Bug 66984 - EDITING: PIVOT TABLE, crash moving a row field to a column field.
Summary: EDITING: PIVOT TABLE, crash moving a row field to a column field.
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
4.1.0.0.alpha1
Hardware: Other Windows (All)
: medium critical
Assignee: Kohei Yoshida
URL:
Whiteboard: target:4.3.0 target:4.2.0.1 target:4.1.5
Keywords: regression
: 68819 (view as bug list)
Depends on:
Blocks:
 
Reported: 2013-07-17 00:32 UTC by m_a_riosv
Modified: 2013-12-08 16:53 UTC (History)
6 users (show)

See Also:
Crash report or crash signature:


Attachments
Sample GETPIVOTDATA moving field crash. (15.38 KB, application/vnd.oasis.opendocument.spreadsheet)
2013-07-17 00:32 UTC, m_a_riosv
Details
console + bt with symbols on master sources (5.26 KB, text/plain)
2013-07-21 08:25 UTC, Julien Nabet
Details
Test file to reproduce the crash (8.10 KB, application/vnd.oasis.opendocument.spreadsheet)
2013-10-02 16:54 UTC, Laurent Balland
Details
console + bt from make debugrun (15.28 KB, text/plain)
2013-10-03 19:20 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description m_a_riosv 2013-07-17 00:32:11 UTC
Created attachment 82513 [details]
Sample GETPIVOTDATA moving field crash.

Win7x64Ultimate
Version: 4.2.0.0.alpha0+
Build ID: 22fa63a4fac7e86bc199092c48f0d2954435bf46

1. Open attached file
2. Drag day_nu field to column fields.
3. Answer No to overwrite destination range.
4. Right-click in DataPilot / Refresh -> crash.

Not reproducible.
Version 4.0.4.2 (Build ID: 9e9821abd0ffdbc09cd8c52eaa574fa09eb08f2)
Comment 1 Julien Nabet 2013-07-21 08:18:42 UTC
Comment on attachment 82513 [details]
Sample GETPIVOTDATA moving field crash.

Mimetype fixed
Comment 2 Julien Nabet 2013-07-21 08:25:24 UTC
Created attachment 82764 [details]
console + bt with symbols on master sources

On pc Debian x86-64 with master sources updated today I had a crash but not at the same moment.
Comment 3 Julien Nabet 2013-07-21 08:27:36 UTC
Kohei/Markus/Eike: one for you?
Do you think I should fill a new bugtracker since the crash I had was before running Refresh part?
Comment 4 m_a_riosv 2013-09-01 22:16:24 UTC
*** Bug 68819 has been marked as a duplicate of this bug. ***
Comment 5 Laurent Balland 2013-10-02 16:53:12 UTC
Hello,

I reproduced a crash on Win7 with LibO Version: 4.1.2.3
Build ID: 40b2d7fde7e8d2d7bc5a449dc65df4d08a7dd38

1. Create a spreadsheet similar to CrashPivotTable.ods
   a. create a table with text in column A (Data1), and values in column B (Data2)
   b. select table, Data > Pivot Table > Create, Current selection
   c. set Data1 from column A in Row Field, Data2 from column B in Data Field, with sum
   d. filter Data1 with only some values (for instance only "A")
=> table is reduced from 1 row
   e. enter text just below the table
2. Filter with all Data1: the table should increase its size and may overwrite the text below the table
=> LibO ask "The destination range is not empty. Overwrite existing contents?"
3. Answer No
=> Crash
Comment 6 Laurent Balland 2013-10-02 16:54:50 UTC
Created attachment 86978 [details]
Test file to reproduce the crash
Comment 7 Laurent Balland 2013-10-02 17:03:15 UTC
Reproduced with LibO Version: 4.1.0.4
Build ID: 89ea49ddacd9aa532507cbf852f2bb22b1ace28

NOT reproduced with LibO Version 4.0.5.2 
(Build ID: 5464147a081647a250913f19c0715bca595af2f)
Comment 8 Laurent Balland 2013-10-02 17:07:33 UTC
(In reply to comment #5)
> 3. Answer No
> => Crash

To be more precise, the crash occurs when you click on the table, after answering the question.
Comment 9 Laurent Balland 2013-10-02 18:38:22 UTC
Reproduced on Win7 with LibO Version: 4.1.0.0.alpha1
Build ID: 67ce08e2c64a6615abc90d3a3c442f90d86fa69
Comment 10 Julien Nabet 2013-10-03 19:20:17 UTC
Created attachment 87086 [details]
console + bt from make debugrun

With master sources updated today + brand new LO profile, I got this new bt + console.
This time I had a crash by following the Mariosv's description.
Comment 11 Julien Nabet 2013-10-03 19:35:32 UTC
LaurentBP: I gave a try to Debian package 4.1.1.2 and with 4.1 sources updated some days ago, I didn't reproduce the crash.
Anyway, even if it's similar, it's better you fill a brand new bug in order to not mix bugs.

BTW, following my last comment, I put it at NEW.
Comment 12 Laurent Balland 2013-10-04 19:34:41 UTC
@Julien Nabet: I tested both procedures (mariosv and mine) and reproduced crash with both on Linux OpenSuse with LibO Version: 4.1.2.3
Build ID: 40b2d7fde7e8d2d7bc5a449dc65df4d08a7dd38
I think that the bug is not similar but identical between both procedures: the bug occurs if PivotTable asks if it should overwrite data and user answers "No", whatever the reason why PivotTable need to expand its size. I just tried to create a simpler test case from scratch.

If you cannot reproduce a crash with the procedure I described, then it may be not clear enough. The crash does not occur just after you answer No, but when you try to modify again the PivotTable.
Comment 13 Kohei Yoshida 2013-12-06 20:37:25 UTC
I'll take a look.
Comment 14 Commit Notification 2013-12-07 00:52:15 UTC
Kohei Yoshida committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=bd976e5b070ec68a4f842190db4d0c1ea0e93428

fdo#66984: Define an assignment operator to prevent double deletion.



The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 15 Commit Notification 2013-12-07 00:52:33 UTC
Kohei Yoshida committed a patch related to this issue.
It has been pushed to "libreoffice-4-2":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=4e57eaaaccb114b03849521d5a1a88da4b110236&h=libreoffice-4-2

fdo#66984: Define an assignment operator to prevent double deletion.


It will be available in LibreOffice 4.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 16 Kohei Yoshida 2013-12-07 01:01:19 UTC
So, great job uncovering this crasher.  This use case was the only way to invoke the problematic code path which was triggering the crash.  Hopefully fixed it up now.

The request for backporting to 4.1 is on gerrit.
Comment 17 Commit Notification 2013-12-07 18:40:27 UTC
Kohei Yoshida committed a patch related to this issue.
It has been pushed to "libreoffice-4-1":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=1d33b1de2b9eeef0043c057bbfa539ab1e7c3238&h=libreoffice-4-1

fdo#66984: Define an assignment operator to prevent double deletion.


It will be available in LibreOffice 4.1.5.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 18 m_a_riosv 2013-12-08 16:53:30 UTC
Thanks Kohei.

Works in:
Version: 4.1.5.0.0+ Build ID: cb4225144f1fff44f9bb972fe06f51524da11b8
Version: 4.2.0.0.beta2+ Build ID: 02180aed7dc0b8c5f9cc23b319adc2386a9aab69
         TinderBox: Win-x86@42, Branch:libreoffice-4-2, Time: 2013-12-08_08:48:31
Version: 4.3.0.0.alpha0+ Build ID: c6fe5c6f371328cb6cf61d68f016a04f8b635a48
         TinderBox: Win-x86@39, Branch:master, Time: 2013-12-08_02:58:23