Created attachment 128874 [details] Test file with FORMCHECKBOX This bug may be reproduced with the fix for bug 95699. Pasting single FORMCHECKBOX and undoing then redoing gives !!br0ken!! in release builds, asserts in debug builds To reproduce: 1. Open the attached document 2. Select the checkbox *only* (without newline), e.g. by putting the cursor to the end of the first line and using Shift+LeftArrow 3. Copy the checkbox to clipboard (Ctrl+C) 4. Go to second line (Ctrl+End) and paste (Ctrl+V) 5. Undo (Ctrl+Z) 6. Redo (Ctrl+Y) Expected result: the checkbox added on step 4 should disappear on step 5, then reappear at step 6 Actual result: in release build, on step 6 "!!br0ken!!" appears instead of checkbox; in debug build, at step 5, an assertion is triggered. It's difficult to trace when the problem first appeared, because it's masked by bug 95699.
A patch is submitted for review: https://gerrit.libreoffice.org/30980
Mike Kaganski committed a patch related to this issue. It has been pushed to "master": http://cgit.freedesktop.org/libreoffice/core/commit/?id=7c43cba9804e70b23b71783d362401c75f9caa54 tdf#104032: use correct text length It will be available in 5.4.0. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.