crashtesting: Error: attempt to increment a singular iterator.

on loading tdf97831-15.xlsx

#0  0x00007fffebea8664 in __pthread_kill_implementation () at /lib64/libc.so.6
#1  0x00007fffebe4fc4e in raise () at /lib64/libc.so.6
#2  0x00007fffebe37902 in abort () at /lib64/libc.so.6
#3  0x00007fffebaa84e9 in __gnu_debug::_Error_formatter::_M_error() const [clone .cold] () at /lib64/libstdc++.so.6
#4  0x00007fffa8d75183 in __gnu_debug::_Safe_iterator<__gnu_cxx::__normal_iterator<unsigned int const*, std::__cxx1998::vector<unsigned int, std::allocator<unsigned int> > >, std::__debug::vector<unsigned int, std::allocator<unsigned int> >, std::forward_iterator_tag>::operator++ (this=0x7fffffff9360) at /usr/include/c++/14/debug/safe_iterator.h:392
#5  0x00007fffa8d73da2 in __gnu_debug::_Safe_iterator<__gnu_cxx::__normal_iterator<unsigned int const*, std::__cxx1998::vector<unsigned int, std::allocator<unsigned int> > >, std::__debug::vector<unsigned int, std::allocator<unsigned int> >, std::bidirectional_iterator_tag>::operator++ (this=0x7fffffff9360) at /usr/include/c++/14/debug/safe_iterator.h:679
#6  0x00007fffa8d71fd2 in __gnu_debug::_Safe_iterator<__gnu_cxx::__normal_iterator<unsigned int const*, std::__cxx1998::vector<unsigned int, std::allocator<unsigned int> > >, std::__debug::vector<unsigned int, std::allocator<unsigned int> >, std::random_access_iterator_tag>::operator++ (this=0x7fffffff9360) at /usr/include/c++/14/debug/safe_iterator.h:849
#7  0x00007fffa90d204e in ScDocument::GetCondResult (this=0x18fbcb0, rCell=..., rPos=..., rList=..., rIndex=...) at co-24.04/sc/source/core/data/documen4.cxx:816
#8  0x00007fffa90d1ea1 in ScDocument::GetCondResult (this=0x18fbcb0, nCol=7, nRow=1, nTab=0, pCell=0x7fffffff9420) at co-24.04/sc/source/core/data/documen4.cxx:809
#9  0x00007fffa8f2740d in ScColumn::GetNeededSize
(this=0x7fffd000b4d0, nRow=1, pDev=0x1fa6690, nPPTX=0.064757526036325508, nPPTY=0.067000000000000004, rZoomX=..., rZoomY=..., bWidth=false, rOptions=..., ppPatternChange=0x7fffffff9ba8, bInPrintTwips=false) at co-24.04/sc/source/core/data/column2.cxx:139
#10 0x00007fffa8f2b887 in ScColumn::GetOptimalHeight (this=0x7fffd000b4d0, rCxt=..., nStartRow=0, nEndRow=24, nMinHeight=256, nMinStart=0)
at co-24.04/sc/source/core/data/column2.cxx:1084
#11 0x00007fffa94a28b7 in (anonymous namespace)::GetOptimalHeightsInColumn (rCxt=..., rCol=..., nStartRow=0, nEndRow=24, pProgress=0x0, nProgressStart=0)
at co-24.04/sc/source/core/data/table1.cxx:120
#12 0x00007fffa94a47f2 in ScTable::SetOptimalHeight (this=0x1f584a0, rCxt=..., nSt

where things go wrong earlier with:

#2  0x00007fffacd716c3 in std::__new_allocator<unsigned int>::deallocate (this=0x7fff9c1d2030, __p=0x7fff9c37acf0, __n=1) at /usr/include/c++/14/bits/new_allocator.h:172
#3  0x00007fffacd65215 in std::allocator<unsigned int>::deallocate (this=0x7fff9c1d2030, __p=0x7fff9c37acf0, __n=1) at /usr/include/c++/14/bits/allocator.h:208
#4  std::allocator_traits<std::allocator<unsigned int> >::deallocate (__a=..., __p=0x7fff9c37acf0, __n=1) at /usr/include/c++/14/bits/alloc_traits.h:513
#5  std::__cxx1998::_Vector_base<unsigned int, std::allocator<unsigned int> >::_M_deallocate (this=0x7fff9c1d2030, __p=0x7fff9c37acf0, __n=1) at /usr/include/c++/14/bits/stl_vector.h:389
#6  0x00007fffacd60b88 in std::__cxx1998::_Vector_base<unsigned int, std::allocator<unsigned int> >::~_Vector_base (this=0x7fff9c1d2030, __in_chrg=<optimized out>)
at /usr/include/c++/14/bits/stl_vector.h:368
#7  0x00007fffacd60bef in std::__cxx1998::vector<unsigned int, std::allocator<unsigned int> >::~vector (this=0x7fff9c1d2030, __in_chrg=<optimized out>)
at /usr/include/c++/14/bits/stl_vector.h:738
#8  0x00007fffacd5ecd6 in std::__debug::vector<unsigned int, std::allocator<unsigned int> >::~vector (this=0x7fff9c1d2018, __in_chrg=<optimized out>) at /usr/include/c++/14/debug/vector:245
#9  0x00007fffacd5feb6 in o3tl::sorted_vector<unsigned int, std::less<unsigned int>, o3tl::find_unique, true>::~sorted_vector (this=0x7fff9c1d2018, __in_chrg=<optimized out>)
at co-24.04/include/o3tl/sorted_vector.hxx:39
#10 0x00007fffacd7a71c in ScCondFormatItem::~ScCondFormatItem (this=0x7fff9c1d2000, __in_chrg=<optimized out>) at co-24.04/sc/source/core/data/attrib.cxx:722
#11 0x00007fffacd7a748 in ScCondFormatItem::~ScCondFormatItem (this=0x7fff9c1d2000, __in_chrg=<optimized out>) at co-24.04/sc/source/core/data/attrib.cxx:722
#12 0x00007fffef638513 in implCleanupItemEntry (rPool=..., pSource=0x7fff9c1d2000) at co-24.04/svl/source/items/itemset.cxx:473
#13 0x00007fffef638e00 in SfxItemSet::ClearAllItemsImpl (this=0x7fffffff8d38) at co-24.04/svl/source/items/itemset.cxx:643
#14 0x00007fffef638a02 in SfxItemSet::~SfxItemSet (this=0x7fffffff8d38, __in_chrg=<optimized out>) at co-24.04/svl/source/items/itemset.cxx:562
#15 0x00007fffacd5f7d0 in SfxSetItem::~SfxSetItem (this=0x7fffffff8d20, __in_chrg=<optimized out>) at co-24.04/include/svl/setitem.hxx:27
#16 0x00007fffacd5f88e in ScPatternAttr::~ScPatternAttr (this=0x7fffffff8d20, __in_chrg=<optimized out>) at co-24.04/sc/inc/patattr.hxx:54
#17 0x00007fffaceab497 in ScColumn::ApplyAttr (this=0x7fff9c027960, nRow=1, rAttr=...) at co-24.04/sc/source/core/data/column.cxx:573
#18 0x00007fffacf38508 in ScColumn::SetNumberFormat (this=0x7fff9c027960, nRow=1, nNumberFormat=99) at co-24.04/sc/source/core/data/column2.cxx:3302
#19 0x00007fffad4c3b55 in ScTable::SetNumberFormat (this=0x1d93840, nCol=7, nRow=1, nNumberFormat=99) at co-24.04/sc/source/core/data/table2.cxx:2315
#20 0x00007fffad114bfa in ScDocument::SetNumberFormat (this=0x1c74100, rPos=..., nNumberFormat=99) at co-24.04/sc/source/core/data/document.cxx:3727
#21 0x00007fffad356c65 in ScFormulaCell::InterpretTail (this=0x1cf9800, rContext=..., eTailParam=ScFormulaCell::SCITP_NORMAL)
at co-24.04/sc/source/core/data/formulacell.cxx:2157
#22 0x00007fffad354e67 in ScFormulaCell::Interpret (this=0x1cf9800, nStartOffset=-1, nEndOffset=-1) at co-24.04/sc/source/core/data/formulacell.cxx:1619
#23 0x00007fffacf8e59f in ScFormulaCell::MaybeInterpret (this=0x1cf9800) at co-24.04/sc/inc/formulacell.hxx:470
#24 0x00007fffad358dd4 in ScFormulaCell::IsValue (this=0x1cf9800) at co-24.04/sc/source/core/data/formulacell.cxx:2762
#25 0x00007fffad025e1b in lcl_GetCellContent (rCell=..., bIsStr1=false, rArg=@0x7fffffff9208: 0, rArgStr="", pDoc=0x1c74100)
at co-24.04/sc/source/core/data/conditio.cxx:764
#26 0x00007fffad0286c5 in ScConditionEntry::IsCellValid (this=0x7fff9c1c73f0, rCell=..., rPos=...) at co-24.04/sc/source/core/data/conditio.cxx:1263
#27 0x00007fffad02b18c in ScConditionalFormat::GetCellStyle (this=0x7fff9c02c1d0, rCell=..., rPos=...) at co-24.04/sc/source/core/data/conditio.cxx:1863
#28 0x00007fffad0d20f8 in ScDocument::GetCondResult (this=0x1c74100, rCell=..., rPos=..., rList=..., rIndex=...) at co-24.04/sc/source/core/data/documen4.cxx:827
#29 0x00007fffad0d1f91 in ScDocument::GetCondResult (this=0x1c74100, nCol=7, nRow=1, nTab=0, pCell=0x7fffffff9420) at co-24.04/sc/source/core/data/documen4.cxx:809

very probably this is a problem since ItemSet rework of:

commit 2b4cb63a4450aff4582994ca6ac701287da61ddd
CommitDate: Tue Nov 21 16:08:57 2023 +0100

Cleanup some ScPatternAttr specific stuff

or similar of that sequence, and likely fixed in upstream later by:

Author:     Armin Le Grand (allotropia) <armin.le.grand.extern@allotropia.de>
CommitDate: Thu Dec 28 19:38:15 2023 +0100

Decouple ScPatternAttr from SfxItemPool

but that's a very sizable rework, so here apply a conservative simpler
workaround to avoid the crash.

Change-Id: I309953015d39bce4796a2cf99666603b00c34d24
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/178579
Reviewed-by: Andras Timar <andras.timar@collabora.com>
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>

1 files changed, 3 insertions, 1 deletions

diff --git a/sc/source/core/data/documen4.cxx b/sc/source/core/data/documen4.cxx
index e9a4fea132f2..40862f813ff5 100644
--- a/sc/source/core/data/documen4.cxx
+++ b/sc/source/core/data/documen4.cxx
@@ -813,8 +813,10 @@ const SfxItemSet* ScDocument::GetCondResult(
     ScRefCellValue& rCell, const ScAddress& rPos, const ScConditionalFormatList& rList,
     const ScCondFormatIndexes& rIndex ) const
 {
-    for (const auto& rItem : rIndex)
+    for (size_t i = 0, nLen = rIndex.size(); i < nLen; ++i)
     {
+        const auto& rItem = rIndex[i];
+
         const ScConditionalFormat* pForm = rList.GetFormat(rItem);
         if (!pForm)
             continue;