Bug 89226 - The operation Undo after Chinese convertion crashes the Calc
Summary: The operation Undo after Chinese convertion crashes the Calc
Status: RESOLVED DUPLICATE of bug 91995
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
(earliest affected) rc
Hardware: Other All
: medium normal
Assignee: Mike Kaganski
Keywords: bibisected, bisected, regression
: 90741 (view as bug list)
Depends on:
Reported: 2015-02-08 12:51 UTC by Eudien
Modified: 2016-07-04 16:12 UTC (History)
6 users (show)

See Also:
Crash report or crash signature:

OSX/LO backtrace (82.32 KB, text/plain)
2015-03-31 04:25 UTC, Matthew Francis
Sample ODS (7.06 KB, application/vnd.oasis.opendocument.spreadsheet)
2015-03-31 04:38 UTC, Matthew Francis

Note You need to log in before you can comment on or make changes to this bug.
Description Eudien 2015-02-08 12:51:20 UTC
Steps to reproduce:
1 Start Calc
2 Input some Simplified Chinese in a cell
3 Select the characters
4 Click Tools->Language->Chinese Convertion->Simplified Chinese to traditional Chinese, and click OK
5 Click Edit->Undo or Undo on the toolbar
6 Calc crashes

ps: Undo won't crashes the Calc when doing the tranditional Chinese convert to tranditional Chinese, or simplified Chinese convert to simplefied Chinese.
Comment 1 Buovjaga 2015-02-08 13:48:33 UTC
Reproduced with 4.4.
4.5 doesn't crash on undo, but the cell becomes empty.

Win 7 Pro 64-bit, LibO Version:
Build ID: de093506bcdc5fafd9023ee680b8c60e3e0645d7
Locale: fi_FI

Build ID: 99c00b090533da9818444be2831b8da0e713e5f9
TinderBox: Win-x86@62-TDF, Branch:MASTER, Time: 2015-02-04_06:38:53
Locale: fi_FI
Comment 2 Matthew Francis 2015-03-31 04:25:18 UTC
Created attachment 114481 [details]
OSX/LO backtrace
Comment 3 Matthew Francis 2015-03-31 04:38:11 UTC
Created attachment 114482 [details]
Sample ODS
Comment 4 Matthew Francis 2015-03-31 04:39:27 UTC
Still occurs for me with current 4.5 master

Results from bibisect 43all:

bac2489ff3b644bd046102e379bff5a6c6c469d9 is the first bad commit
commit bac2489ff3b644bd046102e379bff5a6c6c469d9
Author: Bjoern Michaelsen <bjoern.michaelsen@canonical.com>
Date:   Fri Oct 18 02:48:35 2013 +0000

    commit 621c1e491e56db5416da1c763aaff862e8ede67a
    Author:     Michael Meeks <michael.meeks@suse.com>
    AuthorDate: Tue Aug 20 12:45:34 2013 +0100
    Commit:     Fridrich Strba <fridrich@documentfoundation.org>
    CommitDate: Fri Aug 23 09:04:13 2013 +0000
Comment 5 Matthew Francis 2015-04-01 11:51:47 UTC
This appears to have changed at the below commit.
Adding Cc: to michael.meeks@collabora.com; Could you possibly take a look at this? Thanks

(Unsure what the connection is other than that they both concern undo)

commit e851ea0ed30e9bb95c273a29aeab7f48f606145f
Author: Michael Meeks <michael.meeks@suse.com>
Date:   Thu Aug 22 17:45:18 2013 +0100

    fdo#39484 - don't loose outlines while trying to undo formulae changes.
    Change-Id: Ib3b2bab5beffb8164a8cd2c0b4db4c97f427507e
Comment 6 Mike Kaganski 2015-06-08 08:51:10 UTC
Here are some details:

1. The problems introduced ~20 aug 2013 totally prevented the Chinese convertion from working. They have been fixed between and (dec 2013-jan 2014)
2. Meanwhile, another problem was introduced with commit 575e88da278f536ebfb6562dfd98f341240afec4 (author Kohei Yoshida <kohei.yoshida@collabora.com> 2014-02-18 02:57:01 (GMT)): fdo#75032: Handle note copying correctly.

That commit fails to check the pointer argument p in
void CopyCellNotesHandler::operator() ( size_t nRow, const ScPostIt* p )
The null pointer is passed there if the cell doesn't contain a note.
That is the cause of this bug.

But fixing that uncovers another problem here.
If some cells that undergo the conversion do contain notes with them, then undoing the conversion works (given the zero-checking is enabled), but redoing crashes LO. That's because of a memory corruption in first undo in
static void noncopyable_managed_element_block::overwrite_values(base_element_block& block, size_t pos, size_t len)
called from
multi_type_vector<_CellBlockFunc>::set_impl(size_type pos, size_type start_row, size_type block_index, const _T& value)

This method overwrites a copy of ScPostIt, that later is used in redo.

So, working on a better fix
Comment 7 Mike Kaganski 2015-06-09 10:24:48 UTC
Posted patch to gerrit: https://gerrit.libreoffice.org/16181
Comment 8 Michael Meeks 2015-06-13 14:58:20 UTC
*** Bug 90741 has been marked as a duplicate of this bug. ***
Comment 9 Matthew Millar 2015-06-17 18:43:18 UTC

Why have you marked Bug 90741 as a duplicate.

How are the two related?
Comment 10 Buovjaga 2015-06-17 18:48:16 UTC
(In reply to Matthew Millar from comment #9)
> Michael,
> Why have you marked Bug 90741 as a duplicate.
> How are the two related?

See this message: http://lists.freedesktop.org/archives/libreoffice/2015-June/068742.html
Comment 11 Robinson Tryon (qubit) 2015-12-13 11:12:20 UTC
Migrating Whiteboard tags to Keywords: (bibisected)
Comment 12 Kevin Suo 2016-04-07 08:40:00 UTC
Still reproduciable with
Version: (x64)
Build ID: d3bf12ecb743fc0d20e0be0c58ca359301eb705f
CPU Threads: 2; OS Version: Windows 6.19; UI Render: default; 
Locale: zh-CN (zh_CN)
Win10 x64.
Comment 13 Caolán McNamara 2016-07-04 16:12:49 UTC

*** This bug has been marked as a duplicate of bug 91995 ***