Bug 166837 - Calc crashed after calculating descriptive statistics and then closing
Summary: Calc crashed after calculating descriptive statistics and then closing
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
25.2.3.2 release
Hardware: All Linux (All)
: medium normal
Assignee: Michael Weghorn
URL:
Whiteboard: target:25.8.0 target:25.2.5 target:25...
Keywords:
Depends on:
Blocks:
 
Reported: 2025-06-03 06:17 UTC by Matt Fagnani
Modified: 2025-06-05 09:29 UTC (History)
2 users (show)

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Matt Fagnani 2025-06-03 06:17:09 UTC
I opened a speadsheet of ods format I had previously created in Libreoffice Calc 25.2.3.2 in Plasma 6.3.5 on Wayland in a Fedora 42 KDE Plasma installation. I clicked on the header of a column with numeric data to select it. I clicked on the Data menu in the menu bar, then on Statistics and Descriptive Statistics. I selected a cell to the right of the data for the Results to field, then I clicked OK. I saved the file. I closed Calc. A crash notification was shown from abrt. Calc crashed with the following trace which might indicate it happened when an object related to the clipboard was being destroyed.

(gdb) bt
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0)
    at pthread_kill.c:44
#1  0x00007f543265a1e3 in __pthread_kill_internal (threadid=<optimized out>, signo=6) at pthread_kill.c:89
#2  0x00007f5432600afe in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#3  0x00007f54325e86d0 in __GI_abort () at abort.c:73
#4  0x00007f54322091b6 in __gnu_cxx::__verbose_terminate_handler ()
    at ../../../../libstdc++-v3/libsupc++/vterminate.cc:95
#5  0x00007f543221e95c in __cxxabiv1::__terminate (handler=<optimized out>)
    at ../../../../libstdc++-v3/libsupc++/eh_terminate.cc:48
#6  0x00007f5432208c2d in __cxa_call_terminate (ue_header_in=0x555801b6c1c0)
    at ../../../../libstdc++-v3/libsupc++/eh_call.cc:56
#7  0x00007f543221e1d1 in __cxxabiv1::__gxx_personality_v0
    (version=<optimized out>, actions=6, exception_class=5138137972254386944, ue_header=0x555801b6c1c0, context=0x7ffef76069a0) at ../../../../libstdc++-v3/libsupc++/eh_personality.cc:692
#8  0x00007f54324bd3cb in _Unwind_RaiseException_Phase2
    (exc=exc@entry=0x555801b6c1c0, context=context@entry=0x7ffef76069a0, frames_p=frames_p@entry=0x7ffef76068a8)
    at ../../../libgcc/unwind.inc:64
#9  0x00007f54324bdeca in _Unwind_Resume (exc=exc@entry=0x555801b6c1c0) at ../../../libgcc/unwind.inc:242
#10 0x00007f542ea3df46 in cppu::WeakImplHelper<com::sun::star::datatransfer::XTransferable2, com::sun::star::datatransfer::clipboard::XClipboardOwner, com::sun::star::datatransfer::dnd::XDragSourceListener>::~WeakImplHelper
    (this=<optimized out>, this=<optimized out>)
    at /usr/src/debug/libreoffice-25.2.3.2-1.fc42.x86_64/include/cppuhelper/implbase.hxx:102
#11 TransferableHelper::~TransferableHelper (this=0x5558048bece0, this=<optimized out>)
    at /usr/src/debug/libreoffice-25.2.3.2-1.fc42.x86_64/vcl/source/treelist/transfer.cxx:316
#12 0x00007f53c35171c5 in ScSelectionTransferObj::~ScSelectionTransferObj (this=0x5558048bece0, this=<optimized out>)
    at /usr/src/debug/libreoffice-25.2.3.2-1.fc42.x86_64/sc/source/ui/app/seltrans.cxx:163
#13 0x00007f541b34196d in non-virtual thunk to QtClipboard::~QtClipboard() ()
--Type <RET> for more, q to quit, c to continue without paging--c
    at /usr/src/debug/libreoffice-25.2.3.2-1.fc42.x86_64/vcl/inc/qt6/../qt5/QtClipboard.hxx:30
#14 0x00007f541b36f476 in com::sun::star::uno::Reference<com::sun::star::uno::XInterface>::~Reference
    (this=0x5558048d6ce0, this=<optimized out>)
    at /usr/src/debug/libreoffice-25.2.3.2-1.fc42.x86_64/include/com/sun/star/uno/Reference.hxx:114
#15 std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::uno::XInterface> >::~pair
    (this=0x5558048d6cd8, this=<optimized out>) at /usr/include/c++/15/bits/stl_pair.h:302
#16 std::destroy_at<std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::uno::XInterface> > >
    (__location=0x5558048d6cd8) at /usr/include/c++/15/bits/stl_construct.h:88
#17 std::allocator_traits<std::allocator<std::__detail::_Hash_node<std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::uno::XInterface> >, true> > >::destroy<std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::uno::XInterface> > > (__a=<optimized out>, __p=0x5558048d6cd8)
    at /usr/include/c++/15/bits/alloc_traits.h:698
#18 std::__detail::_Hashtable_alloc<std::allocator<std::__detail::_Hash_node<std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::uno::XInterface> >, true> > >::_M_deallocate_node
    (this=<optimized out>, __n=0x5558048d6cd0) at /usr/include/c++/15/bits/hashtable_policy.h:1572
#19 std::__detail::_Hashtable_alloc<std::allocator<std::__detail::_Hash_node<std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::uno::XInterface> >, true> > >::_M_deallocate_nodes
    (this=0x5557ff7f25c0, __n=0x5558011d89f0) at /usr/include/c++/15/bits/hashtable_policy.h:1594
#20 std::_Hashtable<rtl::OUString, std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::uno::XInterface> >, std::allocator<std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::uno::XInterface> > >, std::__detail::_Select1st, std::equal_to<rtl::OUString>, std::hash<rtl::OUString>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<true, false, true> >::~_Hashtable (this=0x5557ff7f25c0, this=<optimized out>) at /usr/include/c++/15/bits/hashtable.h:1852
#21 0x00007f541b3741e6 in std::unordered_map<rtl::OUString, com::sun::star::uno::Reference<com::sun::star::uno::XInterface>, std::hash<rtl::OUString>, std::equal_to<rtl::OUString>, std::allocator<std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::uno::XInterface> > > >::~unordered_map (this=0x5557ff7f25c0, this=<optimized out>)
    at /usr/include/c++/15/bits/unordered_map.h:112
#22 QtInstance::~QtInstance (this=0x5557ff7f24e0, this=<optimized out>)
    at /usr/src/debug/libreoffice-25.2.3.2-1.fc42.x86_64/vcl/qt6/../qt5/QtInstance.cxx:312
#23 0x00007f54327eb047 in non-virtual thunk to KFSalInstance::~KFSalInstance() ()
    at /usr/src/debug/libreoffice-25.2.3.2-1.fc42.x86_64/vcl/unx/kf6/../kf5/KFSalInstance.hxx:24
#24 0x00007f542eec5c3a in DestroySalInstance (pInst=0x5557ff7f24f0)
    at /usr/src/debug/libreoffice-25.2.3.2-1.fc42.x86_64/vcl/source/app/salplug.cxx:361
#25 DeInitVCL () at /usr/src/debug/libreoffice-25.2.3.2-1.fc42.x86_64/vcl/source/app/svmain.cxx:627
#26 0x00007f542eec6a21 in ImplSVMain ()
    at /usr/src/debug/libreoffice-25.2.3.2-1.fc42.x86_64/vcl/source/app/svmain.cxx:239
#27 0x00007f542eec6c19 in SVMain () at /usr/src/debug/libreoffice-25.2.3.2-1.fc42.x86_64/vcl/source/app/svmain.cxx:246
#28 0x00007f5432853bec in soffice_main ()
    at /usr/src/debug/libreoffice-25.2.3.2-1.fc42.x86_64/desktop/source/app/sofficemain.cxx:121
#29 0x00005557faa00406 in sal_main () at /usr/src/debug/libreoffice-25.2.3.2-1.fc42.x86_64/desktop/source/app/main.c:51
#30 main (argc=<optimized out>, argv=<optimized out>)
    at /usr/src/debug/libreoffice-25.2.3.2-1.fc42.x86_64/desktop/source/app/main.c:49

I saw this type of crash again after calculating descriptive statistics for another column/variable with numeric data, saving, then closing. I reproduced the problem with a new blank spreadsheet file by clicking on the column A header, calculating descriptive statistics, saving, then closing. This problem didn't happen unless I followed the steps above. The system is using Qt 6.9.0 and KF 6.14.0.

Version: 25.2.3.2 (X86_64)
Build ID: 520(Build:2)
CPU threads: 4; OS: Linux 6.14; UI render: default; VCL: kf6 (cairo+wayland)
Locale: en-CA (en_CA.UTF-8); UI: en-US
Calc: threaded
Comment 1 Xisco Faulí 2025-06-03 08:09:29 UTC
Thank you for reporting the bug. Please attach a sample document, as this makes it easier for us to verify the bug. 
I have set the bug's status to 'NEEDINFO'. Please change it back to 'UNCONFIRMED' once the requested document is provided.
(Please note that the attachment will be public, remove any sensitive information before attaching it. 
See https://wiki.documentfoundation.org/QA/FAQ#How_can_I_eliminate_confidential_data_from_a_sample_document.3F for help on how to do so.)
Comment 2 Matt Fagnani 2025-06-03 08:39:33 UTC
(In reply to Xisco Faulí from comment #1)
> Thank you for reporting the bug. Please attach a sample document, as this
> makes it easier for us to verify the bug. 
> I have set the bug's status to 'NEEDINFO'. Please change it back to
> 'UNCONFIRMED' once the requested document is provided.
> (Please note that the attachment will be public, remove any sensitive
> information before attaching it. 
> See
> https://wiki.documentfoundation.org/QA/
> FAQ#How_can_I_eliminate_confidential_data_from_a_sample_document.3F for help
> on how to do so.)

This problem can be reproduced with a new blank spreadsheet file as I mentioned, so I'm guessing that me attaching an empty spreadsheet file wouldn't be necessary. I found that saving the file isn't needed for the crash to happen. 

When I reproduced the crash by running Calc in Konsole, there was the following error message before Calc aborted.
terminate called after throwing an instance of 'com::sun::star::uno::DeploymentException'
Aborted (core dumped)

Thanks.
Comment 3 Xisco Faulí 2025-06-03 10:11:40 UTC
I can't reproduce it in

Version: 25.8.0.0.alpha1+ (X86_64) / LibreOffice Community
Build ID: 04744bbc9be4adca92eaba602b7a65c17f6b8dd7
CPU threads: 8; OS: Linux 6.1; UI render: default; VCL: gtk3
Locale: es-ES (es_ES.UTF-8); UI: en-US
Calc: threaded
Comment 4 Xisco Faulí 2025-06-03 10:12:17 UTC
@Michael, is it something you can  reproduce on your end ?
Comment 5 Michael Weghorn 2025-06-03 14:03:13 UTC
(In reply to Xisco Faulí from comment #4)
> @Michael, is it something you can  reproduce on your end ?

Yes, and as far as I can tell, pending https://gerrit.libreoffice.org/c/core/+/186149 fixes it.
Comment 6 Xisco Faulí 2025-06-03 14:39:01 UTC
(In reply to Michael Weghorn from comment #5)
> (In reply to Xisco Faulí from comment #4)
> > @Michael, is it something you can  reproduce on your end ?
> 
> Yes, and as far as I can tell, pending
> https://gerrit.libreoffice.org/c/core/+/186149 fixes it.

is it something related to qt or I'm following the wrong steps ?

1. Open Calc
2. Insert some numbers in some cells in Column A
3. Select column A
4. Data Statistics - Descriptive Statistics
5. B1 in Results to
6. Save
7. Close LibreOffice
Comment 7 Michael Weghorn 2025-06-03 14:44:28 UTC
(In reply to Xisco Faulí from comment #6)
> is it something related to qt or I'm following the wrong steps ?
> 
> 1. Open Calc
> 2. Insert some numbers in some cells in Column A
> 3. Select column A
> 4. Data Statistics - Descriptive Statistics
> 5. B1 in Results to
> 6. Save
> 7. Close LibreOffice

That are the same steps I'm taking, 2) and 6) can even be left out.

I see this with qt6, but not gtk3 or gen, though the fix is elsewhere (apparently code only triggered by qt6, but not others for some reason).
Comment 8 Commit Notification 2025-06-04 05:35:59 UTC
Michael Weghorn committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/d37fdb9ef2662e8dae5df864d93fe0ef9152f9b0

tdf#166837 vcl: Avoid some const_cast

It will be available in 25.8.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 9 Commit Notification 2025-06-04 05:36:02 UTC
Michael Weghorn committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/14c2c76474b93551195fab3b75d5ba42535c7f11

tdf#166837 vcl: Drop TransferableDataHelper_Impl

It will be available in 25.8.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 10 Commit Notification 2025-06-04 05:36:04 UTC
Michael Weghorn committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/919f4a1430a6f1daba756b7f9f7615c3c9f603ae

tdf#166837 vcl: Unset terminate listener once it's been notified

It will be available in 25.8.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 11 Michael Weghorn 2025-06-04 05:36:42 UTC
Fixed in master now, backport for 25-2 pending in Gerrit:
https://gerrit.libreoffice.org/c/core/+/186157
Comment 12 Commit Notification 2025-06-04 08:12:28 UTC
Michael Weghorn committed a patch related to this issue.
It has been pushed to "libreoffice-25-2":

https://git.libreoffice.org/core/commit/08162b794a7402e029a495e713e6ec60f17040a3

tdf#166837 vcl: Unset terminate listener once it's been notified

It will be available in 25.2.5.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 13 Commit Notification 2025-06-05 09:29:08 UTC
Michael Weghorn committed a patch related to this issue.
It has been pushed to "libreoffice-25-2-4":

https://git.libreoffice.org/core/commit/68327b9eba00fb8a7ded551cd94bb6dee9d78daa

tdf#166837 vcl: Unset terminate listener once it's been notified

It will be available in 25.2.4.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.