Created attachment 66127 [details] Sample file for testing crash on Command-D on Mac Problem description: Ever since update to 3.6.0 (and tested also on 3.6.1.2), Command-D on several selected cells with formula crashes on Mac OS X 10.8. Did not crash on 3.5.x. Steps to reproduce: 1. Please download and open attached sample file and open on a Mac. 2. Select C5:C7 3. Press Cmd-D 4. Works 5. Select C5:C8 6. Press Cmd-D Current behavior: Crash Expected behavior: Should not crash Platform (if different from the browser): Browser: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_1) AppleWebKit/536.25 (KHTML, like Gecko) Version/6.0 Safari/536.25
Created attachment 66128 [details] Crash log I get from the crash on Cmd-D
Confirming. My own crash log attached too. Alex
Created attachment 66132 [details] Apple Crash trace with Calc sheet and Cmd-D
Program received signal EXC_BAD_ACCESS, Could not access memory. Reason: KERN_PROTECTION_FAILURE at address: 0x00000112 0x00ae5db6 in SvtListenerIter::GoStart () (gdb) bt #0 0x00ae5db6 in SvtListenerIter::GoStart () #1 0x00ae5317 in SvtBroadcaster::Broadcast () #2 0x2173ab70 in ScDocument::Broadcast () #3 0x216ff5d8 in ScColumn::DeleteRange () #4 0x21700265 in ScColumn::DeleteArea () #5 0x21819719 in ScTable::DeleteArea () #6 0x21827c5a in ScTable::FillSeries () #7 0x2182a242 in ScTable::Fill () #8 0x2172a758 in ScDocument::Fill () #9 0x21ada412 in ScDocFunc::FillSimple () #10 0x21e487d4 in ScViewFunc::FillSimple () #11 0x21d76ad5 in ScCellShell::ExecuteEdit () #12 0x00805acd in SfxDispatcher::Call_Impl () #13 0x00807f54 in SfxDispatcher::PostMsgHandler () #14 0x007a5ba9 in SfxHintPoster::LinkStubDoEvent_Impl () #15 0x01b10b9f in ImplWindowFrameProc () #16 0x01b23723 in AquaSalInstance::Yield () #17 0x01810b80 in Application::Yield () #18 0x01810c6c in Application::Execute () #19 0x0007abbc in desktop::Desktop::Main () #20 0x0181a222 in ImplSVMain () #21 0x01b22e4b in AquaSalInstance::handleAppDefinedEvent () #22 0x01b6346b in -[VCL_NSApplication sendEvent:] () #23 0x93d9f73c in -[NSApplication run] () #24 0x93d428e6 in NSApplicationMain () #25 0x01b24407 in ImplSVMainHook () #26 0x0181a2b1 in SVMain () #27 0x000a7f86 in soffice_main () #28 0x00001f0e in main () #29 0x00001872 in _start () #30 0x00001799 in start () (gdb) c Continuing. Program received signal EXC_BAD_ACCESS, Could not access memory. Reason: KERN_PROTECTION_FAILURE at address: 0x00000112 0x00ae5db6 in SvtListenerIter::GoStart () (gdb) bt thread all apply No symbol "thread" in current context. (gdb) bt all No symbol "all" in current context. (gdb) bt #0 0x00ae5db6 in SvtListenerIter::GoStart () #1 0x00ae5317 in SvtBroadcaster::Broadcast () #2 0x2173ab70 in ScDocument::Broadcast () #3 0x216ff5d8 in ScColumn::DeleteRange () #4 0x21700265 in ScColumn::DeleteArea () #5 0x21819719 in ScTable::DeleteArea () #6 0x21827c5a in ScTable::FillSeries () #7 0x2182a242 in ScTable::Fill () #8 0x2172a758 in ScDocument::Fill () #9 0x21ada412 in ScDocFunc::FillSimple () #10 0x21e487d4 in ScViewFunc::FillSimple () #11 0x21d76ad5 in ScCellShell::ExecuteEdit () #12 0x00805acd in SfxDispatcher::Call_Impl () #13 0x00807f54 in SfxDispatcher::PostMsgHandler () #14 0x007a5ba9 in SfxHintPoster::LinkStubDoEvent_Impl () #15 0x01b10b9f in ImplWindowFrameProc () #16 0x01b23723 in AquaSalInstance::Yield () #17 0x01810b80 in Application::Yield () #18 0x01810c6c in Application::Execute () #19 0x0007abbc in desktop::Desktop::Main () #20 0x0181a222 in ImplSVMain () #21 0x01b22e4b in AquaSalInstance::handleAppDefinedEvent () #22 0x01b6346b in -[VCL_NSApplication sendEvent:] () #23 0x93d9f73c in -[NSApplication run] () #24 0x93d428e6 in NSApplicationMain () #25 0x01b24407 in ImplSVMainHook () #26 0x0181a2b1 in SVMain () #27 0x000a7f86 in soffice_main () #28 0x00001f0e in main () #29 0x00001872 in _start () #30 0x00001799 in start () (gdb) c Continuing.
@Kohei : any idea ? Alex
Note that when running under gdb, the app wouldn't crash, but entered the same Iter loop repeatedly until I quit gdb. Alex
*** Bug 54075 has been marked as a duplicate of this bug. ***
(In reply to comment #7) > *** Bug 54075 has been marked as a duplicate of this bug. *** Please note that in my other bug report, Cmd-D worked (basically steps 1-4 from this bug) with no crash. Then pressing Cmd-Z causes the crash. No idea if it's related. Just wanted to mention that in case it's a different situation.
Looks like another case of the boradcaster lifetime problem. I'm going to look into this one for 3.6.2
OK, assigning to you Markus. Alex
Ok, I think I fixed it. Problem was the double delete of Broadcasters in formula cells which have listeners. They were part of the temporary ScNoteCell and of the ScFormulaCell and therefore deleted twice.
Markus Mohrhard committed a patch related to this issue. It has been pushed to "master": http://cgit.freedesktop.org/libreoffice/core/commit/?id=7a8040665f40fbcb4fa58c036aa066f061abd9ba prevent double delete of broadcaster, fdo#54074, fdo#53364
Markus Mohrhard committed a patch related to this issue. It has been pushed to "libreoffice-3-6": http://cgit.freedesktop.org/libreoffice/core/commit/?id=cedaa445535e9337294a46cb75c4850294e4f715&g=libreoffice-3-6 prevent double delete of broadcaster, fdo#54074, fdo#53364 It will be available in LibreOffice 3.6.2.
*** Bug 54223 has been marked as a duplicate of this bug. ***