Bug 90391 - ScMatrix::AddOp crashes with mixed type matrix
Summary: ScMatrix::AddOp crashes with mixed type matrix
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
4.4.0.3 release
Hardware: Other All
: high blocker
Assignee: Markus Mohrhard
URL:
Whiteboard: target:4.5.0 target:4.4.3
Keywords:
Depends on:
Blocks:
 
Reported: 2015-04-01 12:24 UTC by Eike Rathke
Modified: 2015-04-02 22:18 UTC (History)
2 users (show)

See Also:
Crash report or crash signature:


Attachments
simple testcase to make NegOp crash (7.27 KB, application/x-vnd.oasis.opendocument.spreadsheet)
2015-04-01 12:24 UTC, Eike Rathke
Details
crash AddOp in 4.4.0 (14.72 KB, application/vnd.oasis.opendocument.spreadsheet)
2015-04-02 19:10 UTC, Eike Rathke
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Eike Rathke 2015-04-01 12:24:21 UTC
Created attachment 114521 [details]
simple testcase to make NegOp crash

Split off of bug 89387

Something is seriously wrong with the new MatOp handling, the attached document, calculating a mixed array of one number and one string using NegOp, makes the application immediately crash with a Fatal Error "Data array is too long". My assumption is it happens because the iterator of the result matrix is invalid because new segments are created when the error string result is to be inserted as element, but that's just a raw guess.
Comment 1 Eike Rathke 2015-04-01 22:30:33 UTC
I'm marking this as blocker. If it can't be fixed we'll have to revert the MatOp commits of bug 89387. The same crash happens also in other constellations, e.g. value in A1, empty A2, and in B1:B2 have {=A1:A2/1}

I played with MatOp to have only double returns and removing the SharedString specializations, but still it crashes, so the assumption about the mixed double/string result segments doesn't seem to hold.
Comment 2 Eike Rathke 2015-04-02 19:10:25 UTC
Created attachment 114567 [details]
crash AddOp in 4.4.0

Situation is even worse than I thought. Attached document crashes AddOp already in 4.4.0 with the same Fatal Error.
Comment 3 Commit Notification 2015-04-02 20:52:59 UTC
Markus Mohrhard committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=f9e38cbd3afdf0c8b2ebef0c4995e2443eac4d9a

we need a more intelligent increment for the iterator, tdf#90391

It will be available in 4.5.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 4 Commit Notification 2015-04-02 21:57:42 UTC
Markus Mohrhard committed a patch related to this issue.
It has been pushed to "libreoffice-4-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=dd5e8ff4314a87cf86d473e21902df48668d1dd3&h=libreoffice-4-4

we need a more intelligent increment for the iterator, tdf#90391

It will be available in 4.4.3.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.