Bug 160944 - LO Calc Crashes after inserting a row in spreadsheet (or after saving directly after)
Summary: LO Calc Crashes after inserting a row in spreadsheet (or after saving directl...
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
7.1.0.0.alpha1+
Hardware: x86-64 (AMD64) All
: medium critical
Assignee: Not Assigned
URL:
Whiteboard:
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks: Cell-Management Crash
  Show dependency treegraph
 
Reported: 2024-05-06 04:32 UTC by Eric
Modified: 2024-05-11 12:39 UTC (History)
5 users (show)

See Also:
Crash report or crash signature: ["libc.so.6"]


Attachments
Materials presentation file for a 3D sketchup model (export via OpenCutList) (131.14 KB, application/vnd.oasis.opendocument.spreadsheet)
2024-05-06 04:35 UTC, Eric
Details
bt with debug symbols (11.49 KB, text/plain)
2024-05-06 20:23 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Eric 2024-05-06 04:32:32 UTC
Description:
inserting a line in a document causes LB to crash. 

Steps to Reproduce:
1.insert additionnal line between line 3 and line 4
2.save

Actual Results:
crash

Expected Results:
save the file :-)


Reproducible: Always


User Profile Reset: No

Additional Info:
The file has been created in 2016 with an old version of LB.
Comment 1 Eric 2024-05-06 04:35:37 UTC
Created attachment 193979 [details]
Materials presentation file for a 3D sketchup model (export via OpenCutList)
Comment 2 m_a_riosv 2024-05-06 07:11:20 UTC
No issue with
Version: 24.2.3.2 (X86_64) / LibreOffice Community
Build ID: 433d9c2ded56988e8a90e6b2e771ee4e6a5ab2ba
CPU threads: 16; OS: Windows 10.0 Build 22631; UI render: default; VCL: win
Locale: es-ES (es_ES); UI: en-US
Calc: CL threaded

Please use as abbreviation LibreOffice -> LO

Can you test in safe mode?, Menu/Help/Restart in Safe Mode

Please paste here the information on Menu/Help/About LibreOffice (There is an icon to copy)
Comment 3 Eric 2024-05-06 07:17:59 UTC
Hi, thanks for your answer. The bug occurs in safe mode also. I just tried.
Comment 4 Eric 2024-05-06 07:19:54 UTC
Version: 24.2.3.2 (X86_64) / LibreOffice Community
Build ID: 433d9c2ded56988e8a90e6b2e771ee4e6a5ab2ba
CPU threads: 8; OS: Windows 10.0 Build 19045; UI render: Skia/Raster; VCL: win
Locale: fr-FR (fr_FR); UI: fr-FR
Calc: threaded
Comment 5 m_a_riosv 2024-05-06 11:43:44 UTC
Please try repairing LibreOffice installation, through the operating system, 'Add or remove programs', clicking at the right of the LibeOffice, there is an option to repair.
Comment 6 Eric 2024-05-06 12:59:33 UTC
Hi, thanks for help. I've done it, but it gives the same result after 'repair'. 

Note: I've been unable to update Windows for a few months now. An error message appears every time during the update. That said, everything works. This bug with Calc is the first I've had for a long time. Could it be related?
Comment 7 Julien Nabet 2024-05-06 20:23:06 UTC
Created attachment 194005 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today + gen rendering, I got an assertion.
Comment 8 Julien Nabet 2024-05-06 20:23:46 UTC
with gtk3, I got a crash with:
terminate called after throwing an instance of 'com::sun::star::lang::IndexOutOfBoundsException'
#0  0x00007f2ed40b2191 in __cxa_throw () at /lib/x86_64-linux-gnu/libstdc++.so.6
#1  0x00007f2e9f0a95d5 in ScAccessibleSpreadsheet::getAccessibleCellAt(int, int) (this=0x5564ad85dec0, nRow=1048576, nColumn=0)
    at /home/julien/lo/libreoffice/sc/source/ui/Accessibility/AccessibleSpreadsheet.cxx:945
#2  0x00007f2e9f0aaa33 in non-virtual thunk to ScAccessibleSpreadsheet::getAccessibleCellAt(int, int) () at /home/julien/lo/libreoffice/sc/source/ui/Accessibility/AccessibleSpreadsheet.cxx:1636
#3  0x00007f2e9f05c67d in ScChildrenShapes::GetRelationSet((anonymous namespace)::ScAccessibleShapeData const*) const (this=0x5564b1e971c0, pData=0x5564b1c45c10)
    at /home/julien/lo/libreoffice/sc/source/ui/Accessibility/AccessibleDocument.cxx:1144
#4  0x00007f2e9f04726d in ScChildrenShapes::SetAnchor(com::sun::star::uno::Reference<com::sun::star::drawing::XShape> const&, (anonymous namespace)::ScAccessibleShapeData*) const
    (this=0x5564b1e971c0, xShape=uno::Reference to (SvxCustomShape *) 0x5564b439c158, pData=0x5564b1c45c10) at /home/julien/lo/libreoffice/sc/source/ui/Accessibility/AccessibleDocument.cxx:1166
#5  0x00007f2e9f046b08 in ScChildrenShapes::Notify(SfxBroadcaster&, SfxHint const&) (this=0x5564b1e971c0, rHint=...) at /home/julien/lo/libreoffice/sc/source/ui/Accessibility/AccessibleDocument.cxx:387
#6  0x00007f2ecfb4c9c4 in SfxBroadcaster::Broadcast(SfxHint const&) (this=0x5564ad7b2980, rHint=...) at /home/julien/lo/libreoffice/svl/source/notify/SfxBroadcaster.cxx:40
#7  0x00007f2ece686e4f in SdrObject::BroadcastObjectChange() const (this=0x5564adfffa80) at /home/julien/lo/libreoffice/svx/source/svdraw/svdobj.cxx:1025
#8  0x00007f2e9e67f057 in ScDrawLayer::RecalcPos(SdrObject*, ScDrawObjData&, bool, bool) (this=0x5564ad7b2980, pObj=0x5564adfffa80, rData=..., bNegativePage=false, bUpdateNoteCaptionPos=true)
    at /home/julien/lo/libreoffice/sc/source/core/data/drwlayer.cxx:1335
#9  0x00007f2e9e67d043 in ScDrawLayer::MoveCells(short, short, int, short, int, short, int, bool)
    (this=0x5564ad7b2980, nTab=1, nCol1=0, nRow1=3, nCol2=16383, nRow2=1048575, nDx=0, nDy=1, bUpdateNoteCaptionPos=true) at /home/julien/lo/libreoffice/sc/source/core/data/drwlayer.cxx:632
#10 0x00007f2e9e6840e2 in ScDrawLayer::MoveArea(short, short, int, short, int, short, int, bool, bool)
    (this=0x5564ad7b2980, nTab=1, nCol1=0, nRow1=3, nCol2=16383, nRow2=1048575, nDx=0, nDy=1, bInsDel=true, bUpdateNoteCaptionPos=true) at /home/julien/lo/libreoffice/sc/source/core/data/drwlayer.cxx:1565
#11 0x00007f2e9e822151 in ScTable::UpdateDrawRef(UpdateRefMode, short, int, short, short, int, short, short, int, short, bool)
    (this=0x5564ae1489f0, eUpdateRefMode=URM_INSDEL, nCol1=0, nRow1=3, nTab1=0, nCol2=16383, nRow2=1048575, nTab2=4, nDx=0, nDy=1, nDz=0, bUpdateNoteCaptionPos=true)
    at /home/julien/lo/libreoffice/sc/source/core/data/table1.cxx:1821
#12 0x00007f2e9e422737 in ScDocument::InsertRow(short, short, short, short, int, unsigned long, ScDocument*, ScMarkData const*)
    (this=0x5564adb1e3f0, nStartCol=0, nStartTab=0, nEndCol=16383, nEndTab=4, nStartRow=3, nSize=1, pRefUndoDoc=0x5564b3086680, pTabMark=0x7fff9f289c88)
    at /home/julien/lo/libreoffice/sc/source/core/data/document.cxx:1311
#13 0x00007f2e9f2be7d1 in ScDocFunc::InsertCells(ScRange const&, ScMarkData const*, InsCellCmd, bool, bool, bool, unsigned long)
    (this=0x5564adafbd90, rRange=..., pTabMark=0x5564adebc158, eCmd=INS_INSROWS_BEFORE, bRecord=true, bApi=false, bPartOfPaste=false, nInsertCount=0)
    at /home/julien/lo/libreoffice/sc/source/ui/docshell/docfunc.cxx:2113
#14 0x00007f2e9fc0407c in ScViewFunc::InsertCells(InsCellCmd, bool, bool, unsigned long) (this=0x5564adebc108, eCmd=INS_INSROWS_BEFORE, bRecord=true, bPartOfPaste=false, nCount=0)
    at /home/julien/lo/libreoffice/sc/source/ui/view/viewfunc.cxx:1845
#15 0x00007f2e9f905b3b in ScCellShell::ExecuteEdit(SfxRequest&) (this=0x5564ade56f80, rReq=...) at /home/julien/lo/libreoffice/sc/source/ui/view/cellsh1.cxx:312
Comment 9 Stéphane Guillou (stragu) 2024-05-10 04:35:00 UTC
Also reproduced on Ubuntu 22.04 with comment 0 steps and a recent daily build:

Version: 24.8.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: ad1f0bdeac30fca1dc56a08803ef23f2aca4db05
CPU threads: 8; OS: Linux 6.5; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: CL threaded

...but I only need to insert the row (no need to save) to reproduce the crash.

Crash reports:
- 24.2.3: https://crashreport.libreoffice.org/stats/crash_details/d78f0e88-3f54-4f1f-86c5-793a80c3c7a6
- 7.6.6.3: https://crashreport.libreoffice.org/stats/crash_details/f247db78-d30c-4999-be31-8fcee7571aef
- 7.2.0.4: https://crashreport.libreoffice.org/stats/crash_details/3306047d-3f01-4330-9046-a7074dc0b1f1
- 7.1.0.3: https://crashreport.libreoffice.org/stats/crash_details/b653e0e8-c19d-40fe-b321-07345402c835

Bibisected with linux-64-7.1 repo to first bad build [71b83e373e9401a6bb4ef4972923978616c49331] which points to:

commit 670d10f2b06656973a61e956956b149bae01721f
author	Regina Henschel 	Fri Nov 13 18:29:20 2020 +0100
committer	Regina Henschel 	Sun Nov 15 09:04:14 2020 +0100
Avoid changing anchor on visibility change of cell
Change-Id: I0bd3684b7a5eda62b578275c02a5ac839ce58e2c
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/105802

Regina, could you please have a look?
Comment 10 Regina Henschel 2024-05-11 12:39:38 UTC
The example document has Zombie-shape anchored to the first cell in the last row.

Repair instructions: Insert a shape. Leave insert mode. Select the newly inserted shape. Press Tab-key (that will select the next shape) and wait a little bit. The view will change to the last row. There you see the anchor in the first cell. Press Delete-key. Now the Zombie-shape is deleted. Go back to the newly inserted shape and delete it too. Save the document.

This Zombie-shape itself is a 180° rotated, skewed "Striped Right Arrow". It is anchored "To cell (resize with cell).

The crash itself happens somewhere in export, likely in OpenRow, when it gets a nStartRow=1048576. There is somewhere a check missing, whether the row really exists. But I don't now where. 

So there are two problems:
1. How could this Zombie-shape come into being?
2. Prevent invalid row access.