spreadsheet)
2024-07-08 20:45 UTC, Pat Finnegan
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Pat Finnegan 2024-07-03 23:18:09 UTC
Description:
I use the sum function in Calc a LOT with no problem for many years now. Since yesterday (2nd July) a very simple sum caused multiple crashes. Today I installed the latest LibreOffice update, restarted the entire computer and the Sum function in Calc is STILL causing a crash. Existing sums are also showing up false. Here are the crash reports as sent:

https://crashreport.libreoffice.org/stats/crash_details/d7a2824e-a111-4285-be19-29afbcb828e2


https://crashreport.libreoffice.org/stats/crash_details/8f980070-1fbf-4ec6-83ad-d7219d6a5d02


https://crashreport.libreoffice.org/stats/crash_details/16a37987-bd97-4e83-bd47-1438e3e886ce


Steps to Reproduce:
1.Create a column of numbers
2.Sum new numbers, then cut 
3.Try to add cut sum to another already existing column of numbers in same sheet

Actual Results:
Calc crashes and recovered version has defective existing sums in existing columns

Expected Results:
The new sum should be able to add safely into a blank cell in an existing column of numbers which is already summed and the new total should display accurately


Reproducible: Always


User Profile Reset: No

Additional Info:
I have used Sum, Cut, Add, in Calc for very many years on a multiple times per day basis. I have never known it fail before
Comment 1 m_a_riosv 2024-07-04 01:12:33 UTC Comment hidden (obsolete)
Comment 2 Xisco Faulí 2024-07-04 08:17:55 UTC Comment hidden (obsolete)
Comment 3 Pat Finnegan 2024-07-04 11:28:04 UTC Comment hidden (obsolete)
Comment 4 Pat Finnegan 2024-07-04 11:45:53 UTC Comment hidden (obsolete)
Comment 5 m_a_riosv 2024-07-04 12:10:11 UTC Comment hidden (obsolete)
Comment 6 Julien Nabet 2024-07-06 19:12:57 UTC Comment hidden (obsolete)
Comment 7 ady 2024-07-08 04:19:53 UTC Comment hidden (obsolete)
Comment 8 Pat Finnegan 2024-07-08 20:45:59 UTC Comment hidden (obsolete)
Comment 9 ady 2024-07-08 22:42:59 UTC
I am changing the Summary field according to the relevant test and behavior, from:

"Sum function in Calc not working and causing crashes"

...to:

"Cell with formula, Cut+Paste, crash"


STR:
1. Open attachment 195175 [details].
2. Click on cell F239.
3. [CTRL]+[X] to cut cell F239.
4. Click on cell F268.
5. [CTRL]+[V] to paste the clipboard.


Actual results:
Calc Crash. Calc suggests the possibility to attempt recovery of the file. After recovery, AutoCalculate is OFF for the recovered file (but it was ON before the crash).

Same crash when starting LO in Safe Mode.

OpenCL: OFF.


* First; Not reproduced with:

** LibreOffice 3.3.0 
OOO330m19 (Build:6)
tag libreoffice-3.3.0.4

** AOO4115m2(Build:9813)  -  Rev. 5f13fa0070

   -> Regression.

* Reproduced, but showing error message before Calc closes itself, without a recovery attempt, and with a different fatal error (IIUC, but please double check):

** Version: 7.0.4.2 (x86)
Build ID: dcf040e67528d9187c66b2379df5ea4407429775
CPU threads: 4; OS: Windows 10.0 Build 19045; UI render: Skia/Raster; VCL: win
Locale: en-US (es_AR); UI: en-US
Calc: CL


* Crash reproduced with:

** Version: 24.8.0.0.beta1+ (X86_64) / LibreOffice Community
Build ID: 12b0d0dd2e22a1abc955a11bfe4ae87631409622
CPU threads: 4; OS: Windows 10 X86_64 (10.0 build 19045); UI render: Skia/Raster; VCL: win
Locale: en-US (es_AR); UI: en-US
Calc: threaded

** Version: 24.8.0.0.beta1+ (X86_64) / LibreOffice Community
Build ID: 12b0d0dd2e22a1abc955a11bfe4ae87631409622
CPU threads: 4; OS: Windows 10 X86_64 (10.0 build 19045); UI render: default; VCL: win
Locale: en-US (es_AR); UI: en-US
Calc: threaded

Version: 7.1.2.2 (x86) / LibreOffice Community
Build ID: 8a45595d069ef5570103caea1b71cc9d82b2aae4
CPU threads: 4; OS: Windows 10.0 Build 19045; UI render: default; VCL: win
Locale: en-US (es_AR); UI: en-US
Calc: threaded


Setting Version field to 7.1, since older version behaves differently.
Comment 10 ady 2024-07-08 23:02:32 UTC Comment hidden (obsolete)
Comment 11 m_a_riosv 2024-07-08 23:54:42 UTC
It happens cutting from the range F36:F240 and pasting on the range F262:F268
Comment 12 stragu 2024-07-09 02:07:18 UTC
Thanks for clarifying.

No crash in 5.2.0.4.

In 5.3.0.3 and 5.4.0.2, crash with Fatal Error message:

multi_type_vector::position#1491: block position not found! (logical pos=18446744073709551598, block size=17, logical size=1048576)

Later, direct crash with no error message:
- signature "libc.so.6" in
   - 6.0: https://crashreport.libreoffice.org/stats/crash_details/629f5ee3-a082-4728-a03c-3fcc78d5b7e2
   - 7.0: https://crashreport.libreoffice.org/stats/crash_details/20c2c69c-9ca2-4139-a67a-7ed51053aefb
   - 7.1: https://crashreport.libreoffice.org/stats/crash_details/5e409624-e601-43de-93d4-9d28d842fa4a
   - 7.2: https://crashreport.libreoffice.org/stats/crash_details/8d5b030e-53e4-46fa-9127-fd442bab4fc9
   - 7.6: https://crashreport.libreoffice.org/stats/crash_details/8692e92e-f75b-4127-8833-a700a3ba34eb
   - 24.2.4.2: https://crashreport.libreoffice.org/stats/crash_details/0fea636d-59e7-4ba4-96c5-aa9398831cba

But as the terminal shows for 24.8 beta1, the issue hasn't changed:

terminate called after throwing an instance of 'std::out_of_range'
  what():  multi_type_vector::position#490: block position not found! (logical pos=18446744073709551598, block size=17, logical size=1048576)

Bibisected with linux-64-5.3 repo to first bad build [4467a22f4544cd2d5c637dd909f828ed3e99edb6] which is:

commit dfa92e106f7eaa8c3fc6cda034001197ecc53a8f
author	Eike Rathke 	Wed Oct 19 23:04:34 2016 +0200
committer	Eike Rathke 	Wed Oct 19 23:05:44 2016 +0200
Resolves: tdf#97968 adjust references during Cut&Paste of formula groups
Comment 13 Caolán McNamara 2024-07-11 15:13:57 UTC
seems a bit odd that a 2024-07-03 bug report about something reported to recently starting to fail then bisects to a 2016 commit

but fwiw catch throw std::out_of_range

gives:

#0  0x00007ffff74b5201 in __cxa_throw () at /lib64/libstdc++.so.6
#1  0x00007fff9549bf6a in mdds::mtv::detail::throw_block_position_not_found
    (method_sig=0x7fff972a9c41 "multi_type_vector::position", line=490, pos=18446744073709551598, block_size=17, container_size=1048576)
    at workdir/UnpackedTarball/mdds/include/mdds/multi_type_vector/soa/../util.hpp:153
#2  0x00007fff95595049 in mdds::mtv::soa::multi_type_vector<sc::CellStoreTraits>::position (this=0x1b9f460, pos=18446744073709551598)
    at workdir/UnpackedTarball/mdds/include/mdds/multi_type_vector/soa/main_def.inl:489
#3  0x00007fff961d9a80 in sc::SharedFormulaUtil::splitFormulaCellGroups (rDoc=..., rCells=..., rBounds=std::__debug::vector of length 3, capacity 4 = {...})
    at /home/caolan/LibreOffice/core/sc/source/core/tool/sharedformula.cxx:129
#4  0x00007fff9557f113 in ScColumn::UpdateReference (this=0x1b9f230, rCxt=..., pUndoDoc=0x6ffe940) at /home/caolan/LibreOffice/core/sc/source/core/data/column.cxx:2392
#5  0x00007fff95c07e03 in ScTable::UpdateReference (this=0x23b88e0, rCxt=..., pUndoDoc=0x6ffe940, bIncludeDraw=false, bUpdateNoteCaptionPos=true)
    at /home/caolan/LibreOffice/core/sc/source/core/data/table1.cxx:1875
#6  0x00007fff9578c10a in ScDocument::UpdateReference (this=0x2380190, rCxt=..., pUndoDoc=0x6ffe940, bIncludeDraw=false, bUpdateNoteCaptionPos=true)
    at /home/caolan/LibreOffice/core/sc/source/core/data/documen3.cxx:1074
#7  0x00007fff95816e2f in ScDocument::CopyBlockFromClip (this=0x2380190, rCxt=..., nCol1=5, nRow1=267, nCol2=5, nRow2=267, rMark=..., nDx=0, nDy=29)
    at /home/caolan/LibreOffice/core/sc/source/core/data/document.cxx:2736
#8  0x00007fff958181f3 in ScDocument::CopyFromClip
    (this=0x2380190, rDestRange=..., rMark=..., nInsFlag=18815, pRefUndoDoc=0x6ffe940, pClipDoc=0x61d8ef0, bResetCut=true, bAsLink=false, bIncludeFiltered=true, bSkipEmptyCells=false, pDestRanges=0x7fffffff4118) at /home/caolan/LibreOffice/core/sc/source/core/data/document.cxx:2980
#9  0x00007fff96ff0aa1 in ScViewFunc::PasteFromClip
    (this=0x551df38, nFlags=InsertDeleteFlags::ALL, pClipDoc=0x61d8ef0, nFunction=ScPasteFunc::NONE, bSkipEmptyCells=false, bTranspose=false, bAsLink=false, eMoveMode=INS_NONE, nUndoExtraFlags=InsertDeleteFlags::NONE, bAllowDialogs=true) at sc/source/ui/view/viewfun3.cxx:1329
#10 0x00007fff96d56034 in ScClipUtil::PasteFromClipboard (rViewData=..., pTabViewShell=0x551dc10, bShowDialog=true) at sc/source/ui/view/cliputil.cxx:110

and in ScColumn::UpdateReference there is aBounds of {-18, 10, 11} so it seems to be that -18 which is causing the problem.
Comment 14 QA Administrators 2026-07-12 03:13:57 UTC
Dear Pat Finnegan,

To make sure we're focusing on the bugs that affect our users today, LibreOffice QA is asking bug reporters and confirmers to retest open, confirmed bugs which have not been touched for over a year.

There have been thousands of bug fixes and commits since anyone checked on this bug report. During that time, it's possible that the bug has been fixed, or the details of the problem have changed. We'd really appreciate your help in getting confirmation that the bug is still present.

If you have time, please do the following:

Test to see if the bug is still present with the latest version of LibreOffice from https://www.libreoffice.org/download/

If the bug is present, please leave a comment that includes the information from Help - About LibreOffice.
 
If the bug is NOT present, please set the bug's Status field to RESOLVED-WORKSFORME and leave a comment that includes the information from Help - About LibreOffice.

Please DO NOT

Update the version field
Reply via email (please reply directly on the bug tracker)
Set the bug's Status field to RESOLVED - FIXED (this status has a particular meaning that is not 
appropriate in this case)


If you want to do more to help you can test to see if your issue is a REGRESSION. To do so:
1. Download and install oldest version of LibreOffice (usually 3.3 unless your bug pertains to a feature added after 3.3) from https://downloadarchive.documentfoundation.org/libreoffice/old/

2. Test your bug
3. Leave a comment with your results.
4a. If the bug was present with 3.3 - set version to 'inherited from OOo';
4b. If the bug was not present in 3.3 - add 'regression' to keyword


Feel free to come ask questions or to say hello in our QA chat: https://web.libera.chat/?settings=#libreoffice-qa

Thank you for helping us make LibreOffice even better for everyone!

Warm Regards,
QA Team

MassPing-UntouchedBug