https://bugs.documentfoundation.org/show_bug.cgi?id=166762
Bug ID: 166762
Summary: Calc crashes in ScViewData::ScViewData when releasing
Shift key after Shift+Arrow range selection
Product: LibreOffice
Version: unspecified
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: medium
Component: Calc
Assignee: [email protected]
Reporter: [email protected]
Build Information:
------------------
Version: master (Git commit: b77f1d103cd3a800eef0b71456fdc7c28799af65 )
OS: 6.6.90-1-MANJARO (64-bit)
Hardware:
Operating System: Manjaro Linux
KDE Plasma Version: 6.3.5
KDE Frameworks Version: 6.14.0
Qt Version: 6.9.0
Kernel Version: 6.6.90-1-MANJARO (64-bit)
Graphics Platform: X11
Processors: 16 × AMD Ryzen 7 3700X 8-Core Processor
Memory: 31.3 GiB of RAM
Graphics Processor: NVIDIA GeForce GTX 1050 Ti
Steps to Reproduce:
-------------------
1. Ensure working tree is clean and on the specified master commit.
2. Build LibreOffice from source.
3. Launch Calc (e.g., ./instdir/program/scalc or ./instdir/program/soffice
--calc).
4. Create a new, empty spreadsheet (File -> New -> Spreadsheet).
5. Click in any cell (e.g., A1).
6. Press and hold the Shift key.
7. Press and release an arrow key (e.g., Right Arrow) to select a range (e.g.,
A1:B1).
8. Release the Shift key.
Observed Result:
----------------
LibreOffice Calc crashes immediately upon releasing the Shift key. A dialog
appears stating "Due to an error, LibreOffice crashed. All the files you were
working on will now be saved...".
Expected Result:
----------------
The cell range selection (e.g., A1:B1) should remain active, and LibreOffice
Calc should not crash.
Additional Information:
----------------------
- The crash is reproducible 100% of the time with the steps above.
- The crash occurs even in a brand new, empty spreadsheet with no data.
- The crash occurs when selecting even a small range (e.g., two cells).
- Selecting cells using only the mouse (click and drag) does NOT cause the
crash. The issue is specific to the Shift+Arrow key selection method and
releasing the Shift key.
Backtrace (from GDB):
---------------------
(gdb) bt full
#0 0x00007fffc6ef1971 in ScViewData::ScViewData(ScDocShell&, ScTabViewShell*)
()
from
/home/seeh/projects/libreoffice/libreoffice-core/instdir/program/../program/libsclo.so
No symbol table info available.
#1 0x00007fffc69e8a8f in ScTransferObj::PaintToDev(OutputDevice*, ScDocument&,
double, ScRange const&) ()
from
/home/seeh/projects/libreoffice/libreoffice-core/instdir/program/../program/libsclo.so
No symbol table info available.
#2 0x00007fffc69eb6b0 in
ScTransferObj::GetData(com::sun::star::datatransfer::DataFlavor const&,
rtl::OUString const&) ()
from
/home/seeh/projects/libreoffice/libreoffice-core/instdir/program/../program/libsclo.so
No symbol table info available.
#3 0x00007ffff27d36ee in
TransferableHelper::getTransferData2(com::sun::star::datatransfer::DataFlavor
const&, rtl::OUString const&) ()
from
/home/seeh/projects/libreoffice/libreoffice-core/instdir/program/libvcllo.so
No symbol table info available.
#4 0x00007ffff27d48af in
TransferableDataHelper::GetAny(com::sun::star::datatransfer::DataFlavor const&,
rtl::OUString const&) const ()
from
/home/seeh/projects/libreoffice/libreoffice-core/instdir/program/libvcllo.so
No symbol table info available.
#5 0x00007fffc69e812d in
ScSelectionTransferObj::GetData(com::sun::star::datatransfer::DataFlavor
const&, rtl::OUString const&) ()
from
/home/seeh/projects/libreoffice/libreoffice-core/instdir/program/../program/libsclo.so
No symbol table info available.
#6 0x00007ffff27d36ee in
TransferableHelper::getTransferData2(com::sun::star::datatransfer::DataFlavor
const&, rtl::OUString const&) ()
from
/home/seeh/projects/libreoffice/libreoffice-core/instdir/program/libvcllo.so
No symbol table info available.
#7 0x00007ffff27ce6e0 in
TransferableHelper::getTransferData(com::sun::star::datatransfer::DataFlavor
const&) ()
from
/home/seeh/projects/libreoffice/libreoffice-core/instdir/program/libvcllo.so
No symbol table info available.
#8 0x00007fffeaf3485b in
VclToGtkHelper::setSelectionData(com::sun::star::uno::Reference<com::sun::star::datatransfer::XTransferable>
const&, _GtkSelectionData*, unsigned int) ()
from
/home/seeh/projects/libreoffice/libreoffice-core/instdir/program/libvclplug_gtk3lo.so
No symbol table info available.
#9 0x00007fffeaf358ae in (anonymous
namespace)::ClipboardGetFunc(_GtkClipboard*, _GtkSelectionData*, unsigned int,
void*) ()
from
/home/seeh/projects/libreoffice/libreoffice-core/instdir/program/libvclplug_gtk3lo.so
--Type <RET> for more, q to quit, c to continue without paging--
No symbol table info available.
#10 0x00007fffea8b510d in _gtk_marshal_VOID__BOXED_UINT_UINTv
(closure=<optimized out>, return_value=<optimized out>, instance=<optimized
out>, args=<optimized out>, marshal_data=<optimized out>,
n_params=<optimized out>, param_types=0x5555565bdf60) at
gtk/gtkmarshalers.c:3789
cc = <optimized out>
data1 = <optimized out>
data2 = <optimized out>
callback = <optimized out>
arg0 = 0x7fffffffc830
arg1 = 0
arg2 = 171
args_copy = {{gp_offset = 40, fp_offset = 48, overflow_arg_area =
0x7fffffffc7a0, reg_save_area = 0x7fffffffc6b0}}
#11 0x00007ffff1f88e5c in ?? () from /usr/lib/libgobject-2.0.so.0
No symbol table info available.
#12 0x00007ffff1f89252 in g_signal_emit_by_name () from
/usr/lib/libgobject-2.0.so.0
No symbol table info available.
#13 0x00007fffeaac22db in gtk_selection_invoke_handler (widget=0x5555570a94d0,
data=0x7fffffffc830, time=25253768) at ../gtk/gtk/gtkselection.c:3226
target_list = <optimized out>
info = 6
__func__ = "gtk_selection_invoke_handler"
#14 0x00007fffeaaca514 in _gtk_selection_request (widget=0x5555570a94d0,
event=0x555557b18b10) at ../gtk/gtk/gtkselection.c:2613
data = {selection = 0x1, target = 0xb7, type = 0x54, format = 131076,
data = 0x0, length = -1, display = 0x55555658c3c0}
items = 0
_g_boolean_var_71 = <optimized out>
display = <optimized out>
info = 0x555557b99430
tmp_list = <optimized out>
i = 0
selection_max_size = 262144
__func__ = "_gtk_selection_request"
#15 0x00007fffea8b3c92 in _gtk_marshal_BOOLEAN__BOXEDv (closure=<optimized
out>, return_value=0x7fffffffca80, instance=<optimized out>, args=<optimized
out>, marshal_data=<optimized out>,
n_params=<optimized out>, param_types=0x55555659c480) at
gtk/gtkmarshalers.c:130
cc = <optimized out>
data1 = <optimized out>
data2 = <optimized out>
callback = <optimized out>
v_return = <optimized out>
arg0 = 0x555557b18b10
args_copy = {{gp_offset = 32, fp_offset = 48, overflow_arg_area =
0x7fffffffcc50, reg_save_area = 0x7fffffffcb90}}
__func__ = "_gtk_marshal_BOOLEAN__BOXEDv"
#16 0x00007ffff1f88e5c in ?? () from /usr/lib/libgobject-2.0.so.0
No symbol table info available.
#17 0x00007ffff1f88f72 in g_signal_emit_valist () from
/usr/lib/libgobject-2.0.so.0
No symbol table info available.
#18 0x00007ffff1f89034 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
No symbol table info available.
#19 0x00007fffeabad67e in gtk_widget_event_internal.part.0.lto_priv.0
(widget=0x5555570a94d0, event=0x555557b18b10) at ../gtk/gtk/gtkwidget.c:7822
signal_num = <optimized out>
return_val = <optimized out>
handled = 0
__func__ = <optimized out>
--Type <RET> for more, q to quit, c to continue without paging--
#20 0x00007fffeaa2ffc4 in gtk_main_do_event (event=<optimized out>) at
../gtk/gtk/gtkmain.c:1861
event_widget = 0x5555570a94d0
grab_widget = 0x5555570a94d0
topmost_widget = <optimized out>
window_group = 0x5555568328c0
rewritten_event = <optimized out>
device = 0x0
tmp_list = <optimized out>
__func__ = <optimized out>
#21 gtk_main_do_event (event=<optimized out>) at ../gtk/gtk/gtkmain.c:1691
event_widget = <optimized out>
grab_widget = 0x0
topmost_widget = 0x0
window_group = <optimized out>
rewritten_event = 0x0
device = <optimized out>
tmp_list = <optimized out>
cleanup = <optimized out>
__func__ = "gtk_main_do_event"
__inst = <optimized out>
__t = <optimized out>
__r = <optimized out>
window = <optimized out>
__inst = <optimized out>
__t = <optimized out>
__r = <optimized out>
__inst = <optimized out>
__t = <optimized out>
__r = <optimized out>
mnemonics_visible = <optimized out>
window = <optimized out>
__inst = <optimized out>
__t = <optimized out>
__r = <optimized out>
#22 0x00007fffeb6261b7 in _gdk_event_emit (event=0x555557b18b10) at
../gtk/gdk/gdkevents.c:73
No locals.
#23 _gdk_event_emit (event=0x555557b18b10) at ../gtk/gdk/gdkevents.c:67
No locals.
#24 0x00007fffeb684bf0 in gdk_event_source_dispatch.lto_priv () at
../gtk/gdk/x11/gdkeventsource.c:354
contexts = 0x0
gdk_x11_display_parent_class = 0x5555556d5550
xdnd_actions_table = {{name = 0x7fffeb6a4320 "XdndActionCopy", atom =
0x0, action = GDK_ACTION_COPY}, {name = 0x7fffeb6a433e "XdndActionMove", atom =
0x0, action = GDK_ACTION_MOVE}, {
name = 0x7fffeb6a432f "XdndActionLink", atom = 0x0, action =
GDK_ACTION_LINK}, {name = 0x7fffeb6a4312 "XdndActionAsk", atom = 0x0, action =
GDK_ACTION_ASK}, {
name = 0x7fffeb6a434d "XdndActionPrivate", atom = 0x0, action =
GDK_ACTION_COPY}}
_gdk_old_error_handler = 0x7fffeb68b2e0 <gdk_x_error>
xdnd_actions_initialized = 0
grab_keys = {{keysym = 65307, modifiers = 0}, {keysym = 32, modifiers =
0}, {keysym = 65408, modifiers = 0}, {keysym = 65293, modifiers = 0}, {keysym =
65421, modifiers = 0}, {keysym = 65362,
modifiers = 0}, {keysym = 65362, modifiers = 8}, {keysym = 65364,
modifiers = 0}, {keysym = 65364, modifiers = 8}, {keysym = 65361, modifiers =
0}, {keysym = 65361, modifiers = 8}, {
keysym = 65363, modifiers = 0}, {keysym = 65363, modifiers = 8},
{keysym = 65431, modifiers = 0}, {keysym = 65431, modifiers = 8}, {keysym =
65433, modifiers = 0}, {keysym = 65433, modifiers = 8},
{keysym = 65430, modifiers = 0}, {keysym = 65430, modifiers = 8},
{keysym = 65432, modifiers = 0}, {keysym = 65432, modifiers = 8}}
--Type <RET> for more, q to quit, c to continue without paging--
owner_list = 0x5555577fb4b0
gdk_x11_gl_context_parent_class = 0x0
xdnd_filters = {{atom_name = 0x7fffeb6a41e6 "XdndEnter", func =
0x7fffeb681c30 <xdnd_enter_filter>}, {atom_name = 0x7fffeb6a40f2 "XdndLeave",
func = 0x7fffeb6807d0 <xdnd_leave_filter>}, {
atom_name = 0x7fffeb6a41f0 "XdndPosition", func = 0x7fffeb6808d0
<xdnd_position_filter>}, {atom_name = 0x7fffeb6a40e7 "XdndStatus", func =
0x7fffeb6805c0 <xdnd_status_filter>}, {
atom_name = 0x7fffeb6a410f "XdndFinished", func = 0x7fffeb6806f0
<xdnd_finished_filter>}, {atom_name = 0x7fffeb6a40fc "XdndDrop", func =
0x7fffeb680a70 <xdnd_drop_filter>}}
signals = {14}
event_funcs = {prepare = 0x7fffeb67fa30 <gdk_event_source_prepare>,
check = 0x7fffeb67fab0 <gdk_event_source_check>, dispatch = 0x7fffeb684bc0
<gdk_event_source_dispatch.lto_priv>,
finalize = 0x7fffeb67b390 <gdk_event_source_finalize>,
closure_callback = 0x0, closure_marshal = 0x0}
gdk_x11_drag_context_parent_class = 0x0
gdk_sm_client_id = 0x0
precache_atoms = {0x7fffeb6a2453 "UTF8_STRING", 0x7fffeb6a435f
"WM_CLIENT_LEADER", 0x7fffeb6a3ff3 "WM_DELETE_WINDOW", 0x7fffeb6a43e9
"WM_ICON_NAME", 0x7fffeb6a4370 "WM_LOCALE_NAME",
0x7fffeb6a43fb "WM_NAME", 0x7fffeb6a3fe6 "WM_PROTOCOLS",
0x7fffeb6a4004 "WM_TAKE_FOCUS", 0x7fffeb6a437f "WM_WINDOW_ROLE", 0x7fffeb6a438e
"_NET_ACTIVE_WINDOW", 0x7fffeb6a43a1 "_NET_CURRENT_DESKTOP",
0x7fffeb6a43b6 "_NET_FRAME_EXTENTS", 0x7fffeb6a3f32
"_NET_STARTUP_ID", 0x7fffeb6a43c9 "_NET_WM_CM_S0", 0x7fffeb6a3f8a
"_NET_WM_DESKTOP", 0x7fffeb6a43d7 "_NET_WM_ICON",
0x7fffeb6a43e4 "_NET_WM_ICON_NAME", 0x7fffeb6a43f6 "_NET_WM_NAME",
0x7fffeb6a4097 "_NET_WM_PID", 0x7fffeb6a4012 "_NET_WM_PING", 0x7fffeb6a4279
"_NET_WM_STATE", 0x7fffeb6a4403 "_NET_WM_STATE_ABOVE",
0x7fffeb6a4417 "_NET_WM_STATE_BELOW", 0x7fffeb6a42d6
"_NET_WM_STATE_FULLSCREEN", 0x7fffeb6a4264 "_NET_WM_STATE_HIDDEN",
0x7fffeb6a442b "_NET_WM_STATE_MODAL",
0x7fffeb6a429c "_NET_WM_STATE_MAXIMIZED_VERT", 0x7fffeb6a42b9
"_NET_WM_STATE_MAXIMIZED_HORZ", 0x7fffeb6a443f "_NET_WM_STATE_SKIP_TASKBAR",
0x7fffeb6a445a "_NET_WM_STATE_SKIP_PAGER",
0x7fffeb6a4287 "_NET_WM_STATE_STICKY", 0x7fffeb6a401f
"_NET_WM_SYNC_REQUEST", 0x7fffeb6a4473 "_NET_WM_SYNC_REQUEST_COUNTER",
0x7fffeb6a4490 "_NET_WM_WINDOW_TYPE",
0x7fffeb6a44a4 "_NET_WM_WINDOW_TYPE_COMBO", 0x7fffeb6a44be
"_NET_WM_WINDOW_TYPE_DIALOG", 0x7fffeb6a44d9 "_NET_WM_WINDOW_TYPE_DND",
0x7fffeb6a8fb0 "_NET_WM_WINDOW_TYPE_DROPDOWN_MENU",
0x7fffeb6a44f1 "_NET_WM_WINDOW_TYPE_MENU", 0x7fffeb6a450a
"_NET_WM_WINDOW_TYPE_NORMAL", 0x7fffeb6a8fd8 "_NET_WM_WINDOW_TYPE_POPUP_MENU",
0x7fffeb6a4525 "_NET_WM_WINDOW_TYPE_TOOLTIP",
0x7fffeb6a4541 "_NET_WM_WINDOW_TYPE_UTILITY", 0x7fffeb6a455d
"_NET_WM_USER_TIME", 0x7fffeb6a456f "_NET_WM_USER_TIME_WINDOW", 0x7fffeb6a4588
"_NET_VIRTUAL_ROOTS", 0x7fffeb6a3aaa "GDK_SELECTION",
0x7fffeb6a42ef "_NET_WM_STATE_FOCUSED", 0x7fffeb6a459b "GDK_VISUALS"}
GdkX11GLContext_private_offset = 0
GdkX11DragContext_private_offset = 0
GdkX11Display_private_offset = 0
GdkX11DisplayManager_private_offset = 0
window_caches = 0x0
_gdk_error_handler_push_count = 1
#25 0x00007fffeff061e4 in ?? () from /usr/lib/libglib-2.0.so.0
No symbol table info available.
#26 0x00007fffeff69e97 in ?? () from /usr/lib/libglib-2.0.so.0
No symbol table info available.
#27 0x00007fffeff05615 in g_main_context_iteration () from
/usr/lib/libglib-2.0.so.0
No symbol table info available.
#28 0x00007fffeaefbba3 in GtkSalData::Yield(bool, bool) () from
/home/seeh/projects/libreoffice/libreoffice-core/instdir/program/libvclplug_gtk3lo.so
No symbol table info available.
#29 0x00007ffff29cb4d9 in ImplYield(bool, bool) () from
/home/seeh/projects/libreoffice/libreoffice-core/instdir/program/libvcllo.so
No symbol table info available.
#30 0x00007ffff29cbe7b in Application::Execute() () from
/home/seeh/projects/libreoffice/libreoffice-core/instdir/program/libvcllo.so
No symbol table info available.
#31 0x00007ffff7e813de in desktop::Desktop::Main() () from
/home/seeh/projects/libreoffice/libreoffice-core/instdir/program/libsofficeapp.so
No symbol table info available.
#32 0x00007ffff29d52d2 in ImplSVMain() () from
/home/seeh/projects/libreoffice/libreoffice-core/instdir/program/libvcllo.so
No symbol table info available.
#33 0x00007ffff7ea755b in soffice_main () from
/home/seeh/projects/libreoffice/libreoffice-core/instdir/program/libsofficeapp.so
No symbol table info available.
#34 0x000055555555506e in main ()
No symbol table info available.
(gdb)
--
You are receiving this mail because:
You are the assignee for the bug.
