Download it now!
Bug 48405 - Calc crashes during execution of macro in XLS spreadsheet
Summary: Calc crashes during execution of macro in XLS spreadsheet
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
3.5.2 release
Hardware: Other All
: lowest major
Assignee: Caolán McNamara
URL:
Whiteboard: BSA target:4.4.0
Keywords:
Depends on:
Blocks:
 
Reported: 2012-04-06 15:29 UTC by Moritz Mühlenhoff
Modified: 2014-10-08 12:39 UTC (History)
3 users (show)

See Also:
Crash report or crash signature:


Attachments
backtrace of where things go wrong (27.65 KB, text/plain)
2014-10-08 11:41 UTC, Caolán McNamara
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Moritz Mühlenhoff 2012-04-06 15:29:02 UTC
This was reported to the Debian bug tracking system. I can still reproduce it with LO 3.5.2:

Detailed steps on how to reproduce it and the affected XLS are are provided in the Debian bug report:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=640543
Comment 1 Joel Madero 2012-11-13 00:45:21 UTC
I have confirmed this as well. I have no clue if this will be addressed as it's so specific to a particular macro enabled page that I personally have no clue what it's intended purpose is. 

Markig as NEW and prioritzing:

Major: I'm hesitant to mark this as Major but since it causes a crash, I'm going by my normal flowchart and marking it as so.

Lowest: So specific that it's unlikely another user would have face this furthermore there is a workaround to just go slow.

If someone could do a bt that would be nice, I may be able to do one tomorrow.
Comment 2 Caolán McNamara 2014-10-08 11:41:32 UTC
Created attachment 107551 [details]
backtrace of where things go wrong
Comment 3 Caolán McNamara 2014-10-08 11:43:51 UTC
at the bottom of the stack we have m_aDataArray.clear() but *mile* up the stack in frame 110 we have...

m_aDataArray.push_back(Item());
Item& rItem = m_aDataArray.back();
rItem.maString = m_pDocument->GetString(aAdr);

so during the GetString the m_aDataArray is cleared, so rItem is no longer valid and we cannot assign to it anymore legally
Comment 4 Caolán McNamara 2014-10-08 12:39:50 UTC
With the straightforward approach of http://cgit.freedesktop.org/libreoffice/core/commit/?id=deed6dcacd355ce84cada955887a31e7d8cb5fb1
it no longer crashes.