Created attachment 114871 [details] Calc document with problem data When dealing with multiple cells containing formulas (such as highlighting a row and moving it, or deleting cell contents), a crash occurs. Attached is a file that should be able to reproduce the issue. For example, highlight the last row of data and drag it to the gap in the middle. This occurred on OS X 10.8.5. Crash produced on 4.4.2. 4.4.3.1 rc produced the crash too. 4.3.6 release does not crash. Following stack traces are for various operations with the thread crashing converging at one area. ======== Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000007 Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 libsvllo.dylib 0x000000010df5c4ea std::__1::vector<SvtListener*, std::__1::allocator<SvtListener*> >::vector(std::__1::vector<SvtListener*, std::__1::allocator<SvtListener*> > const&) + 122 1 libsvllo.dylib 0x000000010df5c21b SvtBroadcaster::Broadcast(SfxHint const&) + 43 2 libsclo.dylib 0x000000011d940e6f ScBroadcastAreaSlotMachine::BulkBroadcastGroupAreas() + 127 3 libsclo.dylib 0x000000011dadab47 ScTable::DeleteSelection(InsertDeleteFlags, ScMarkData const&, bool) + 151 4 libsclo.dylib 0x000000011da17ddb ScDocument::DeleteSelection(InsertDeleteFlags, ScMarkData const&, bool) + 155 5 libsclo.dylib 0x000000011ddc80cf ScDocFunc::DeleteContents(ScMarkData const&, InsertDeleteFlags, bool, bool) + 831 6 libsclo.dylib 0x000000011e11adfd ScViewFunc::DeleteContents(InsertDeleteFlags, bool) + 461 7 libsclo.dylib 0x000000011e03495a ScCellShell::ExecuteEdit(SfxRequest&) + 28234 8 libsfxlo.dylib 0x000000010d987b5f SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, bool) + 895 9 libsfxlo.dylib 0x000000010d983350 SfxBindings::Execute_Impl(SfxRequest&, SfxSlot const*, SfxShell*) + 896 10 libsfxlo.dylib 0x000000010d9bb863 SfxDispatchController_Impl::dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XDispatchResultListener> const&) + 6259 11 libsfxlo.dylib 0x000000010d9b9f07 SfxOfficeDispatch::dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) + 279 12 libsvtlo.dylib 0x000000010e18e704 svt::AsyncAccelExec::impl_ts_asyncCallback(void*) + 116 13 libsvtlo.dylib 0x000000010e18e679 svt::AsyncAccelExec::LinkStubimpl_ts_asyncCallback(void*, void*) + 9 14 libvcllo.dylib 0x000000010ef1249a vcl::EventPoster::LinkStubDoEvent_Impl(void*, void*) + 26 15 libvcllo.dylib 0x000000010ed1afa6 ImplWindowFrameProc(vcl::Window*, SalFrame*, unsigned short, void const*) + 1558 16 libvcllo.dylib 0x000000010ef990d8 AquaSalInstance::Yield(bool, bool) + 424 17 libvcllo.dylib 0x000000010ef2633e Application::Yield() + 94 18 libvcllo.dylib 0x000000010ef262c5 Application::Execute() + 37 19 libsofficeapp.dylib 0x000000010cf7a55d desktop::Desktop::Main() + 7741 20 libvcllo.dylib 0x000000010ef29d74 ImplSVMain() + 52 21 libvcllo.dylib 0x000000010ef98d34 AquaSalInstance::handleAppDefinedEvent(NSEvent*) + 84 22 libvcllo.dylib 0x000000010efcf190 -[VCL_NSApplication sendEvent:] + 320 23 com.apple.AppKit 0x00007fff8e31b21a -[NSApplication run] + 636 24 com.apple.AppKit 0x00007fff8e2bfbd6 NSApplicationMain + 869 25 libvcllo.dylib 0x000000010ef98079 ImplSVMainHook(int*) + 329 26 libvcllo.dylib 0x000000010ef2a92a SVMain() + 26 27 libsofficeapp.dylib 0x000000010cfa57ba soffice_main + 218 28 org.libreoffice.script 0x000000010cef7f20 main + 16 29 libdyld.dylib 0x00007fff8ffed7e1 start + 1 ======== Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x00007f9c52800000 Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 libsvllo.dylib 0x00000001088264ea std::__1::vector<SvtListener*, std::__1::allocator<SvtListener*> >::vector(std::__1::vector<SvtListener*, std::__1::allocator<SvtListener*> > const&) + 122 1 libsvllo.dylib 0x000000010882621b SvtBroadcaster::Broadcast(SfxHint const&) + 43 2 libsclo.dylib 0x0000000118228e6f ScBroadcastAreaSlotMachine::BulkBroadcastGroupAreas() + 127 3 libsclo.dylib 0x00000001183c2861 ScTable::DeleteArea(short, int, short, int, InsertDeleteFlags, bool, sc::ColumnSpanSet*) + 273 4 libsclo.dylib 0x00000001182f4163 ScDocument::DeleteAreaTab(short, int, short, int, short, InsertDeleteFlags) + 195 5 libsclo.dylib 0x00000001186b88c2 ScDocFunc::MoveBlock(ScRange const&, ScAddress const&, bool, bool, bool, bool) + 2546 6 libsclo.dylib 0x00000001189f214a ScViewFunc::MoveBlockTo(ScRange const&, ScAddress const&, bool, bool, bool, bool) + 666 7 libsclo.dylib 0x0000000118954b4d ScGridWindow::DropTransferObj(ScTransferObj*, short, int, Point const&, signed char) + 4237 8 libsclo.dylib 0x0000000118954f6e ScGridWindow::ExecuteDrop(ExecuteDropEvent const&) + 158 9 libsvtlo.dylib 0x0000000108a8abad DropTargetHelper::DropTargetListener::drop(com::sun::star::datatransfer::dnd::DropTargetDropEvent const&) + 477 10 libvcllo.dylib 0x000000010956ff87 DNDListenerContainer::fireDropEvent(com::sun::star::uno::Reference<com::sun::star::datatransfer::dnd::XDropTargetDropContext> const&, signed char, int, int, signed char, com::sun::star::uno::Reference<com::sun::star::datatransfer::XTransferable> const&) + 567 11 libvcllo.dylib 0x000000010956e212 DNDEventDispatcher::fireDropEvent(vcl::Window*, com::sun::star::uno::Reference<com::sun::star::datatransfer::dnd::XDropTargetDropContext> const&, signed char, Point const&, signed char, com::sun::star::uno::Reference<com::sun::star::datatransfer::XTransferable> const&) + 290 12 libvcllo.dylib 0x000000010956dce5 DNDEventDispatcher::drop(com::sun::star::datatransfer::dnd::DropTargetDropEvent const&) + 213 13 libvcllo.dylib 0x00000001098781eb DropTarget::fire_drop(com::sun::star::datatransfer::dnd::DropTargetDropEvent const&) + 155 14 libvcllo.dylib 0x0000000109877461 DropTarget::performDragOperation(objc_object*) + 449 15 com.apple.AppKit 0x00007fff8e67594f NSCoreDragReceiveMessageProc + 1651 16 com.apple.HIServices 0x00007fff93a9446a DoMultipartDropMessage + 301 17 com.apple.HIServices 0x00007fff93a94135 DoDropMessage + 49 18 com.apple.HIServices 0x00007fff93a940d7 SendDropMessage + 41 19 com.apple.HIServices 0x00007fff93a977c8 DragInApplication + 654 20 com.apple.HIServices 0x00007fff93a96c69 CoreDragStartDragging + 519 21 com.apple.AppKit 0x00007fff8e676120 -[NSCoreDragManager _dragUntilMouseUp:accepted:] + 881 22 com.apple.AppKit 0x00007fff8e67744a -[NSCoreDragManager dragImage:fromWindow:at:offset:event:pasteboard:source:slideBack:] + 1455 23 com.apple.AppKit 0x00007fff8e926fd0 -[NSWindow(NSDrag) dragImage:at:offset:event:pasteboard:source:slideBack:] + 133 24 libvcllo.dylib 0x0000000109875821 DragSource::startDrag(com::sun::star::datatransfer::dnd::DragGestureEvent const&, signed char, int, int, com::sun::star::uno::Reference<com::sun::star::datatransfer::XTransferable> const&, com::sun::star::uno::Reference<com::sun::star::datatransfer::dnd::XDragSourceListener> const&) + 753 25 libsvtlo.dylib 0x0000000108a83e5a TransferableHelper::StartDrag(vcl::Window*, signed char, int, int) + 282 26 libsclo.dylib 0x00000001189a336d ScViewFunctionSet::BeginDrag() + 765 27 libvcllo.dylib 0x00000001095ae428 SelectionEngine::Command(CommandEvent const&) + 152 28 libsclo.dylib 0x0000000118950ca0 ScGridWindow::StartDrag(signed char, Point const&) + 368 29 libsvtlo.dylib 0x0000000108a8a5d5 DragSourceHelper::DragGestureListener::dragGestureRecognized(com::sun::star::datatransfer::dnd::DragGestureEvent const&) + 85 30 libvcllo.dylib 0x00000001095717c1 DNDListenerContainer::fireDragGestureEvent(signed char, int, int, com::sun::star::uno::Reference<com::sun::star::datatransfer::dnd::XDragSource> const&, com::sun::star::uno::Any const&) + 465 31 libvcllo.dylib 0x00000001095ecdbb ImplHandleMouseEvent(vcl::Window*, unsigned short, bool, long, long, unsigned long, unsigned short, MouseEventModifiers) + 2091 32 libvcllo.dylib 0x00000001095ef4f8 ImplWindowFrameProc(vcl::Window*, SalFrame*, unsigned short, void const*) + 2920 33 libvcllo.dylib 0x00000001098ad800 -[SalFrameView sendMouseEventToFrame:button:eventtype:] + 1344 34 com.apple.AppKit 0x00007fff8e409b81 -[NSWindow sendEvent:] + 8504 35 com.apple.AppKit 0x00007fff8e405644 -[NSApplication sendEvent:] + 5761 36 libvcllo.dylib 0x00000001098a31b3 -[VCL_NSApplication sendEvent:] + 355 37 libvcllo.dylib 0x000000010986d3ae AquaSalInstance::Yield(bool, bool) + 1150 38 libvcllo.dylib 0x00000001097fa33e Application::Yield() + 94 39 libvcllo.dylib 0x00000001097fa2c5 Application::Execute() + 37 40 libsofficeapp.dylib 0x000000010784755d desktop::Desktop::Main() + 7741 41 libvcllo.dylib 0x00000001097fdd74 ImplSVMain() + 52 42 libvcllo.dylib 0x000000010986cd34 AquaSalInstance::handleAppDefinedEvent(NSEvent*) + 84 43 libvcllo.dylib 0x00000001098a3190 -[VCL_NSApplication sendEvent:] + 320 44 com.apple.AppKit 0x00007fff8e31b21a -[NSApplication run] + 636 45 com.apple.AppKit 0x00007fff8e2bfbd6 NSApplicationMain + 869 46 libvcllo.dylib 0x000000010986c079 ImplSVMainHook(int*) + 329 47 libvcllo.dylib 0x00000001097fe92a SVMain() + 26 48 libsofficeapp.dylib 0x00000001078727ba soffice_main + 218 49 org.libreoffice.script 0x00000001077c1f20 main + 16 50 libdyld.dylib 0x00007fff8ffed7e1 start + 1 ======== Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000000 Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 libsvllo.dylib 0x0000000106fe8274 SvtBroadcaster::Broadcast(SfxHint const&) + 132 1 libsclo.dylib 0x00000001169d2e6f ScBroadcastAreaSlotMachine::BulkBroadcastGroupAreas() + 127 2 libsclo.dylib 0x0000000116b6c861 ScTable::DeleteArea(short, int, short, int, InsertDeleteFlags, bool, sc::ColumnSpanSet*) + 273 3 libsclo.dylib 0x0000000116a9e163 ScDocument::DeleteAreaTab(short, int, short, int, short, InsertDeleteFlags) + 195 4 libsclo.dylib 0x0000000116a9dd17 ScDocument::DeleteAreaTab(ScRange const&, InsertDeleteFlags) + 87 5 libsclo.dylib 0x0000000116f4c553 ScUndoAutoFill::Undo() + 243 6 libsvllo.dylib 0x000000010702dd79 SfxUndoManager::ImplUndo(SfxUndoContext*) + 297 7 libsvxcorelo.dylib 0x0000000113bc62c8 SdrUndoManager::Undo() + 104 8 libsclo.dylib 0x0000000117177ac4 ScTabViewShell::ExecuteUndo(SfxRequest&) + 244 9 libsfxlo.dylib 0x0000000106a0fb5f SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, bool) + 895 10 libsfxlo.dylib 0x0000000106a0b350 SfxBindings::Execute_Impl(SfxRequest&, SfxSlot const*, SfxShell*) + 896 11 libsfxlo.dylib 0x0000000106a43863 SfxDispatchController_Impl::dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XDispatchResultListener> const&) + 6259 12 libsfxlo.dylib 0x0000000106a41f07 SfxOfficeDispatch::dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) + 279 13 libfwklo.dylib 0x0000000112f87fd4 framework::MenuBarManager::Select(Menu*) + 1684 14 libfwklo.dylib 0x0000000112f87939 framework::MenuBarManager::LinkStubSelect(void*, void*) + 9 15 libvcllo.dylib 0x0000000107d4be0d Menu::Select() + 125 16 libvcllo.dylib 0x0000000107d4bd85 Menu::LinkStubImplCallSelect(void*, void*) + 21 17 libvcllo.dylib 0x0000000107daffa6 ImplWindowFrameProc(vcl::Window*, SalFrame*, unsigned short, void const*) + 1558 18 libvcllo.dylib 0x000000010802e0d8 AquaSalInstance::Yield(bool, bool) + 424 19 libvcllo.dylib 0x0000000107fbb33e Application::Yield() + 94 20 libvcllo.dylib 0x0000000107fbb2c5 Application::Execute() + 37 21 libsofficeapp.dylib 0x000000010600b55d desktop::Desktop::Main() + 7741 22 libvcllo.dylib 0x0000000107fbed74 ImplSVMain() + 52 23 libvcllo.dylib 0x000000010802dd34 AquaSalInstance::handleAppDefinedEvent(NSEvent*) + 84 24 libvcllo.dylib 0x0000000108064190 -[VCL_NSApplication sendEvent:] + 320 25 com.apple.AppKit 0x00007fff8e31b21a -[NSApplication run] + 636 26 com.apple.AppKit 0x00007fff8e2bfbd6 NSApplicationMain + 869 27 libvcllo.dylib 0x000000010802d079 ImplSVMainHook(int*) + 329 28 libvcllo.dylib 0x0000000107fbf92a SVMain() + 26 29 libsofficeapp.dylib 0x00000001060367ba soffice_main + 218 30 org.libreoffice.script 0x0000000105f8cf20 main + 16 31 libdyld.dylib ======== Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x00007fef92700000 Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 libsvllo.dylib 0x00000001096364ea std::__1::vector<SvtListener*, std::__1::allocator<SvtListener*> >::vector(std::__1::vector<SvtListener*, std::__1::allocator<SvtListener*> > const&) + 122 1 libsvllo.dylib 0x000000010963621b SvtBroadcaster::Broadcast(SfxHint const&) + 43 2 libsclo.dylib 0x000000011b9ffe6f ScBroadcastAreaSlotMachine::BulkBroadcastGroupAreas() + 127 3 libsclo.dylib 0x000000011bb99b47 ScTable::DeleteSelection(InsertDeleteFlags, ScMarkData const&, bool) + 151 4 libsclo.dylib 0x000000011bad6ddb ScDocument::DeleteSelection(InsertDeleteFlags, ScMarkData const&, bool) + 155 5 libsclo.dylib 0x000000011c1c2ee6 ScViewFunc::CutToClip(ScDocument*, bool) + 502 6 libsclo.dylib 0x000000011c0ecd88 ScCellShell::ExecuteEdit(SfxRequest&) + 632 7 libsfxlo.dylib 0x000000010905eb5f SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, bool) + 895 8 libsfxlo.dylib 0x000000010905a350 SfxBindings::Execute_Impl(SfxRequest&, SfxSlot const*, SfxShell*) + 896 9 libsfxlo.dylib 0x0000000109092863 SfxDispatchController_Impl::dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XDispatchResultListener> const&) + 6259 10 libsfxlo.dylib 0x0000000109090f07 SfxOfficeDispatch::dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) + 279 11 libfwklo.dylib 0x0000000114c80fd4 framework::MenuBarManager::Select(Menu*) + 1684 12 libfwklo.dylib 0x0000000114c80939 framework::MenuBarManager::LinkStubSelect(void*, void*) + 9 13 libvcllo.dylib 0x000000010a388e0d Menu::Select() + 125 14 libvcllo.dylib 0x000000010a388d85 Menu::LinkStubImplCallSelect(void*, void*) + 21 15 libvcllo.dylib 0x000000010a3ecfa6 ImplWindowFrameProc(vcl::Window*, SalFrame*, unsigned short, void const*) + 1558 16 libvcllo.dylib 0x000000010a66b0d8 AquaSalInstance::Yield(bool, bool) + 424 17 libvcllo.dylib 0x000000010a5f833e Application::Yield() + 94 18 libvcllo.dylib 0x000000010a5f82c5 Application::Execute() + 37 19 libsofficeapp.dylib 0x000000010865855d desktop::Desktop::Main() + 7741 20 libvcllo.dylib 0x000000010a5fbd74 ImplSVMain() + 52 21 libvcllo.dylib 0x000000010a66ad34 AquaSalInstance::handleAppDefinedEvent(NSEvent*) + 84 22 libvcllo.dylib 0x000000010a6a1190 -[VCL_NSApplication sendEvent:] + 320 23 com.apple.AppKit 0x00007fff8e31b21a -[NSApplication run] + 636 24 com.apple.AppKit 0x00007fff8e2bfbd6 NSApplicationMain + 869 25 libvcllo.dylib 0x000000010a66a079 ImplSVMainHook(int*) + 329 26 libvcllo.dylib 0x000000010a5fc92a SVMain() + 26 27 libsofficeapp.dylib 0x00000001086837ba soffice_main + 218 28 org.libreoffice.script 0x00000001085cef20 main + 16 29 libdyld.dylib 0x00007fff8ffed7e1 start + 1
I can not confirm with LO Version: 4.5.0.0.alpha0+ Build ID: 51e0d789c344547956764c3b5f0ef5a304f4e0aa TinderBox: Linux-rpm_deb-x86_64@46-TDF, Branch:master, Time: 2015-04-13_16:58:45 select row 10 move to row 7 no crash
And I can't reproduce with: Win7x64 Version: 4.4.3.1 Build ID: b2f347f2ac68821efc00b6f1793cda90af748118 To be certain the reported issue is not related to corruption in the user profile, could you rename this LibreOffice user directory ( see https://wiki.documentfoundation.org/UserProfile#Default_location or http://ask.libreoffice.org/en/question/903/where-are-the-libreoffice-data-profile-files/ ) and re-test?
@raal: Tried master~2015-04-18_02.14.21_LibreOfficeDev_5.0.0.0.alpha0_MacOS_x86-64. Crash still occurs on OS X 10.8.5. @m.a.riosv: Removing the user directory and having LO create a fresh directory did not resolve the issue. Crash still occurs on OS X 10.8.5. In case there was something wrong with the local system, a virtualbox instance of OS X 10.9.5 was created (i.e. clean install), LO 4.4.2 installed, and the test file opened. The example action noted beforehand of highlighting the last row and dragging it to the gap still causes a crash.
Created attachment 114896 [details] bt with debug symbols On pc Debian x86-64 with master sources updated today, I could reproduce this.
Can someone provide clear reproducible steps (enumerated are best) on how to cause the crash? Also - is this a regression? Can someone report findings about that as well. Thanks all - trying to nail down these crashers and push them closer to resolutions
Apologies if the original report did not comply with the requirements for a bug report. The information requested was provided originally, but they are repeated below in the form desired. To reproduce the crash: 1. Download the provided test spreadsheet. 2. Open said spreadsheet. 3. Highlight the last row of data. 4. Drag (or cut and paste) the selection to the empty row in the middle. The crash does not happen in 4.3.6, so it appears to be a regression.
Is this the same issue as these reproduction steps?: 1. Open a new Calc document. 2. Write in A1 "5". 3. Write in A2 "10". 4. Write in A3 "20". 5. Write in B2 "=SUM(A$1:A2)". 6. Write in B3 "=SUM(A$1:A3)". 7. Select A3 and B3 and cut it.
I couldn't reproduce in LO 4.4.3.2 Windows from Comment 6 and Comment 7, I only get Bug 91214 - Calc: Crash on exit.
Reproduced on master, Linux dbgutil; not a duplicate of bug 90694.
*** This bug has been marked as a duplicate of bug 99733 ***