Bug 1080196

Summary: [abrt] libreoffice-core: mdds/multi_type_vector_itr.hpp update_node(): soffice.bin killed by SIGSEGV
Product: [Fedora] Fedora Reporter: Fiorenzo <fiod3s>
Component: libreofficeAssignee: -RETIRED- <erack>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 20CC: caolanm, dtardon, erack, ltinkl, mstahl, sbergman
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
URL: https://retrace.fedoraproject.org/faf/reports/bthash/658050b3611ed00cfacbfd769bbf37d3c515b830
Whiteboard: abrt_hash:88401ffeea3be92d3e149a9fcca6f2ba9445ec5e
Fixed In Version: libreoffice-4.2.3.2-2.fc20 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-04-11 08:02:37 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: backtrace
none
File: cgroup
none
File: core_backtrace
none
File: dso_list
none
File: environ
none
File: exploitable
none
File: limits
none
File: maps
none
File: open_fds
none
File: proc_pid_status
none
File: var_log_messages
none
xls file to help reproducing the bug (copy)
none
ods file to help reproducing the bug (paste) none

Description Fiorenzo 2014-03-24 21:33:00 UTC 
Description of problem:
it crashed while pasting data from a .xls file to a .ods file by using "Paste special..." with "Selection" option = "Numbers"

then I used "Selection" = "Text", "Numbers", "Date & Time", "Formulas", "Comments" and "Objects" so it didn't crash anymore

Version-Release number of selected component:
libreoffice-core-4.2.2.1-7.fc20

Additional info:
reporter:       libreport-2.2.0
backtrace_rating: 4
cmdline:        /usr/lib64/libreoffice/program/soffice.bin --calc '/home/kensh1n/Documents/Academic World/Laboratorio SxS/Pubblicazioni/Mentha/results2.ods' --splash-pipe=5
crash_function: update_node
executable:     /usr/lib64/libreoffice/program/soffice.bin
kernel:         3.13.6-200.fc20.x86_64
runlevel:       N 5
type:           CCpp
uid:            1000

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 update_node at /usr/include/mdds/multi_type_vector_itr.hpp:171
 #1 iterator_common_base at /usr/include/mdds/multi_type_vector_itr.hpp:152
 #2 const_iterator_base at /usr/include/mdds/multi_type_vector_itr.hpp:355
 #3 mdds::multi_type_vector<mdds::mtv::custom_block_func3<mdds::mtv::default_element_block<52, svl::SharedString>, mdds::mtv::noncopyable_managed_element_block<53, EditTextObject>, mdds::mtv::noncopyable_managed_element_block<54, ScFormulaCell> > >::position at /usr/include/mdds/multi_type_vector_def.inl:1225
 #4 ScColumn::GetPositionToInsert at /usr/src/debug/libreoffice-4.2.2.1/sc/source/core/data/column3.cxx:379
 #5 ScColumn::SetValue at /usr/src/debug/libreoffice-4.2.2.1/sc/source/core/data/column3.cxx:2306
 #6 operator() at /usr/src/debug/libreoffice-4.2.2.1/sc/source/core/data/column3.cxx:782
 #7 ParseBlock<mdds::multi_type_vector<mdds::mtv::custom_block_func3<mdds::mtv::default_element_block<52, svl::SharedString>, mdds::mtv::noncopyable_managed_element_block<53, EditTextObject>, mdds::mtv::noncopyable_managed_element_block<54, ScFormulaCell> > >, (anonymous namespace)::CopyCellsFromClipHandler> at /usr/src/debug/libreoffice-4.2.2.1/sc/inc/mtvfunctions.hxx:56
 #8 ScColumn::CopyFromClip at /usr/src/debug/libreoffice-4.2.2.1/sc/source/core/data/column3.cxx:1001
 #9 ScTable::CopyFromClip at /usr/src/debug/libreoffice-4.2.2.1/sc/source/core/data/table2.cxx:663
Comment 1 Fiorenzo 2014-03-24 21:33:15 UTC 
Created attachment 878175 [details]
File: backtrace
Comment 2 Fiorenzo 2014-03-24 21:33:18 UTC 
Created attachment 878176 [details]
File: cgroup
Comment 3 Fiorenzo 2014-03-24 21:33:22 UTC 
Created attachment 878177 [details]
File: core_backtrace
Comment 4 Fiorenzo 2014-03-24 21:33:26 UTC 
Created attachment 878178 [details]
File: dso_list
Comment 5 Fiorenzo 2014-03-24 21:33:28 UTC 
Created attachment 878179 [details]
File: environ
Comment 6 Fiorenzo 2014-03-24 21:33:30 UTC 
Created attachment 878180 [details]
File: exploitable
Comment 7 Fiorenzo 2014-03-24 21:33:33 UTC 
Created attachment 878181 [details]
File: limits
Comment 8 Fiorenzo 2014-03-24 21:34:14 UTC 
Created attachment 878182 [details]
File: maps
Comment 9 Fiorenzo 2014-03-24 21:34:16 UTC 
Created attachment 878183 [details]
File: open_fds
Comment 10 Fiorenzo 2014-03-24 21:34:18 UTC 
Created attachment 878184 [details]
File: proc_pid_status
Comment 11 Fiorenzo 2014-03-24 21:34:21 UTC 
Created attachment 878185 [details]
File: var_log_messages
Comment 12 Caolan McNamara 2014-03-25 11:54:05 UTC 
caolanm->erack: bt looks like something kohei would be interested in
Comment 13 -RETIRED- 2014-03-25 14:23:30 UTC 
@Fiorenzo:
Do you have a reproducible test case you could attach the files of along with a description of which cells to copy from where to where to reproduce? It is likely that this was fixed upstream for the 4.2.3 or 4.2.4 release.
Comment 14 Fiorenzo 2014-03-25 20:10:22 UTC 
Created attachment 878668 [details]
xls file to help reproducing the bug (copy)
Comment 15 Fiorenzo 2014-03-25 20:11:15 UTC 
Created attachment 878669 [details]
ods file to help reproducing the bug (paste)
Comment 16 Fiorenzo 2014-03-25 20:14:04 UTC 
Yes, I have!

copy B20:C20;B32:C32;B44:C44 together from "24ore" sheet of file1.xls and then paste them into E93 of "MTT_2nd" sheet of file2.ods by using "Paste Special..." with only "Numbers" selected
Comment 17 -RETIRED- 2014-03-27 20:45:18 UTC 
Ha, great! Thanks!
The bad news is it still crashes in current master..
Comment 18 David Tardon 2014-03-31 06:58:29 UTC 
Kohei fixed it
Comment 19 -RETIRED- 2014-03-31 10:34:35 UTC 
Fix should be available with LibreOffice 4.2.4 as per http://cgit.freedesktop.org/libreoffice/core/commit/?h=libreoffice-4-2&id=9ae833b62956a6d86772e2d2bf83a7391f322b00
Comment 20 -RETIRED- 2014-04-10 15:06:46 UTC 
Actually already available with libreoffice-4.2.3.2-2.fc20