Created attachment 114877 [details] File for reproduce bug Steps to reproduce : with the attached file : - Select two or more sheets - select a few rows (example : rows 37 to 67) - delete rows by right-clic => delete selected rows or edit => delete rows Result : Crash Version: 4.4.3.1 Build ID: b2f347f2ac68821efc00b6f1793cda90af748118 Locale: fr_FR Windows XP Pro SP3 and Vista 64 Tested by few users on French discuss list : http://nabble.documentfoundation.org/LibreOffice-4-4-3-RC1-est-disponible-pour-vos-tests-tt4146492.html reproductible with : Win7 - Version: 4.4.0.1 Build ID: 1ba9640ddd424f1f535c75bf2b86703770b8cf6f Locale: fr_FR - Version: 4.4.0.0.beta2 Build ID: be92f32b8f21603a6b7a75dd645f7475bdee519d Locale : fr_FR - Version: 4.4.2.2 Build ID: c4c7d32d0d49397cad38d62472b0bc8acff48dd6 Locale : fr_FR - Version: 4.4.3.1 Build ID: b2f347f2ac68821efc00b6f1793cda90af748118 Locale : fr_FR ...and with a "SEH Exception: ACCESS VIOLATION" - Version: 4.5.0.0.alpha0+ Build ID: 88bf8325f7ae49f949704021081a195d25985867 TinderBox: Win-x86@42, Branch:master, Time: 2015-04-12_00:58:11 Locale: fr_FR - Version: 5.0.0.0.alpha0+ Build ID: 35a4d80750553e7d51a6139b61c47a4f7a475ce8 TinderBox: Win-x86@42, Branch:master, Time: 2015-04-16_23:53:40 Locale: fr_FR Linux : fedora 21 KDE and Xfce Work fine with : - Version: 4.4.0.0.beta1 Build ID: 9af3d21234aa89dac653c0bd76648188cdeb683e Locale: fr_FR
Created attachment 114878 [details] trace file obtained with : Windows 7/64 & Version: 4.4.3.1 Build ID: b2f347f2ac68821efc00b6f1793cda90af748118 Locale : fr_FR
Change version according to tests: 4.4.0.0 beta2
Created attachment 114890 [details] console+bt with debug symbols On pc Debian x86-64 with master sources updated today, I could reproduce this. I attached bt Notice: warn:sc.core:13739:1:sc/source/core/tool/grouparealistener.cxx:213: FormulaGroupAreaListener::collectFormulaCells() nBlockSize 36 < 62 mnGroupLen
*** Bug 90717 has been marked as a duplicate of this bug. ***
Eike: noticing http://cgit.freedesktop.org/libreoffice/core/commit/?id=cff5ee864b2d87d74079697425d7895dbf1b2ba4 and http://cgit.freedesktop.org/libreoffice/core/commit/?id=47230a036fe35b9a7a7c0609232849fcbb51efcc, thought you might be interested in this one. tdf#90717 shows that the problem is even simpler to reproduce.
I tried to bibisect this and it never crashed - adding findings to whiteboard.
Hi Still reproduced on windows 7/64 & Version: 4.4.3.2 Build ID: 88805f81e9fe61362df02b9941de8e38a9b5fd16 Locale: fr_FR Regards Pierre-Yves
(In reply to Denis RADWAN from comment #0) > Created attachment 114877 [details] > Steps to reproduce with the attached file : > - Select two or more sheets NOT necessary. Enough to select "Mensuel". > - select a few rows (example : rows 37 to 67) > - delete rows by right-clic => delete selected rows or edit => delete rows > Result : Crash Reproduced.
Created attachment 115745 [details] Test case which also crashes I'm hoping that it's related, but the attached file crashes reliably for me when I delete one of the rows with formulas in. It's originally from a larger spreadsheet (which also crashed), hence the various #REF & #NAME errors, but I'm hoping that the relative simplicity of this will aid in finding this bug.
I can't reproduce a crash in master with the latest attachment (maybe David uses a 4.4.2 release where the change for bug 89957 isn't included?) but in a dbgutil build it triggers the related warnings mentioned above in comment 3, so might be helpful as a smaller test case scenario, thanks. I'm taking this.
Eike Rathke committed a patch related to this issue. It has been pushed to "master": http://cgit.freedesktop.org/libreoffice/core/commit/?id=2f6a06856ad8df0c11a112d1e457b408e9a7af1d tdf#90694 reset group area listeners when splitting group It will be available in 5.1.0. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Eike Rathke committed a patch related to this issue. It has been pushed to "libreoffice-5-0": http://cgit.freedesktop.org/libreoffice/core/commit/?id=4d8acde1b820c2548839b1632bc28f2988001941&h=libreoffice-5-0 tdf#90694 reset group area listeners when splitting group It will be available in 5.0.0.0.beta2. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Eike Rathke committed a patch related to this issue. It has been pushed to "master": http://cgit.freedesktop.org/libreoffice/core/commit/?id=5d6448a5131488eac3a6af16bff06140663c3db4 tdf#90694 reset group area listeners on correct top It will be available in 5.1.0. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Eike Rathke committed a patch related to this issue. It has been pushed to "libreoffice-5-0": http://cgit.freedesktop.org/libreoffice/core/commit/?id=e141806955a2a3231a0c43519bbfcf8bc65fc5cd&h=libreoffice-5-0 tdf#90694 reset group area listeners on correct top It will be available in 5.0.0.0.beta2. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Pending review https://gerrit.libreoffice.org/16104 for 4-4 https://gerrit.libreoffice.org/16105 for 4-4-4
*** Bug 91217 has been marked as a duplicate of this bug. ***
Eike Rathke committed a patch related to this issue. It has been pushed to "master": http://cgit.freedesktop.org/libreoffice/core/commit/?id=4baf76ddb39580678cf14019900be78bb9071d7b check bounds in RPN tokens, tdf#90694 related and others It will be available in 5.1.0. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Eike Rathke committed a patch related to this issue. It has been pushed to "libreoffice-5-0": http://cgit.freedesktop.org/libreoffice/core/commit/?id=81a4cd506929416de278a94279c4774ad5a7ac95&h=libreoffice-5-0 check bounds in RPN tokens, tdf#90694 related and others It will be available in 5.0.0.0.beta2. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Jan Holesovsky committed a patch related to this issue. It has been pushed to "master": http://cgit.freedesktop.org/libreoffice/core/commit/?id=3caa8c633168d3fa9540192d85869492df602d54 Revert "check bounds in RPN tokens, tdf#90694 related and others" It will be available in 5.1.0. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Eike Rathke committed a patch related to this issue. It has been pushed to "master": http://cgit.freedesktop.org/libreoffice/core/commit/?id=bd856bdeb1e04311c3c389093afbc4d6a6321ecb Revert "Revert "check bounds in RPN tokens, tdf#90694 related and others"" It will be available in 5.1.0. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Windows build hopefully fixed with 883ebe0283dc6bdf62f08191dede2a249f777f63
Eike Rathke committed a patch related to this issue. It has been pushed to "libreoffice-4-4": http://cgit.freedesktop.org/libreoffice/core/commit/?id=d3a491fcc678bb4a490de79cb7474ef72cf6c35f&h=libreoffice-4-4 tdf#90694 reset group area listeners when splitting group It will be available in 4.4.5. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Eike Rathke committed a patch related to this issue. It has been pushed to "libreoffice-4-4": http://cgit.freedesktop.org/libreoffice/core/commit/?id=38f99a5071bc5f3b68a6833305665b14bd5ba9ed&h=libreoffice-4-4 check bounds in RPN tokens, tdf#90694 related and others It will be available in 4.4.5. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Thx for the patch on 4.4.5 good job ;)
Eike Rathke committed a patch related to this issue. It has been pushed to "libreoffice-4-4-4": http://cgit.freedesktop.org/libreoffice/core/commit/?id=ce73f4befb90dbcc80964cec656127a6210b4d18&h=libreoffice-4-4-4 tdf#90694 reset group area listeners when splitting group It will be available in 4.4.4. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Eike Rathke committed a patch related to this issue. It has been pushed to "libreoffice-4-4-4": http://cgit.freedesktop.org/libreoffice/core/commit/?id=17c9cfef1a1bf48489fc856d59c6776a47ef0f77&h=libreoffice-4-4-4 check bounds in RPN tokens, tdf#90694 related and others It will be available in 4.4.4. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Migrating Whiteboard tags to Keywords: (notBibisectable) [NinjaEdit]
Caolán McNamara committed a patch related to this issue. It has been pushed to "master": https://git.libreoffice.org/core/+/11e381c527ebd440e4d64d19a5bc27bdc9ea70fc%5E%21 crashtesting: failure on import of tdf90694-1.ots It will be available in 6.3.0. The patch should be included in the daily builds available at https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: https://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Xisco Fauli committed a patch related to this issue. It has been pushed to "master": https://git.libreoffice.org/core/commit/a42b6236de6df452d1b2341ae6009da3c38bc481 tdf#90694: sc_uicalc: Add unittest It will be available in 7.4.0. The patch should be included in the daily builds available at https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: https://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.