Bug 90694 - Crash when deleting rows on multiple sheets
Summary: Crash when deleting rows on multiple sheets
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
4.4.0.0.beta2
Hardware: All All
: high critical
Assignee: Eike Rathke
URL:
Whiteboard: target:5.1.0 target:5.0.0.0.beta2 tar...
Keywords: haveBacktrace, notBibisectable
: 91217 (view as bug list)
Depends on:
Blocks:
 
Reported: 2015-04-18 12:03 UTC by Denis RADWAN
Modified: 2019-04-12 10:46 UTC (History)
9 users (show)

See Also:
Crash report or crash signature:


Attachments
File for reproduce bug (98.79 KB, application/vnd.oasis.opendocument.spreadsheet-template)
2015-04-18 12:03 UTC, Denis RADWAN
Details
trace file (26.14 KB, text/plain)
2015-04-18 12:05 UTC, Denis RADWAN
Details
console+bt with debug symbols (6.35 KB, text/plain)
2015-04-18 18:38 UTC, Julien Nabet
Details
Test case which also crashes (12.23 KB, application/vnd.oasis.opendocument.spreadsheet)
2015-05-20 11:32 UTC, David Maugham
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Denis RADWAN 2015-04-18 12:03:00 UTC
Created attachment 114877 [details]
File for reproduce bug

Steps to reproduce :

with the attached file :
- Select two or more sheets
- select a few rows (example : rows 37 to 67)
- delete rows by right-clic => delete selected rows or edit => delete rows

Result : Crash

Version: 4.4.3.1
Build ID: b2f347f2ac68821efc00b6f1793cda90af748118
Locale: fr_FR
Windows XP Pro SP3 and Vista 64

Tested by few users on French discuss list :
http://nabble.documentfoundation.org/LibreOffice-4-4-3-RC1-est-disponible-pour-vos-tests-tt4146492.html

reproductible with :
Win7
- Version: 4.4.0.1 
Build ID: 1ba9640ddd424f1f535c75bf2b86703770b8cf6f 
Locale: fr_FR 

- Version: 4.4.0.0.beta2 
Build ID: be92f32b8f21603a6b7a75dd645f7475bdee519d 
Locale : fr_FR 

- Version: 4.4.2.2 
Build ID: c4c7d32d0d49397cad38d62472b0bc8acff48dd6 
Locale : fr_FR 

- Version: 4.4.3.1 
Build ID: b2f347f2ac68821efc00b6f1793cda90af748118 
Locale : fr_FR 

...and with a  "SEH Exception: ACCESS VIOLATION"  
- Version: 4.5.0.0.alpha0+ 
Build ID: 88bf8325f7ae49f949704021081a195d25985867 
TinderBox: Win-x86@42, Branch:master, Time: 2015-04-12_00:58:11 
Locale: fr_FR 
- Version: 5.0.0.0.alpha0+ 
Build ID: 35a4d80750553e7d51a6139b61c47a4f7a475ce8 
TinderBox: Win-x86@42, Branch:master, Time: 2015-04-16_23:53:40 
Locale: fr_FR  

Linux :
fedora 21 KDE and Xfce

Work fine with :
- Version: 4.4.0.0.beta1 
Build ID: 9af3d21234aa89dac653c0bd76648188cdeb683e 
Locale: fr_FR
Comment 1 Denis RADWAN 2015-04-18 12:05:01 UTC
Created attachment 114878 [details]
trace file

obtained with :
Windows 7/64 & Version: 4.4.3.1 
Build ID: b2f347f2ac68821efc00b6f1793cda90af748118 
Locale : fr_FR
Comment 2 Laurent BP 2015-04-18 12:33:07 UTC
Change version according to tests: 4.4.0.0 beta2
Comment 3 Julien Nabet 2015-04-18 18:38:08 UTC
Created attachment 114890 [details]
console+bt with debug symbols

On pc Debian x86-64 with master sources updated today, I could reproduce this.
I attached bt

Notice:
warn:sc.core:13739:1:sc/source/core/tool/grouparealistener.cxx:213: FormulaGroupAreaListener::collectFormulaCells() nBlockSize 36 < 62 mnGroupLen
Comment 4 Julien Nabet 2015-04-19 19:21:45 UTC
*** Bug 90717 has been marked as a duplicate of this bug. ***
Comment 5 Julien Nabet 2015-04-19 19:47:32 UTC
Eike: noticing http://cgit.freedesktop.org/libreoffice/core/commit/?id=cff5ee864b2d87d74079697425d7895dbf1b2ba4 and http://cgit.freedesktop.org/libreoffice/core/commit/?id=47230a036fe35b9a7a7c0609232849fcbb51efcc, thought you might be interested in this one.

tdf#90717 shows that the problem is even simpler to reproduce.
Comment 6 Joel Madero 2015-04-29 22:37:40 UTC
I tried to bibisect this and it never crashed - adding findings to whiteboard.
Comment 7 pierre-yves samyn 2015-05-09 10:57:21 UTC
Hi

Still reproduced on windows 7/64 & Version: 4.4.3.2
Build ID: 88805f81e9fe61362df02b9941de8e38a9b5fd16
Locale: fr_FR

Regards
Pierre-Yves
Comment 8 Timur 2015-05-11 17:59:24 UTC
(In reply to Denis RADWAN from comment #0)
> Created attachment 114877 [details]
> Steps to reproduce with the attached file :
> - Select two or more sheets
NOT necessary. Enough to select "Mensuel".
> - select a few rows (example : rows 37 to 67)
> - delete rows by right-clic => delete selected rows or edit => delete rows
> Result : Crash
Reproduced.
Comment 9 David Maugham 2015-05-20 11:32:42 UTC
Created attachment 115745 [details]
Test case which also crashes

I'm hoping that it's related, but the attached file crashes reliably for me when I delete one of the rows with formulas in.

It's originally from a larger spreadsheet (which also crashed), hence the various #REF & #NAME errors, but I'm hoping that the relative simplicity of this will aid in finding this bug.
Comment 10 Eike Rathke 2015-06-03 17:30:46 UTC
I can't reproduce a crash in master with the latest attachment (maybe David uses a 4.4.2 release where the change for bug 89957 isn't included?) but in a dbgutil build it triggers the related warnings mentioned above in comment 3, so might be helpful as a smaller test case scenario, thanks.

I'm taking this.
Comment 11 Commit Notification 2015-06-05 14:24:11 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=2f6a06856ad8df0c11a112d1e457b408e9a7af1d

tdf#90694 reset group area listeners when splitting group

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 12 Commit Notification 2015-06-05 15:03:05 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "libreoffice-5-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=4d8acde1b820c2548839b1632bc28f2988001941&h=libreoffice-5-0

tdf#90694 reset group area listeners when splitting group

It will be available in 5.0.0.0.beta2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 13 Commit Notification 2015-06-08 11:32:42 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=5d6448a5131488eac3a6af16bff06140663c3db4

tdf#90694 reset group area listeners on correct top

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 14 Commit Notification 2015-06-08 11:38:26 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "libreoffice-5-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=e141806955a2a3231a0c43519bbfcf8bc65fc5cd&h=libreoffice-5-0

tdf#90694 reset group area listeners on correct top

It will be available in 5.0.0.0.beta2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 15 Eike Rathke 2015-06-08 12:01:31 UTC
Pending review
https://gerrit.libreoffice.org/16104 for 4-4
https://gerrit.libreoffice.org/16105 for 4-4-4
Comment 16 Eike Rathke 2015-06-08 12:05:49 UTC
*** Bug 91217 has been marked as a duplicate of this bug. ***
Comment 17 Commit Notification 2015-06-08 13:39:52 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=4baf76ddb39580678cf14019900be78bb9071d7b

check bounds in RPN tokens, tdf#90694 related and others

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 18 Commit Notification 2015-06-08 14:01:45 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "libreoffice-5-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=81a4cd506929416de278a94279c4774ad5a7ac95&h=libreoffice-5-0

check bounds in RPN tokens, tdf#90694 related and others

It will be available in 5.0.0.0.beta2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 19 Commit Notification 2015-06-08 14:11:50 UTC
Jan Holesovsky committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=3caa8c633168d3fa9540192d85869492df602d54

Revert "check bounds in RPN tokens, tdf#90694 related and others"

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 20 Commit Notification 2015-06-08 15:52:42 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=bd856bdeb1e04311c3c389093afbc4d6a6321ecb

Revert "Revert "check bounds in RPN tokens, tdf#90694 related and others""

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 21 Eike Rathke 2015-06-08 15:54:20 UTC
Windows build hopefully fixed with 883ebe0283dc6bdf62f08191dede2a249f777f63
Comment 22 Commit Notification 2015-06-09 10:36:31 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "libreoffice-4-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=d3a491fcc678bb4a490de79cb7474ef72cf6c35f&h=libreoffice-4-4

tdf#90694 reset group area listeners when splitting group

It will be available in 4.4.5.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 23 Commit Notification 2015-06-09 10:36:35 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "libreoffice-4-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=38f99a5071bc5f3b68a6833305665b14bd5ba9ed&h=libreoffice-4-4

check bounds in RPN tokens, tdf#90694 related and others

It will be available in 4.4.5.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 24 Denis RADWAN 2015-06-10 11:15:44 UTC
Thx for the patch on 4.4.5
good job ;)
Comment 25 Commit Notification 2015-06-10 17:00:13 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "libreoffice-4-4-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=ce73f4befb90dbcc80964cec656127a6210b4d18&h=libreoffice-4-4-4

tdf#90694 reset group area listeners when splitting group

It will be available in 4.4.4.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 26 Commit Notification 2015-06-10 17:01:39 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "libreoffice-4-4-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=17c9cfef1a1bf48489fc856d59c6776a47ef0f77&h=libreoffice-4-4-4

check bounds in RPN tokens, tdf#90694 related and others

It will be available in 4.4.4.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 27 Robinson Tryon (qubit) 2015-12-17 10:59:16 UTC Comment hidden (obsolete)
Comment 28 Commit Notification 2019-04-12 10:46:45 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/+/11e381c527ebd440e4d64d19a5bc27bdc9ea70fc%5E%21

crashtesting: failure on import of tdf90694-1.ots

It will be available in 6.3.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.