Download it now!
Bug 90606 - Crash when delete a large part of a column with shift cells left
Summary: Crash when delete a large part of a column with shift cells left
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
4.4.2.2 release
Hardware: x86-64 (AMD64) All
: high major
Assignee: Arul Michael
URL:
Whiteboard: target:5.2.0 target:5.1.0.2 target:5...
Keywords: bibisected, bisected, haveBacktrace, regression
: 97363 (view as bug list)
Depends on:
Blocks:
 
Reported: 2015-04-14 09:13 UTC by Rpnpif
Modified: 2016-09-01 13:14 UTC (History)
9 users (show)

See Also:
Crash report or crash signature:


Attachments
bt (2.65 KB, text/plain)
2015-04-14 21:00 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Rpnpif 2015-04-14 09:13:10 UTC
When I want to delete a large part of a column of a spreadsheet with shift cells left, LO crashes with this message in a dialogue box :

multi_type_vector::get_block_position#676: block position not found! (logical pos=1048576, block size=4, logical size=1048576).

This bug is always reproducible for all spreadsheets.

To reproduce :

1. Open a blank or not spreadsheet.
2. Select B4:B1048576 zone.
3. Click-right and select shift cells left.
3. A dialogue box appears with 
multi_type_vector::get_block_position#676: block position not found! (logical pos=1048576, block size=4, logical size=1048576).
4. Click on OK and LO crashes.

It is impossible to delete this large part of the column only little parts can be deleted.
Comment 1 Rpnpif 2015-04-14 09:16:07 UTC
Sorry for the bad writing. I want to say :

To reproduce :

1. Open a blank or not spreadsheet.
2. Select B4:B1048576 zone.
3. Click-right and select delete shift cells left.
4. A dialogue box appears with 
multi_type_vector::get_block_position#676: block position not found! (logical pos=1048576, block size=4, logical size=1048576).
5. Click on OK and LO crashes.
Comment 2 raal 2015-04-14 15:52:23 UTC
I can confirm with LO 4.4.2, win7.
Comment 3 Julien Nabet 2015-04-14 21:00:18 UTC
Created attachment 114794 [details]
bt

On pc Debian x86-64 with master sources updated today, I could reproduce this.

I could retrieve a bt thanks to "catch throw" from gdb.
Comment 4 Julien Nabet 2015-04-14 21:50:02 UTC
gdb session:
Breakpoint 1, mdds::multi_type_vector<mdds::mtv::custom_block_func3<mdds::mtv::default_element_block<52, svl::SharedString>, mdds::mtv::noncopyable_managed_element_block<53, EditTextObject>, mdds::mtv::noncopyable_managed_element_block<54, ScFormulaCell> > >::get_block_position (this=0x2b22530, pos_hint=..., pos=1048576, 
    start_row=@0x7fffffff2bc8: 0, block_index=@0x7fffffff2bd0: 0)
    at /home/julien/compile-libreoffice/libreoffice/workdir/UnpackedTarball/mdds/include/mdds/multi_type_vector_def.inl:675
675	    if (!get_block_position(pos, start_row, block_index))
(gdb) s
mdds::multi_type_vector<mdds::mtv::custom_block_func3<mdds::mtv::default_element_block<52, svl::SharedString>, mdds::mtv::noncopyable_managed_element_block<53, EditTextObject>, mdds::mtv::noncopyable_managed_element_block<54, ScFormulaCell> > >::get_block_position (this=0x2b22530, row=1048576, start_row=@0x7fffffff2bc8: 0, 
    block_index=@0x7fffffff2bd0: 0) at /home/julien/compile-libreoffice/libreoffice/workdir/UnpackedTarball/mdds/include/mdds/multi_type_vector_def.inl:634
634	    for (size_type i = block_index, n = m_blocks.size(); i < n; ++i)
(gdb) p m_blocks
$5 = std::__debug::vector of length 1, capacity 1 = {0x2b21a30}
(gdb) p m_blocks.size()
$6 = 1
(gdb) n
636	        const block& blk = *m_blocks[i];
(gdb) n
637	        if (row < start_row + blk.m_size)
(gdb) p blk
$7 = (const 
    mdds::multi_type_vector<mdds::mtv::custom_block_func3<mdds::mtv::default_element_block<52, svl::SharedString>, mdds::mtv::noncopyable_managed_element_block<53, EditTextObject>, mdds::mtv::noncopyable_managed_element_block<54, ScFormulaCell> > >::block &) @0x2b21a30: {m_size = 1048576, mp_data = 0x0}
(gdb) p blk.m_size
$8 = 1048576
Comment 5 Julien Nabet 2015-04-15 05:48:13 UTC
I reduce the importance since it only happens at limits.
Indeed, I don't reproduce this if I try with B4:B1048575

Kohei/Eike/Markus: thought you might be interested in this one (mdds related, see previous comment + bt with debug symbols even in mdds).
Comment 6 Rpnpif 2015-04-15 10:39:34 UTC
(In reply to Julien Nabet from comment #5)
> I reduce the importance since it only happens at limits.
> Indeed, I don't reproduce this if I try with B4:B1048575

In fact, only to delete cells in row # 1048576 triggers the crash.
Yes it is a limit issue.
Comment 7 Matthew Francis 2015-04-23 14:02:27 UTC
This began at the below commit.

commit 7a6d9eb7198a4a0c808db87a5496e07d46d89413
Author: Kohei Yoshida <kohei.yoshida@gmail.com>
Date:   Thu Jul 4 02:17:03 2013 -0400

    More on regrouping of formula cells.
    
    Change-Id: Icd3403e759841dce351c932ea8915ba9819e5a29
Comment 8 Rpnpif 2015-09-04 16:52:22 UTC
This bug is still in LO 5.0.1.1.
Insert action has the same effect than delete.
Comment 9 Konstantin Khomoutov 2015-11-13 13:33:10 UTC
We were able to easily and repeatably reproduce this bug in an empty sheet of an empty document in LO 5.0.2 (both on Debian GNU/Linux 64-bit and Windows 7 64-bit).

Here's how:

1) Open a new Calc spreadsheet.
2) In the default sheet select the whole first column by clicking on its header ("A").
3) Deselect the first cell of this column by Ctrl-left-clicking on it.
4) Open the context menu on the range of the cells remaining selected.
5) Execute the "Delete..." entry in the context menu.
6) In the "Delete cells" dialog, which appears, select "Shift cells left".
7) Click "OK" in that dialog to receive the error:

> multi_type_vector::get_block_position#676: block position not found! (logical
> pos=1048576, block size=2, logical size=1048576)

What's interesting, is that the numbers of those "parameters" inside the parentheses are the same no matter if the sheet contains any data or not.
Comment 10 Robinson Tryon (qubit) 2015-12-13 11:12:19 UTC Comment hidden (obsolete)
Comment 11 Rpnpif 2015-12-27 11:40:24 UTC
This bug is still in LO 5.1.0.1.
Build ID: bcace328aabc4c8c10b56daa87da0a2ee6579b5a
Comment 12 Arul Michael 2016-01-11 12:23:50 UTC
I am starting to work on this bug.
Thanks
Arul
Comment 13 Julien Nabet 2016-01-11 13:05:53 UTC
Thank you Arul for taking a looking at it! :-) Let's put this to ASSIGNED status then.
Comment 14 Arul Michael 2016-01-12 10:19:23 UTC
Patch has been submitted for fixing this issue
https://gerrit.libreoffice.org/#/c/21389/
Comment 15 Commit Notification 2016-01-12 11:11:46 UTC
Arul committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=975ceab198a06558875006bbd9a4d0a2708e416e

tdf#90606 Crash when delete a large part of a column with shift cells left

It will be available in 5.2.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 16 Commit Notification 2016-01-12 11:24:58 UTC
Arul committed a patch related to this issue.
It has been pushed to "libreoffice-5-1":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=e9e641b39a98df8c6aef8d2f12f4a589ed887612&h=libreoffice-5-1

tdf#90606 Crash when delete a large part of a column with shift cells left

It will be available in 5.1.0.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 17 Commit Notification 2016-01-12 11:39:54 UTC
Arul committed a patch related to this issue.
It has been pushed to "libreoffice-5-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=293e7bef122fc5f5f4b9cc7719e22489913e8726&h=libreoffice-5-0

tdf#90606 Crash when delete a large part of a column with shift cells left

It will be available in 5.0.5.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 18 Eike Rathke 2016-09-01 13:14:08 UTC
*** Bug 97363 has been marked as a duplicate of this bug. ***