Bug 99174 - Attempt to copy text from named expression crashes LibreOffice
Summary: Attempt to copy text from named expression crashes LibreOffice
Status: RESOLVED WORKSFORME
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
5.1.2.2 release
Hardware: x86-64 (AMD64) Linux (All)
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-04-08 18:53 UTC by rlk
Modified: 2016-04-10 17:32 UTC (History)
2 users (show)

See Also:
Crash report or crash signature:


Attachments
Demonstration of crash when copying expression from name dialog (7.75 KB, application/vnd.oasis.opendocument.spreadsheet)
2016-04-08 18:53 UTC, rlk
Details

Note You need to log in before you can comment on or make changes to this bug.
Description rlk 2016-04-08 18:53:02 UTC
Created attachment 124194 [details]
Demonstration of crash when copying expression from name dialog

Attempting to copy text from the Range or formula expression in the Manage Names dialog crashes LibreOffice when the OK or Cancel button is clicked.

To reproduce, using attached spreadsheet:

1) Enter Manage Names dialog (alt-I alt-N alt-M)

2) Select the range expression from the addit name.

3) Type ctrl-C to copy the expression

4) Click Cancel

5) Watch LibreOffice immediately crash.

This doesn't happen with 4.2.7 (which is the version I have to use with the full-size spreadsheet that I use).
Comment 1 m_a_riosv 2016-04-08 22:21:12 UTC
Not for me with
Win10x64
Version: 5.1.2.2 (x64)
Build ID: d3bf12ecb743fc0d20e0be0c58ca359301eb705f
CPU Threads: 4; OS Version: Windows 6.19; UI Render: GL; 

Please try resetting the user profile, sometimes solves strange issues.
https://wiki.documentfoundation.org/UserProfile
Usually it's enough renaming/deleting the file "user/registrymodifications.xcu",  it affects all the options in Menu/Tools/Options, and the files "user/basic/dialog.xlc" and "scrip.xlc" are overwritten, additionally custom colors in "user/config/standard.soc" are lost.
Comment 2 rlk 2016-04-08 23:07:19 UTC
That worked.
Comment 3 rlk 2016-04-08 23:11:32 UTC
Setting it back to unconfirmed.

It didn't crash, but I did get this message (I ran it on the command line), and it's now locked up (I'm using a more complex example):

(soffice:27336): GLib-GObject-WARNING **: gsignal.c:3406: signal name 'selection_changed' is invalid for instance '0x2d4f5e90' of type 'OOoAtkObjCompTxt'
*** Error in `/usr/lib64/libreoffice/program/soffice.bin': corrupted double-linked list: 0x000000002c70f000 ***

I will try to find a simpler example that does this.
Comment 4 rlk 2016-04-08 23:15:58 UTC
After this happened, the previous crash behavior returned.  Something is definitely not right here.
Comment 5 rlk 2016-04-08 23:22:11 UTC
OK, after removing my old profile, loading up that sample spreadsheet, and doing what I said earlier, sometimes it produces some kind of error corruption message:

$ soffice name-crash.ods 
*** Error in `/usr/lib64/libreoffice/program/soffice.bin': malloc(): smallbin double linked list corrupted: 0x0000000003dd52f0 ***

and locks up.  Sometimes it doesn't.

There definitely looks to be a real bug here that presumably could cause data corruption of some kind.
Comment 6 rlk 2016-04-09 03:17:31 UTC
For what it's worth, this is not happening with the 03/16 dev build (which had a fix for another bug that was causing a crash).  So either something's broken since, or this is a problem with the openSUSE RPM's.  I'll wait for official packages from libreoffice.org and/or updates from openSUSE (42.1) and update the bug then.
Comment 7 raal 2016-04-10 17:32:10 UTC
(In reply to rlk from comment #6)
> For what it's worth, this is not happening with the 03/16 dev build (which
> had a fix for another bug that was causing a crash).  So either something's
> broken since, or this is a problem with the openSUSE RPM's.  I'll wait for
> official packages from libreoffice.org and/or updates from openSUSE (42.1)
> and update the bug then.

Hello, I can not reproduce crash with Version: 5.2.0.0.alpha0+
Build ID: ef34535ceb60d7d63b8d8671e4c6e9e43ffbd17d
CPU Threads: 4; OS Version: Linux 4.2; UI Render: default; 
TinderBox: Linux-rpm_deb-x86_64@70-TDF, Branch:master, Time: 2016-03-27_09:53:05

Seems to be fixed, closing the bug. Set again to unconfirmed if you can reproduce the bug in dev version.