https://bugs.freedesktop.org/show_bug.cgi?id=79704
Priority: medium
Bug ID: 79704
Assignee: [email protected]
Summary: Calc crashes while sorting table
Severity: major
Classification: Unclassified
OS: Linux (All)
Reporter: [email protected]
Hardware: x86-64 (AMD64)
Status: UNCONFIRMED
Version: 4.2.4.2 release
Component: Database
Product: LibreOffice
LibreOffice on Debian Jessie amd64, package version 1:4.2.4-4
Calc crashes sometimes when sorting a table with autofilter enabled. I cannot
reproduce it reliably.
Full backtrace:
#0 intrusive_ptr_release (p=0x31) at
/build/libreoffice-UGxupn/libreoffice-4.2.4/sc/inc/formulacell.hxx:97
No locals.
#1 ~intrusive_ptr (this=<optimized out>, __in_chrg=<optimized out>) at
/usr/include/boost/smart_ptr/intrusive_ptr.hpp:97
No locals.
#2 operator= (rhs=..., this=<optimized out>) at
/usr/include/boost/smart_ptr/intrusive_ptr.hpp:129
No locals.
#3 ScFormulaCell::SetCellGroup (this=0x34b38f0, xRef=...) at
/build/libreoffice-UGxupn/libreoffice-4.2.4/sc/source/core/data/formulacell.cxx:3552
No locals.
#4 0x00007f7dcaa56b93 in sc::SharedFormulaUtil::unshareFormulaCell (aPos=...,
rCell=...) at
/build/libreoffice-UGxupn/libreoffice-4.2.4/sc/source/core/tool/sharedformula.cxx:284
rCell2 = <optimized out>
xGroup2 = {px = 0x2b93710}
rNext = <optimized out>
itCell =
itCellEnd =
xGroup = {px = 0x2b8a020}
nEndRow = <optimized out>
nLength2 = <optimized out>
xNone = {px = 0x0}
it = <optimized out>
#5 0x00007f7dca81feb0 in ScColumn::DetachFormulaCell
(this=this@entry=0x2702d30, aPos=..., rCell=...) at
/build/libreoffice-UGxupn/libreoffice-4.2.4/sc/source/core/data/column3.cxx:338
No locals.
#6 0x00007f7dca7ca96e in ScColumn::SwapRow (this=this@entry=0x2702d30,
nRow1=nRow1@entry=38, nRow2=nRow2@entry=43)
at
/build/libreoffice-UGxupn/libreoffice-4.2.4/sc/source/core/data/column.cxx:1095
pNew = 0x7fff80a5bb60
aCell2 = {meType = CELLTYPE_VALUE, {mfValue = 2656.4499999999998,
mpString = 0x40a4c0e666666666, mpEditText = 0x40a4c0e666666666, mpFormula =
0x40a4c0e666666666}}
aPos2 = {
first =
{<mdds::__mtv::iterator_common_base<mdds::multi_type_vector<mdds::mtv::custom_block_func3<mdds::mtv::default_element_block<52,
svl::SharedString>, mdds::mtv::noncopyable_managed_element_block<53,
EditTextObject>, mdds::mtv::noncopyable_managed_element_block<54,
ScFormulaCell> > >::iterator_trait>> = {m_cur_node = {type = 0, position = 42,
size = 2,
data = 0x2bac250, __private_data = {block_index = 13}}, m_pos =
, m_end = }, <No data fields>}, second = 1}
it2 = <optimized out>
aCell1 = {meType = CELLTYPE_FORMULA, {mfValue =
2.2553124411461889e-316, mpString = 0x2b888a0, mpEditText = 0x2b888a0,
mpFormula = 0x2b888a0}}
aPos1 = {
first =
{<mdds::__mtv::iterator_common_base<mdds::multi_type_vector<mdds::mtv::custom_block_func3<mdds::mtv::default_element_block<52,
svl::SharedString>, mdds::mtv::noncopyable_managed_element_block<53,
EditTextObject>, mdds::mtv::noncopyable_managed_element_block<54,
ScFormulaCell> > >::iterator_trait>> = {m_cur_node = {type = 54, position = 33,
size = 7,
data = 0x3377f20, __private_data = {block_index = 10}}, m_pos =
, m_end = }, <No data fields>}, second = 5}
aRows = std::vector of length 2, capacity 2 = {38, 43}
it1 =
{<mdds::__mtv::iterator_common_base<mdds::multi_type_vector<mdds::mtv::custom_block_func3<mdds::mtv::default_element_block<52,
svl::SharedString>, mdds::mtv::noncopyable_managed_element_block<53,
EditTextObject>, mdds::mtv::noncopyable_managed_element_block<54,
ScFormulaCell> > >::iterator_trait>> = {m_cur_node = {type = 54, position = 33,
size = 7,
data = 0x3377f20, __private_data = {block_index = 10}}, m_pos = ,
m_end = }, <No data fields>}
#7 0x00007f7dca9451ad in ScTable::SwapRow (this=this@entry=0x2702830,
nRow1=nRow1@entry=38, nRow2=nRow2@entry=43)
at
/build/libreoffice-UGxupn/libreoffice-4.2.4/sc/source/core/data/table3.cxx:570
nCol = 8
nColStart = <optimized out>
nColEnd = 1023
#8 0x00007f7dca9453df in ScTable::SortReorder (this=0x2702830,
pArray=<optimized out>, pProgress=0x7fff80a5c010)
at
/build/libreoffice-UGxupn/libreoffice-4.2.4/sc/source/core/data/table3.cxx:360
p = <optimized out>
nOrg = 43
nPos = 31
bByRow = true
aTable = std::vector of length 0, capacity 48
nDest = 38
#9 0x00007f7dca945983 in ScTable::Sort (this=0x2702830, rSortParam=...,
bKeepQuery=<optimized out>, pProgress=0x7fff80a5c010)
at
/build/libreoffice-UGxupn/libreoffice-4.2.4/sc/source/core/data/table3.cxx:669
pArray = 0x3438e30
nLastRow = 54
nRow1 = 7
#10 0x00007f7dca85a733 in ScDocument::Sort (this=0x26c61b0, nTab=-30400,
rSortParam=..., bKeepQuery=8, bKeepQuery@entry=false, pProgress=0x1,
pProgress@entry=0x7fff80a5c010)
at
/build/libreoffice-UGxupn/libreoffice-4.2.4/sc/source/core/data/documen3.cxx:1363
No locals.
#11 0x00007f7dcabb69b5 in ScDBDocFunc::Sort (this=this@entry=0x7fff80a5c0c0,
nTab=0, rSortParam=..., bRecord=<optimized out>, bPaint=bPaint@entry=1 '\001',
bApi=bApi@entry=0 '\000')
at
/build/libreoffice-UGxupn/libreoffice-4.2.4/sc/source/ui/docshell/dbdocfun.cxx:578
aProgress = {static pGlobalProgress = 0x31ad570, static nGlobalRange =
47, static nGlobalPercent = 63, static bGlobalNoUserBreak = 1 '\001',
static pInterpretProgress = 0x7f7dcb36d320
<theDummyInterpretProgress>, static pOldInterpretProgress = 0x0, static
nInterpretProgress = 0,
static bAllowInterpretProgress = 1 '\001', static pInterpretDoc =
0x0, static bIdleWasEnabled = false, pProgress = 0x31ad570}
pDoc = 0x26c61b0
aOldDest = {aStart = {nRow = 0, nCol = 0, nTab = 0, static detailsOOOa1
= {eConv = formula::FormulaGrammar::CONV_OOO, nRow = 0, nCol = 0}}, aEnd =
{nRow = 0, nCol = 0, nTab = 0,
static detailsOOOa1 = {eConv = formula::FormulaGrammar::CONV_OOO,
nRow = 0, nCol = 0}}}
pDrawLayer = 0x298fcf0
aWait = {mpWindow = 0x2b6e730}
aQueryParam = {<ScQueryParamBase> = {_vptr.ScQueryParamBase =
0x7f7dcb2d2290 <vtable for ScQueryParam+16>, bHasHeader = false, bByRow = true,
bInplace = true, bCaseSens = false,
bRegExp = false, bDuplicate = true, mbRangeLookup = false,
maEntries = {<boost::ptr_sequence_adapter<ScQueryEntry,
std::vector<void*, std::allocator<void*> >, boost::heap_clone_allocator>> =
{<boost::ptr_container_detail::reversible_ptr_container<boost::ptr_container_detail::sequence_config<ScQueryEntry,
std::vector<void*, std::allocator<void*> > >, boost::heap_clone_allocator>> =
{static allow_null = false,
c_ = std::vector of length 8, capacity 8 = {0x33c8f00,
0x33cfd20, 0x33cfd90, 0x33cfe00, 0x33cfe70, 0x2ef0480, 0x2ef04c0,
0x2ef0530}}, <No data fields>}, <No data fields>}},
<ScQueryParamTable> = {_vptr.ScQueryParamTable = 0x7f7dcb2d22b8 <vtable for
ScQueryParam+56>, nCol1 = 0,
nRow1 = 7, nCol2 = 1023, nRow2 = 54, nTab = 0}, bDestPers = true,
nDestTab = 0, nDestCol = 0, nDestRow = 0}
pUndoAction = 0x34b3600
aModificator = {rDocShell = @0x26c60f0, mpProtector = {px = 0x33c8fb0},
bAutoCalcShellDisabled = false, bIdleEnabled = true}
nSrcTab = <optimized out>
bCopy = 0 '\000'
aLocalParam = {nCol1 = 0, nRow1 = 7, nCol2 = 1023, nRow2 = 54,
nUserIndex = 0, bHasHeader = false, bByRow = true, bCaseSens = false,
bNaturalSort = false, bUserDef = false,
bIncludePattern = true, bInplace = true, nDestTab = 0, nDestCol = 0,
nDestRow = 0, maKeyState = std::vector of length 3, capacity 3 = {{bDoSort =
true, nField = 5,
bAscending = true}, {bDoSort = false, nField = 0, bAscending =
true}, {bDoSort = false, nField = 0, bAscending = true}}, aCollatorLocale =
{Language = {
pData = 0x7f7dfce09140}, Country = {pData = 0x7f7dfce09140},
Variant = {pData = 0x7f7dfce09140}}, aCollatorAlgorithm = {pData =
0x7f7dfce09140}, nCompatHeader = 2}
bSave = <optimized out>
pDBData = 0x337b1e0
pDestData = 0x0
aTester = {mbIsEditable = true, mbOnlyMatrix = true}
bRepeatQuery = 0 '\000'
aDirtyRange = {aStart = {nRow = 275, nCol = 439, nTab = 0, static
detailsOOOa1 = {eConv = formula::FormulaGrammar::CONV_OOO, nRow = 0, nCol =
0}}, aEnd = {nRow = -340116730,
nCol = 0, nTab = 0, static detailsOOOa1 = {eConv =
formula::FormulaGrammar::CONV_OOO, nRow = 0, nCol = 0}}}
#12 0x00007f7dcadff192 in ScDBFunc::Sort (this=this@entry=0x298cff0,
rSortParam=..., bRecord=<optimized out>, bPaint=bPaint@entry=1 '\001')
at
/build/libreoffice-UGxupn/libreoffice-4.2.4/sc/source/ui/view/dbfunc.cxx:281
aDBDocFunc = {rDocShell = @0x26c60f0}
bSuccess = <optimized out>
#13 0x00007f7dcadff288 in ScDBFunc::UISort (this=this@entry=0x298cff0,
rSortParam=..., bRecord=bRecord@entry=1 '\001')
at
/build/libreoffice-UGxupn/libreoffice-4.2.4/sc/source/ui/view/dbfunc.cxx:272
aSubTotalParam = {nCol1 = 0, nRow1 = 7, nCol2 = 1023, nRow2 = 54,
nUserIndex = 0, bRemoveOnly = false, bReplace = true, bPagebreak = false,
bCaseSens = false, bDoSort = true,
bAscending = true, bUserDef = false, bIncludePattern = false,
bGroupActive = {false, false, false}, nField = {0, 0, 0}, nSubTotals = {0, 0,
0}, pSubTotals = {0x0, 0x0, 0x0},
pFunctions = {0x0, 0x0, 0x0}}
pDBData = 0x337b1e0
#14 0x00007f7dcadf9915 in ScCellShell::ExecuteDB (this=0x2918d30, rReq=...) at
/build/libreoffice-UGxupn/libreoffice-4.2.4/sc/source/ui/view/cellsh2.cxx:497
pOutSet = <optimized out>
pDoc = <optimized out>
aArgSet = {_vptr.SfxItemSet = 0x7f7dfa337850 <vtable for
SfxItemSet+16>, _pPool = 0x269c230, _pParent = 0x0, _aItems = 0x3209670,
_pWhichRanges = 0x2e8c9f0, _nCount = 1}
pDlg = 0x3062400
bHasHeader = <optimized out>
pFact = <optimized out>
aSortParam = {nCol1 = 0, nRow1 = 7, nCol2 = 1023, nRow2 = 54,
nUserIndex = 0, bHasHeader = false, bByRow = true, bCaseSens = false,
bNaturalSort = false, bUserDef = false,
bIncludePattern = true, bInplace = true, nDestTab = 0, nDestCol = 0,
nDestRow = 0, maKeyState = std::vector of length 3, capacity 3 = {{bDoSort =
false, nField = 0,
bAscending = true}, {bDoSort = false, nField = 0, bAscending =
true}, {bDoSort = false, nField = 0, bAscending = true}}, aCollatorLocale =
{Language = {
pData = 0x7f7dfce09140}, Country = {pData = 0x7f7dfce09140},
Variant = {pData = 0x7f7dfce09140}}, aCollatorAlgorithm = {pData =
0x7f7dfce09140}, nCompatHeader = 2}
pDBData = <optimized out>
pScMod = <optimized out>
#15 0x00007f7dfa75bef6 in SfxShell::CallExec (this=0x2918d30,
pFunc=0x7f7dcade93a0 <SfxStubScCellShellExecuteDB(SfxShell*, SfxRequest&)>,
rReq=...)
at /build/libreoffice-UGxupn/libreoffice-4.2.4/include/sfx2/shell.hxx:181
No locals.
#16 0x00007f7dfa7554ec in SfxDispatcher::Call_Impl (this=0x28bdc10, rShell=...,
rSlot=..., rReq=..., bRecord=1 '\001')
at
/build/libreoffice-UGxupn/libreoffice-4.2.4/sfx2/source/control/dispatch.cxx:220
bThisDispatcherAlive = 1 '\001'
pOldInCallAliveFlag = 0x0
pFunc = 0x7f7dcade93a0 <SfxStubScCellShellExecuteDB(SfxShell*,
SfxRequest&)>
bAutoUpdate = 0 '\000'
#17 0x00007f7dfa7570af in SfxDispatcher::_Execute (this=0x28bdc10, rShell=...,
rSlot=..., rReq=..., eCallMode=4)
at
/build/libreoffice-UGxupn/libreoffice-4.2.4/sfx2/source/control/dispatch.cxx:899
No locals.
#18 0x00007f7dfa500dcd in SfxBindings::Execute_Impl (this=0x26ac880, aReq=...,
pSlot=pSlot@entry=0x7f7dcb35e608 <aScCellShellSlots_Impl+16680>,
pShell=pShell@entry=0x2918d30)
at
/build/libreoffice-UGxupn/libreoffice-4.2.4/sfx2/source/control/bindings.cxx:1293
No locals.
#19 0x00007f7dfa534294 in SfxDispatchController_Impl::dispatch (this=0x31acd60,
aURL=..., aArgs=..., rListener=...)
at
/build/libreoffice-UGxupn/libreoffice-4.2.4/sfx2/source/control/unoctitm.cxx:733
aReq = {<SfxHint> = {_vptr.SfxHint = 0x7f7dfaa2cc10 <vtable for
SfxRequest+16>}, nSlot = 26324, pArgs = 0x0, pImp = 0x31a9550}
xSet = {px = 0x0}
pSlot = 0x7f7dcb35e608 <aScCellShellSlots_Impl+16680>
aInternalSet = {<SfxItemSet> = {_vptr.SfxItemSet = 0x7f7dfa337910
<vtable for SfxAllItemSet+16>, _pPool = 0x23af7c0, _pParent = 0x0, _aItems =
0x2ea2320,
_pWhichRanges = 0x3364b70, _nCount = 1}, aDefault = {<SfxPoolItem>
= {_vptr.SfxPoolItem = 0x7f7dfa337cb0 <vtable for SfxVoidItem+16>, m_nRefCount
= 0, m_nWhich = 0,
m_nKind = 0}, <No data fields>}, nFree = 8}
pShell = 0x2918d30
lNewArgs = {_pSequence = 0x7f7dfb5e83ac, static s_pType = 0x2298d20}
nCall = <optimized out>
nModifier = <optimized out>
aAddArgs = std::vector of length 0, capacity 0
xFrameRef = {<com::sun::star::uno::BaseReference> = {_pInterface =
0x29b9558}, <No data fields>}
pItem = 0x0
eMapUnit = SFX_MAPUNIT_100TH_MM
nMarkArg = <optimized out>
nAddArgs = <optimized out>
bSuccess = 0 '\000'
aURLObj = {m_aAbsURIRef = {pData = 0x2bb12e0, nCapacity = 13},
m_aScheme = {m_nBegin = 0, m_nLength = 4}, m_aUser = {m_nBegin = -1, m_nLength
= 0}, m_aAuth = {m_nBegin = -1,
m_nLength = 0}, m_aHost = {m_nBegin = -1, m_nLength = 0}, m_aPort =
{m_nBegin = -1, m_nLength = 0}, m_aPath = {m_nBegin = 5, m_nLength = 8},
m_aQuery = {m_nBegin = -1,
m_nLength = 0}, m_aFragment = {m_nBegin = -1, m_nLength = 0},
m_eScheme = INET_PROT_UNO, m_eSmartScheme = INET_PROT_HTTP}
bTemp = <optimized out>
aGuard = {m_solarMutex = @0x1719600}
#20 0x00007f7dfa535772 in SfxOfficeDispatch::dispatch (this=0x31b0de0,
aURL=..., aArgs=...) at
/build/libreoffice-UGxupn/libreoffice-4.2.4/sfx2/source/control/unoctitm.cxx:359
layer = {m_aEnvTypeName = {pData = 0x335bb30}, m_xPreviousContext =
{<com::sun::star::uno::BaseReference> = {_pInterface = 0x2493b90}, <No data
fields>}}
#21 0x00007f7ddda27d84 in framework::MenuBarManager::Select (this=0x2b3a740,
pMenu=<optimized out>)
at
/build/libreoffice-UGxupn/libreoffice-4.2.4/framework/source/uielement/menubarmanager.cxx:1087
nRef = 2
aTargetURL = {Complete = {pData = 0x2bc3f90}, Main = {pData =
0x2bbf790}, Protocol = {pData = 0x2bb9dd0}, User = {pData = 0x7f7dfce09140},
Password = {pData = 0x7f7dfce09140},
Server = {pData = 0x7f7dfce09140}, Port = 0, Path = {pData =
0x2e908f0}, Name = {pData = 0x7f7dfce09140}, Arguments = {pData =
0x7f7dfce09140}, Mark = {pData = 0x7f7dfce09140}}
aArgs = {_pSequence = 0x7f7dfb5e83ac, static s_pType = 0x2298d20}
xDispatch = {<com::sun::star::uno::BaseReference> = {_pInterface =
0x31b0e08}, <No data fields>}
#22 0x00007f7df886ffcb in Call (pCaller=0x2a9ed70, this=0x2a9edd8) at
/build/libreoffice-UGxupn/libreoffice-4.2.4/include/tools/link.hxx:123
No locals.
#23 Menu::Select (this=0x2a9ed70) at
/build/libreoffice-UGxupn/libreoffice-4.2.4/vcl/source/window/menu.cxx:1157
aDelData = {mpNext = 0x0, mpMenu = 0x2a9ed70}
#24 0x00007f7df886a1b5 in ImplCallSelect (this=<optimized out>) at
/build/libreoffice-UGxupn/libreoffice-4.2.4/vcl/source/window/menu.cxx:3004
No locals.
#25 Menu::LinkStubImplCallSelect (pThis=<optimized out>, pCaller=<optimized
out>) at
/build/libreoffice-UGxupn/libreoffice-4.2.4/vcl/source/window/menu.cxx:3001
No locals.
#26 0x00007f7df88db5f4 in Call (pCaller=<optimized out>, this=<optimized out>)
at /build/libreoffice-UGxupn/libreoffice-4.2.4/include/tools/link.hxx:123
No locals.
#27 ImplHandleUserEvent (pSVEvent=0x2ea9940) at
/build/libreoffice-UGxupn/libreoffice-4.2.4/vcl/source/window/winproc.cxx:1976
No locals.
#28 ImplWindowFrameProc (pWindow=<optimized out>, nEvent=<optimized out>,
pEvent=0x2ea9940) at
/build/libreoffice-UGxupn/libreoffice-4.2.4/vcl/source/window/winproc.cxx:2591
nRet = 0
#29 0x00007f7df88e1f38 in CallCallback (pEvent=0x2ea9940, nEvent=22,
this=0x23b2520) at
/build/libreoffice-UGxupn/libreoffice-4.2.4/vcl/inc/salframe.hxx:243
No locals.
#30 SalGenericDisplay::DispatchInternalEvent (this=0x2240a60) at
/build/libreoffice-UGxupn/libreoffice-4.2.4/vcl/generic/app/gendisp.cxx:91
pData = 0x2ea9940
pFrame = 0x23b2520
nEvent = 22
#31 0x00007f7dec2f638f in GtkData::userEventFn (data=data@entry=0x172ec20) at
/build/libreoffice-UGxupn/libreoffice-4.2.4/vcl/unx/gtk/app/gtkdata.cxx:935
bContinue = 1
aGuard = {pT = 0x1719600}
pThis = 0x172ec20
pData = <optimized out>
#32 0x00007f7dec2f6401 in call_userEventFn (data=0x172ec20) at
/build/libreoffice-UGxupn/libreoffice-4.2.4/vcl/unx/gtk/app/gtkdata.cxx:945
The ScFormulaCellGroupRef passed by SharedFormulaUtil::unshareFormulaCell()
appears to be corrupted. It is the local variable called "xGroup2", which lives
on the stack. Maybe some kind of stack corruption / buffer overflow?
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
Libreoffice-bugs mailing list
[email protected]
http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs
