Bug 78838 - EDITING SIGABRT: ... past-the-end iterator
Summary: EDITING SIGABRT: ... past-the-end iterator
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
4.3.0.0.alpha0+ Master
Hardware: x86-64 (AMD64) Linux (All)
: medium normal
Assignee: Julien Nabet
URL:
Whiteboard: target:4.3.0 target:4.2.5
Keywords: haveBacktrace
Depends on:
Blocks:
 
Reported: 2014-05-17 21:09 UTC by Terrence Enger
Modified: 2014-05-29 22:02 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:


Attachments
.ods file to start with (15.46 KB, application/vnd.oasis.opendocument.spreadsheet)
2014-05-17 21:12 UTC, Terrence Enger
Details
typescript of execution (8.16 KB, text/plain)
2014-05-17 21:14 UTC, Terrence Enger
Details
gdb on the resulting core file (8.03 KB, text/plain)
2014-05-17 21:15 UTC, Terrence Enger
Details
bt with symbols (5.60 KB, text/plain)
2014-05-18 10:08 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Terrence Enger 2014-05-17 21:09:22 UTC
All quotation marks in the following are merely to delimit character
strings in this description.  Do not actually type the quotation
marks.

STR:

(*) Download the (soon-to-be) attached file a3.ods.  Program presents
    Calc window "a3.ods"; cell B4 is selected; cell B3 shows "abcd"
    sans serifs followed by "efgh" with serifs; the font selection
    control in the toolbar shows "Liberation Sans".

(*) Type "abcdefgh<Enter><up>".

(*) In the formula control, drag the mouse cursor through "efgh" and
    in the font selection control select "Courier 10 Pitch".

(*) Type "<Enter>".  Program terminates.


The interesting part of the terminal output is

    /usr/include/c++/4.7/debug/safe_iterator.h:537:error: attempt to compare a 
        singular iterator to a past-the-end iterator.

    Objects involved in the operation:
    iterator "lhs" @ 0x0x33bfc60 {
    type = N11__gnu_debug14_Safe_iteratorISt23_Rb_tree_const_iteratorI14ScTypedStrDataENSt7__debug3setIS2_NS2_17LessCaseSensitiveESaIS2_EEEEE (mutable iterator);
      state = singular;
      references sequence with type `NSt7__debug3setI14ScTypedStrDataNS1_17LessCaseSensitiveESaIS1_EEE' @ 0x0x33bfc60
    }
    iterator "rhs" @ 0x0x7fff76c335c0 {
    type = N11__gnu_debug14_Safe_iteratorISt23_Rb_tree_const_iteratorI14ScTypedStrDataENSt7__debug3setIS2_NS2_17LessCaseSensitiveESaIS2_EEEEE (mutable iterator);
      state = past-the-end;
      references sequence with type `NSt7__debug3setI14ScTypedStrDataNS1_17LessCaseSensitiveESaIS1_EEE' @ 0x0x7fff76c335c0
    }
    Application Error

    Fatal exception: Signal 6


This observation is on master commit 48eccfb, fetched 2014-05-15 00:50 UTC, configured
    --enable-option-checking=fatal
    --enable-dbgutil
    --enable-crashdump
    --without-system-postgresql
    --without-myspell-dicts
    --with-extra-buildid
    --without-doxygen
    --with-external-tar=/home/terry/lo_hacking/git/src
built and running on debian-wheezy 64-bit.
Comment 1 Terrence Enger 2014-05-17 21:12:34 UTC
Created attachment 99248 [details]
.ods file to start with

FWIW, I first created a file lke this while trying to verify the fix
to bug 77537 "FILESAVE: Font name is not preserved when exporting cell
with mixed formatting ODS".
Comment 2 Terrence Enger 2014-05-17 21:14:02 UTC
Created attachment 99249 [details]
typescript of execution
Comment 3 Terrence Enger 2014-05-17 21:15:47 UTC
Created attachment 99250 [details]
gdb on the resulting core file
Comment 4 Terrence Enger 2014-05-17 21:32:42 UTC
Setting status NEW in view of backtrace.

Master commit 49dff05, fetched 2014-05-12 14:59 UTC, crashes the same
way.  This is before commit 48eccfb, which is what brought me here in
the first place.

4.2.4.2 does not crash for these actions, but it being a product build
can well account for the difference.  Thus, I am *not* setting keyword
"regression".
Comment 5 Julien Nabet 2014-05-18 10:08:57 UTC
Created attachment 99267 [details]
bt with symbols

On pc Debian x86-64 with master sources updated today, I had another bt.
Comment 6 Julien Nabet 2014-05-18 15:15:25 UTC
"attempt to compare a singular iterator to a past-the-end iterator" has been seen too in fdo#47865
Caolan had fixed it with http://cgit.freedesktop.org/libreoffice/core/commit/?id=9cab649ccb3d827258e95a9b5c91d4b726564d89

So I thought that insert data in pColumnData might invalidate miAutoPosColumn

With this patch, I don't reproduce the crash.
diff --git a/sc/source/ui/app/inputhdl.cxx b/sc/source/ui/app/inputhdl.cxx
index 8b8d051..32ece93 100644
--- a/sc/source/ui/app/inputhdl.cxx
+++ b/sc/source/ui/app/inputhdl.cxx
@@ -1417,7 +1417,10 @@ void ScInputHandler::GetColData()
         pDoc->GetDataEntries(
             aCursorPos.Col(), aCursorPos.Row(), aCursorPos.Tab(), true, aEntries, true);
         if (!aEntries.empty())
+        {
             pColumnData->insert(aEntries.begin(), aEntries.end());
+            miAutoPosColumn = pColumnData->end();
+        }
     }
 }

Terrence: even if you had a different bt, could you give it a try?

Kohei/Markus/Eike: I thought it might interest you (crash with bt in sc part)
Comment 7 Terrence Enger 2014-05-19 23:45:54 UTC
Thank you for that patch, Julien.  I have applied it over commit
48eccfb (fetched 2014-05-15 00:54 UTC), and I observe:

(*) No crash.

(*) Cell B4 after the <Enter> in the last of the original STR (Whoops!
    I forgot to number the steps.  Careless.) correctly shows "abcd"
    in Liberation Sans and "efgh" in Courier 10 Pitch.

(*) After Save, Close, Open, B4 still shows the two fonts.  (This is
    what I was trying to see when I first encountered the crash.)


I shall let you change the bug status when you commit the patch.
Comment 8 Commit Notification 2014-05-20 05:36:06 UTC
Julien Nabet committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=1df54514d7a1ebb1b4fa16cca386a34e7c41c490

Resolves: fdo#78838 past-the-end iterator



The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 9 Julien Nabet 2014-05-20 05:39:12 UTC
Thank you Terrence for the test!

I pushed it on master sources.
Here's the gerrit for 4.2: https://gerrit.libreoffice.org/#/c/9409/
Comment 10 Eike Rathke 2014-05-20 09:12:55 UTC
Nice find, thanks Julien!
Comment 11 Commit Notification 2014-05-20 09:23:22 UTC
Julien Nabet committed a patch related to this issue.
It has been pushed to "libreoffice-4-2":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=bb8acc29e4ad4fb8245b2ed47e60c6cac641ddb1&h=libreoffice-4-2

Resolves: fdo#78838 past-the-end iterator


It will be available in LibreOffice 4.2.5.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 12 Commit Notification 2014-05-20 09:45:01 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=23e9f36a21f7daa6175f53fd244677b9c2e2a660

simplify and ensure valid miAutoPosColumn in all cases, fdo#78838 related



The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 13 Commit Notification 2014-05-20 10:09:16 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "libreoffice-4-2":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=51a868729b5adfa402095f5c08fa889bddcd1b34&h=libreoffice-4-2

simplify and ensure valid miAutoPosColumn in all cases, fdo#78838 related


It will be available in LibreOffice 4.2.5.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 14 Julien Nabet 2014-05-20 10:11:20 UTC
Thank you Eike for your review and additional changes!
So we can put it at FIXED now.
Comment 15 Commit Notification 2014-05-20 19:00:16 UTC
Julien Nabet committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=04831249713827fb175faa118205bb132387dad9

Following fdo#78838, let's make this part safe too



The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 16 Terrence Enger 2014-05-29 22:02:05 UTC
With master commit 0426306, fetched 2014-05-28 20:30 UTC, I have no
crash.

Thank you, Julien and Eike.