Bug Hunting Session
Bug 98880 - LO crashes when making too many calls of a user-defined function
Summary: LO crashes when making too many calls of a user-defined function
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
5.1.1.2 rc
Hardware: All Linux (All)
: medium major
Assignee: Caolán McNamara
URL:
Whiteboard: target:5.3.0 target:5.2.0.1 target:5.1.5
Keywords: haveBacktrace
Depends on:
Blocks:
 
Reported: 2016-03-25 11:46 UTC by Mamoth
Modified: 2016-10-25 18:54 UTC (History)
3 users (show)

See Also:
Crash report or crash signature:


Attachments
Version of the file that does not make LO crash (614.24 KB, application/vnd.oasis.opendocument.spreadsheet)
2016-03-25 11:46 UTC, Mamoth
Details
version of the file that makes LO crash (820.14 KB, application/vnd.oasis.opendocument.spreadsheet)
2016-03-25 11:47 UTC, Mamoth
Details
bt with debug symbols (22.33 KB, text/plain)
2016-03-26 00:00 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Mamoth 2016-03-25 11:46:58 UTC
Created attachment 123836 [details]
Version of the file that does not make LO crash

Hello to all.

I have defined a function in Basic that makes a simple calculation :
with 3 values P1, P2, P3 it computes ( abs(P1-P2) + abs(P2-P3) + abs(P3-1)) / (abs(P1) + abs (P2) + abs(P3))

I finished coding the function and it works.

However, I want to use it to a huge range of cells (1250 rows x 20 columns = 25 000 function calls ) and that makes LO crash.

I am providing two sample files, one with only 100 calls of the function, so you can open it and check out that the function works.
The second file has the 25 000 function calls and it crashes LO as soon as I open it if I enable the macros.

I am running LO 5.1.1.2 under Linux Mint 17.1. 

However, since I have a dual-boot on this computer, I have also tested opening the same file with LO 5.0.5.2 under Windows 7 and it works (no crashing).

So it seems to be a problem, either with the 5.1.1.2 build or with the Linux version.

The function is called IndiceEquilibrage and is called in the second sheet of the Calc worksheet.
Comment 1 Mamoth 2016-03-25 11:47:53 UTC
Created attachment 123837 [details]
version of the file that makes LO crash
Comment 2 Julien Nabet 2016-03-26 00:00:54 UTC
Created attachment 123862 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today, I could reproduce this.

I attached a bt with symbols.
Comment 3 Caolán McNamara 2016-06-01 15:16:41 UTC
sc/source/core/tool/interpr4.cxx calls ::IsString on a ScVectorRefMatrix which calls ensureFullMatrix. That makes use of rArray.mpStringArray where rArray's mpStringArray is set to that rArray by FormulaGroupContext::ensureStrArray and the storage of mpStringArray belongs to the FormulaGroupContext, but that context was reset and destroyed up the stack in ScDocument::InterpretDirtyCells so the data is now invalid
Comment 4 Caolán McNamara 2016-06-02 10:34:42 UTC
I can make it not crash with https://gerrit.libreoffice.org/#/c/25815/
Comment 5 Mamoth 2016-06-02 11:31:45 UTC
I just tried on another computer (32 bits, running Linux Mint 17.3, with LO 5.0.3.2) and it works fine.
Comment 6 Commit Notification 2016-06-03 14:08:11 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=dc78e5c6f5f55b0289012f4c4e6013d2935b1cc6

Resolves: tdf#98880 ensure backing context of DoubleVectorRefToken...

It will be available in 5.3.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 7 Commit Notification 2016-06-03 14:47:12 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-5-2":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=57f8094fd312114d670ac4cdbdfd18b80b2c67e5&h=libreoffice-5-2

Resolves: tdf#98880 ensure backing context of DoubleVectorRefToken...

It will be available in 5.2.0.1.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 8 Commit Notification 2016-06-03 14:48:33 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-5-1":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=fb433b7909d049f12e848ad56ae8b406f91e1cc2&h=libreoffice-5-1

Resolves: tdf#98880 ensure backing context of DoubleVectorRefToken...

It will be available in 5.1.5.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.