Bug 107644 - Crash on inserting formula
Summary: Crash on inserting formula
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Formula Editor (show other bugs)
Version:
(earliest affected)
5.4.0.0.alpha1+
Hardware: All All
: medium normal
Assignee: Julien Nabet
URL:
Whiteboard: target:5.4.0 target:5.3.4
Keywords:
Depends on:
Blocks:
 
Reported: 2017-05-05 05:28 UTC by sam tygier
Modified: 2017-05-10 09:12 UTC (History)
1 user (show)

See Also:
Crash report or crash signature:


Attachments
backtrace (61.99 KB, text/plain)
2017-05-05 05:28 UTC, sam tygier
Details

Note You need to log in before you can comment on or make changes to this bug.
Description sam tygier 2017-05-05 05:28:08 UTC
Created attachment 133085 [details]
backtrace

In current LO git ( ae7401002a0b6dabe4136dd8c5654ee2a54e7db6 ) I get a crash when inserting a formula into a presentation. I am on Fedora 25.

Steps to reproduce.
1) open a new presentaton
2) Insert -> Object -> formula
3) Put anything in the formula
4) click outside the formula area to return to the presentation

Error message
soffice.bin: /usr/local/src/libreoffice/core/comphelper/source/misc/accessibleeventnotifier.cxx:136: bool {anonymous}::implLookupClient(comphelper::AccessibleEventNotifier::TClientId, std::__debug::map<unsigned int, comphelper::OInterfaceContainerHelper2*>::iterator&): Assertion `rClients.end() != rPos && "AccessibleEventNotifier::implLookupClient: invalid client id " "(did you register your client?)!"' failed.

Thread 1 "soffice.bin" received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:58
58	}

Backtrace:
#0  0x00007ffff73a391f in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:58
#1  0x00007ffff73a551a in __GI_abort () at abort.c:89
#2  0x00007ffff739bda7 in __assert_fail_base (fmt=<optimized out>, assertion=assertion@entry=0x7ffff490a888 "rClients.end() != rPos && \"AccessibleEventNotifier::implLookupClient: invalid client id \" \"(did you register your client?)!\"", file=file@entry=0x7ffff490a7a0 "/usr/local/src/libreoffice/core/comphelper/source/misc/accessibleeventnotifier.cxx", line=line@entry=136, function=function@entry=0x7ffff490aa80 <(anonymous namespace)::implLookupClient(unsigned int, __gnu_debug::_Safe_iterator<std::_Rb_tree_iterator<std::pair<unsigned int const, comphelper::OInterfaceContainerHelper2*> >, std::__debug::map<unsigned int, comphelper::OInterfaceContainerHelper2*, std::less<unsigned int>, std::allocator<std::pair<unsigned int const, comphelper::OInterfaceContainerHelper2*> > > >&)::__PRETTY_FUNCTION__> "bool {anonymous}::implLookupClient(comphelper::AccessibleEventNotifier::TClientId, std::__debug::map<unsigned int, comphelper::OInterfaceContainerHelper2*>::iterator&)") at assert.c:92
#3  0x00007ffff739be52 in __GI___assert_fail (assertion=0x7ffff490a888 "rClients.end() != rPos && \"AccessibleEventNotifier::implLookupClient: invalid client id \" \"(did you register your client?)!\"", file=0x7ffff490a7a0 "/usr/local/src/libreoffice/core/comphelper/source/misc/accessibleeventnotifier.cxx", line=136, function=0x7ffff490aa80 <(anonymous namespace)::implLookupClient(unsigned int, __gnu_debug::_Safe_iterator<std::_Rb_tree_iterator<std::pair<unsigned int const, comphelper::OInterfaceContainerHelper2*> >, std::__debug::map<unsigned int, comphelper::OInterfaceContainerHelper2*, std::less<unsigned int>, std::allocator<std::pair<unsigned int const, comphelper::OInterfaceContainerHelper2*> > > >&)::__PRETTY_FUNCTION__> "bool {anonymous}::implLookupClient(comphelper::AccessibleEventNotifier::TClientId, std::__debug::map<unsigned int, comphelper::OInterfaceContainerHelper2*>::iterator&)") at assert.c:101
#4  0x00007ffff47c29a8 in (anonymous namespace)::implLookupClient(comphelper::AccessibleEventNotifier::TClientId, std::__debug::map<unsigned int, comphelper::OInterfaceContainerHelper2*, std::less<unsigned int>, std::allocator<std::pair<unsigned int const, comphelper::OInterfaceContainerHelper2*> > >::iterator&) (nClient=0, rPos=...)
    at /usr/local/src/libreoffice/core/comphelper/source/misc/accessibleeventnotifier.cxx:134
#5  0x00007ffff47c2ffd in comphelper::AccessibleEventNotifier::removeEventListener(unsigned int, com::sun::star::uno::Reference<com::sun::star::accessibility::XAccessibleEventListener> const&) (_nClient=0, _rxListener=...) at /usr/local/src/libreoffice/core/comphelper/source/misc/accessibleeventnotifier.cxx:238
#6  0x00007fffbaca5865 in SmGraphicAccessible::removeAccessibleEventListener(com::sun::star::uno::Reference<com::sun::star::accessibility::XAccessibleEventListener> const&) (this=0x2d45050, xListener=...) at /usr/local/src/libreoffice/core/starmath/source/accessibility.cxx:398
#7  0x00007fffd30e3169 in AtkListener::handleChildRemoved(com::sun::star::uno::Reference<com::sun::star::accessibility::XAccessibleContext> const&, com::sun::star::uno::Reference<com::sun::star::accessibility::XAccessible> const&) (this=0x2d726e0, rxParent=..., rxChild=...)
    at /usr/local/src/libreoffice/core/vcl/unx/gtk3/a11y/../../gtk/a11y/atklistener.cxx:213
#8  0x00007fffd30e366b in AtkListener::notifyEvent(com::sun::star::accessibility::AccessibleEventObject const&) (this=0x2d726e0, aEvent=...)
    at /usr/local/src/libreoffice/core/vcl/unx/gtk3/a11y/../../gtk/a11y/atklistener.cxx:428
#9  0x00007ffff47c3261 in comphelper::AccessibleEventNotifier::addEvent(unsigned int, com::sun::star::accessibility::AccessibleEventObject const&) (_nClient=59, _rEvent=...) at /usr/local/src/libreoffice/core/comphelper/source/misc/accessibleeventnotifier.cxx:269
#10 0x00007ffff47c0f72 in comphelper::OAccessibleContextHelper::NotifyAccessibleEvent(short, com::sun::star::uno::Any const&, com::sun::star::uno::Any const&) (this=0x2d5b1a0, _nEventId=7, _rOldValue=..., _rNewValue=...) at /usr/local/src/libreoffice/core/comphelper/source/misc/accessiblecontexthelper.cxx:187
#11 0x00007fffee347686 in VCLXAccessibleComponent::ProcessWindowEvent(VclWindowEvent const&) (this=0x2d5b1a0, rVclWindowEvent=...)
    at /usr/local/src/libreoffice/core/toolkit/source/awt/vclxaccessiblecomponent.cxx:212
#12 0x00007fffee347041 in VCLXAccessibleComponent::WindowEventListener(VclWindowEvent&) (this=0x2d5b1a0, rEvent=...)
    at /usr/local/src/libreoffice/core/toolkit/source/awt/vclxaccessiblecomponent.cxx:126
#13 0x00007fffee346f51 in VCLXAccessibleComponent::LinkStubWindowEventListener(void*, VclWindowEvent&) (instance=0x2d5b1a0, data=...)
    at /usr/local/src/libreoffice/core/toolkit/source/awt/vclxaccessiblecomponent.cxx:115
#14 0x00007fffec6168ab in Link<VclWindowEvent&, void>::Call(VclWindowEvent&) const (this=0x2d177b0, data=...)
    at /usr/local/src/libreoffice/core/include/tools/link.hxx:84
#15 0x00007fffec6134b8 in vcl::Window::CallEventListeners(VclEventId, void*) (this=0x2d491f0, nEvent=VclEventId::WindowChildDestroyed, pData=0x2d7dbf0)
    at /usr/local/src/libreoffice/core/vcl/source/window/event.cxx:240
#16 0x00007fffec72ca9c in vcl::Window::dispose() (this=0x2d7dbf0) at /usr/local/src/libreoffice/core/vcl/source/window/window.cxx:171
#17 0x00007fffeedba054 in ScrollableWindow::dispose() (this=0x2d7dbf0) at /usr/local/src/libreoffice/core/svtools/source/control/scrwin.cxx:55
#18 0x00007fffbadb586a in SmGraphicWindow::dispose() (this=0x2d7dbf0) at /usr/local/src/libreoffice/core/starmath/source/view.cxx:127
---Type <return> to continue, or q <return> to quit---
#19 0x00007fffec8c5310 in VclReferenceBase::disposeOnce() (this=0x2d7df20) at /usr/local/src/libreoffice/core/vcl/source/outdev/vclreferencebase.cxx:42
#20 0x00007fffbadc33ce in VclPtr<SmGraphicWindow>::disposeAndClear() (this=0x2ce8688) at /usr/local/src/libreoffice/core/include/vcl/vclptr.hxx:239
#21 0x00007fffbadbf0a1 in SmViewShell::~SmViewShell() (this=0x2ce8610, __in_chrg=<optimized out>) at /usr/local/src/libreoffice/core/starmath/source/view.cxx:1932
#22 0x00007fffbadbf116 in SmViewShell::~SmViewShell() (this=0x2ce8610, __in_chrg=<optimized out>) at /usr/local/src/libreoffice/core/starmath/source/view.cxx:1933
#23 0x00007ffff22a1534 in SfxViewFrame::ReleaseObjectShell_Impl() (this=0x2d53ba0) at /usr/local/src/libreoffice/core/sfx2/source/view/viewfrm.cxx:979
#24 0x00007ffff22a37c8 in SfxViewFrame::~SfxViewFrame() (this=0x2d53ba0, __in_chrg=<optimized out>)
    at /usr/local/src/libreoffice/core/sfx2/source/view/viewfrm.cxx:1385
#25 0x00007ffff22a39c8 in SfxViewFrame::~SfxViewFrame() (this=0x2d53ba0, __in_chrg=<optimized out>)
    at /usr/local/src/libreoffice/core/sfx2/source/view/viewfrm.cxx:1408
#26 0x00007ffff22a1a09 in SfxViewFrame::Close() (this=0x2d53ba0) at /usr/local/src/libreoffice/core/sfx2/source/view/viewfrm.cxx:1031
#27 0x00007ffff2276699 in SfxFrame::DoClose_Impl() (this=0x2d3f730) at /usr/local/src/libreoffice/core/sfx2/source/view/frame.cxx:161
#28 0x00007ffff2291fd4 in SfxBaseController::dispose() (this=0x2cf4b50) at /usr/local/src/libreoffice/core/sfx2/source/view/sfxbasecontroller.cxx:1022
#29 0x00007fffc825a241 in (anonymous namespace)::Frame::setComponent(com::sun::star::uno::Reference<com::sun::star::awt::XWindow> const&, com::sun::star::uno::Reference<com::sun::star::frame::XController> const&) (this=0x2c79470, xComponentWindow=..., xController=...)
    at /usr/local/src/libreoffice/core/framework/source/services/frame.cxx:1475
#30 0x00007fffc825aac9 in (anonymous namespace)::Frame::close(sal_Bool) (this=0x2c79470, bDeliverOwnership=1 '\001')
    at /usr/local/src/libreoffice/core/framework/source/services/frame.cxx:1685
#31 0x00007fffbb121c2d in DocumentHolder::CloseFrame() (this=0x2e68930) at /usr/local/src/libreoffice/core/embeddedobj/source/general/docholder.cxx:225
#32 0x00007fffbb0f5b58 in OCommonEmbeddedObject::Deactivate() (this=0x2e66ad0) at /usr/local/src/libreoffice/core/embeddedobj/source/commonembedding/embedobj.cxx:115
#33 0x00007fffbb0f6a43 in OCommonEmbeddedObject::SwitchStateTo_Impl(int) (this=0x2e66ad0, nNextState=1)
    at /usr/local/src/libreoffice/core/embeddedobj/source/commonembedding/embedobj.cxx:291
#34 0x00007fffbb0f7a71 in OCommonEmbeddedObject::changeState(int) (this=0x2e66ad0, nNewState=1)
    at /usr/local/src/libreoffice/core/embeddedobj/source/commonembedding/embedobj.cxx:461
#35 0x00007ffff2287848 in SfxInPlaceClient::DeactivateObject() (this=0x2d91440) at /usr/local/src/libreoffice/core/sfx2/source/view/ipclient.cxx:1009
#36 0x00007fffc61604ca in sd::DrawViewShell::SelectionHasChanged() (this=0x2126a20) at /usr/local/src/libreoffice/core/sd/source/ui/view/drviews1.cxx:209
#37 0x00007fffc6153c61 in sd::DrawView::MarkListHasChanged() (this=0x2143580) at /usr/local/src/libreoffice/core/sd/source/ui/view/drawview.cxx:106
#38 0x00007fffefba1b65 in SdrMarkView::UnmarkAllObj(SdrPageView*) (this=0x2143580, pPV=0x0) at /usr/local/src/libreoffice/core/svx/source/svdraw/svdmrkv.cxx:1936
#39 0x00007fffefcb51db in SdrView::UnmarkAll() (this=0x2143580) at /usr/local/src/libreoffice/core/svx/source/svdraw/svdview.cxx:1370
#40 0x00007fffc5ed5de3 in sd::FuSelection::MouseButtonDown(MouseEvent const&) (this=0x2aea1d0, rMEvt=...)
    at /usr/local/src/libreoffice/core/sd/source/ui/func/fusel.cxx:373
#41 0x00007fffc623c838 in sd::ViewShell::MouseButtonDown(MouseEvent const&, sd::Window*) (this=0x2126a20, rMEvt=..., pWin=0x2127390)
    at /usr/local/src/libreoffice/core/sd/source/ui/view/viewshel.cxx:499
#42 0x00007fffc618113a in sd::DrawViewShell::MouseButtonDown(MouseEvent const&, sd::Window*) (this=0x2126a20, rMEvt=..., pWin=0x2127390)
    at /usr/local/src/libreoffice/core/sd/source/ui/view/drviews4.cxx:286
#43 0x00007fffc622af89 in sd::Window::MouseButtonDown(MouseEvent const&) (this=0x2127390, rMEvt=...)
    at /usr/local/src/libreoffice/core/sd/source/ui/view/sdwindow.cxx:250
#44 0x00007fffec750e45 in ImplHandleMouseEvent(VclPtr<vcl::Window> const&, MouseNotifyEvent, bool, long, long, unsigned long, unsigned short, MouseEventModifiers) (xWindow=
    ..., nSVEvent=MouseNotifyEvent::MOUSEBUTTONDOWN, bMouseLeave=false, nX=701, nY=246, nMsgTime=125939936, nCode=1, nMode=(MouseEventModifiers::SIMPLECLICK | MouseEventModifiers::SELECT)) at /usr/local/src/libreoffice/core/vcl/source/window/winproc.cxx:699
#45 0x00007fffec758211 in ImplHandleSalMouseButtonDown(vcl::Window*, SalMouseEvent*) (pWindow=0x1d3c190, pEvent=0x7fffffff1a60)
    at /usr/local/src/libreoffice/core/vcl/source/window/winproc.cxx:2010
#46 0x00007fffec75669d in ImplWindowFrameProc(vcl::Window*, SalEvent, void const*) (_pWindow=0x1d3c190, nEvent=SalEvent::MouseButtonDown, pEvent=0x7fffffff1a60)
---Type <return> to continue, or q <return> to quit---
    at /usr/local/src/libreoffice/core/vcl/source/window/winproc.cxx:2332
#47 0x00007fffd3179d1a in SalFrame::CallCallback(SalEvent, void const*) const (this=0x1d48130, nEvent=SalEvent::MouseButtonDown, pEvent=0x7fffffff1a60)
    at /usr/local/src/libreoffice/core/vcl/inc/salframe.hxx:276
#48 0x00007fffd3179231 in GtkSalFrame::CallCallbackExc(SalEvent, void const*) const (this=0x1d48130, nEvent=SalEvent::MouseButtonDown, pEvent=0x7fffffff1a60)
    at /usr/local/src/libreoffice/core/vcl/unx/gtk3/gtk3gtkframe.cxx:4299
#49 0x00007fffd31743f4 in GtkSalFrame::signalButton(_GtkWidget*, _GdkEventButton*, void*) (pEvent=0x265a1e0, frame=0x1d48130)
    at /usr/local/src/libreoffice/core/vcl/unx/gtk3/gtk3gtkframe.cxx:2652
#50 0x00007fffd29bae7c in _gtk_marshal_BOOLEAN__BOXED () at /lib64/libgtk-3.so.0
#51 0x00007ffff5ddc3e5 in g_closure_invoke () at /lib64/libgobject-2.0.so.0
#52 0x00007ffff5dee432 in signal_emit_unlocked_R () at /lib64/libgobject-2.0.so.0
#53 0x00007ffff5df6b8f in g_signal_emit_valist () at /lib64/libgobject-2.0.so.0
#54 0x00007ffff5df743f in g_signal_emit () at /lib64/libgobject-2.0.so.0
#55 0x00007fffd2b0820c in gtk_widget_event_internal () at /lib64/libgtk-3.so.0
#56 0x00007fffd29b7f4e in propagate_event () at /lib64/libgtk-3.so.0
#57 0x00007fffd29b9fbe in gtk_main_do_event () at /lib64/libgtk-3.so.0
#58 0x00007fffd24d05c5 in _gdk_event_emit () at /lib64/libgdk-3.so.0
#59 0x00007fffd2501582 in gdk_event_source_dispatch () at /lib64/libgdk-3.so.0
#60 0x00007ffff5b03e52 in g_main_context_dispatch () at /lib64/libglib-2.0.so.0
#61 0x00007ffff5b041d0 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#62 0x00007ffff5b0427c in g_main_context_iteration () at /lib64/libglib-2.0.so.0
#63 0x00007fffd30ffeaa in GtkData::Yield(bool, bool) (this=0x75dca0, bWait=true, bHandleAllCurrentEvents=false)
    at /usr/local/src/libreoffice/core/vcl/unx/gtk3/gtk3gtkdata.cxx:460
#64 0x00007fffd310323f in GtkInstance::DoYield(bool, bool, unsigned long) (this=0x76a270, bWait=true, bHandleAllCurrentEvents=false, nReleased=0)
    at /usr/local/src/libreoffice/core/vcl/unx/gtk3/../gtk/gtkinst.cxx:427
#65 0x00007fffecb99ddd in ImplYield(bool, bool, unsigned long) (i_bWait=true, i_bAllEvents=false, nReleased=0)
    at /usr/local/src/libreoffice/core/vcl/source/app/svapp.cxx:496
#66 0x00007fffecb95b3e in Application::Yield() () at /usr/local/src/libreoffice/core/vcl/source/app/svapp.cxx:558
#67 0x00007fffecb958d7 in Application::Execute() () at /usr/local/src/libreoffice/core/vcl/source/app/svapp.cxx:458
#68 0x00007ffff7780aa9 in desktop::Desktop::DoExecute() () at /usr/local/src/libreoffice/core/desktop/source/app/app.cxx:1354
#69 0x00007ffff7781c5e in desktop::Desktop::Main() (this=0x7fffffff2b10) at /usr/local/src/libreoffice/core/desktop/source/app/app.cxx:1674
#70 0x00007fffecba4e05 in ImplSVMain() () at /usr/local/src/libreoffice/core/vcl/source/app/svmain.cxx:191
#71 0x00007fffecba4f6e in SVMain() () at /usr/local/src/libreoffice/core/vcl/source/app/svmain.cxx:229
#72 0x00007ffff77d6619 in soffice_main() () at /usr/local/src/libreoffice/core/desktop/source/app/sofficemain.cxx:166
#73 0x000000000040091e in sal_main () at /usr/local/src/libreoffice/core/desktop/source/app/main.c:48
#74 0x0000000000400904 in main (argc=2, argv=0x7fffffff2e48) at /usr/local/src/libreoffice/core/desktop/source/app/main.c:47

Full backtrace attached.
Comment 1 Xisco Faulí 2017-05-05 08:00:35 UTC
I could reproduce it one out of ten in

Version: 5.4.0.0.alpha1+
Build ID: f12096272e684ddcd8ffa4e34dcb0a680cc594c2
CPU threads: 4; OS: Linux 4.8; UI render: default; VCL: gtk3; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group

Do you reproduce it every time?
Comment 2 sam tygier 2017-05-05 10:56:58 UTC
I see it every time in my own builds from git.

Just tried with
Version: 5.4.0.0.alpha1
Build ID: 0b9f9bef65bb21ebb6a64aafad448f7f62dc824a
CPU threads: 4; OS: Linux 4.10; UI render: default; VCL: gtk3; 
Locale: en-GB (en_GB.utf8); Calc: group

I can't reproduce with an official nightly build from last week.
Version: 5.4.0.0.alpha0+
Build ID: 74ccd02eda2d6325a27266fd935aba29b3d75020
CPU threads: 4; OS: Linux 4.10; UI render: default; VCL: gtk2; 
TinderBox: Linux-rpm_deb-x86_64@70-TDF, Branch:master, Time: 2017-04-27_23:51:14
Locale: en-GB (en_GB.utf8); Calc: group

So either very recent regression, or some difference in the builds (gtk2 vs gtk3?)
Comment 3 sam tygier 2017-05-05 11:03:12 UTC
On my same build, but started with
SAL_USE_VCLPLUGIN=gtk  instdir/program/soffice
I don't see the crash

Version: 5.4.0.0.alpha1
Build ID: 0b9f9bef65bb21ebb6a64aafad448f7f62dc824a
CPU threads: 4; OS: Linux 4.10; UI render: default; VCL: gtk2; 
Locale: en-GB (en_GB.utf8); Calc: group
Comment 4 Jacques Guilleron 2017-05-05 17:37:06 UTC
Hello sam, Xisco,

I don't reproduce with
LO 5.4.0.0.alpha1+ Build ID: 0025fc13d805751f8eeb14febbdd0033e0a6d91e
CPU threads: 2; OS: Windows 6.1; UI render: default; 
TinderBox: Win-x86@39, Branch:master, Time: 2017-05-04_05:21:32
Locale: fr-FR (fr_FR); Calc: CL
Linux only, probably.

Jacques
Comment 5 sam tygier 2017-05-06 07:25:55 UTC
Seems consistent that with gtk3 it crashes every time. with gtk (gtk2) i can't make it crash even after many inserted formula.

I can't reproduce with
[3d9a8b4b4e538a85e0782bd6c2d430bafe583448] Version 5.3.3.2, tag libreoffice-5.3.3.2
so have started bisecting.
Comment 6 Julien Nabet 2017-05-06 13:21:05 UTC
Let's give a try with https://gerrit.libreoffice.org/#/c/37315/
Comment 7 sam tygier 2017-05-07 09:45:55 UTC
https://gerrit.libreoffice.org/#/c/37315/ fixes the crash for me.

In my bisecting I got as far as:
# bad: [0b9f9bef65bb21ebb6a64aafad448f7f62dc824a] Version 5.4.0.0.alpha1, tag libreoffice-5.4.0.0.alpha1
git bisect bad 0b9f9bef65bb21ebb6a64aafad448f7f62dc824a
# good: [3d9a8b4b4e538a85e0782bd6c2d430bafe583448] Version 5.3.3.2, tag libreoffice-5.3.3.2
git bisect good 3d9a8b4b4e538a85e0782bd6c2d430bafe583448
# bad: [80c2c0b496494bc648e49f49349a46648f97f689] improve scoping and zero some things
git bisect bad 80c2c0b496494bc648e49f49349a46648f97f689
# bad: [a423ed8a474e114d21b81b84b2900099a6527481] base work to trigger pivot table filter popup with a callback
git bisect bad a423ed8a474e114d21b81b84b2900099a6527481
# bad: [b01ec28b6dfa84c9c9f07d08af27a0107a5260a1] Create missing parent dirs when checking for r/o dir
git bisect bad b01ec28b6dfa84c9c9f07d08af27a0107a5260a1
# bad: [26f6dadb4f8570d609557c004384a509d570b518] manage SvRefBase-subclass by tools::SvRef in ScXMLTableRowCellContext
git bisect bad 26f6dadb4f8570d609557c004384a509d570b518
# bad: [56859198c2e49aa465c49bbfc5a18bfaef056202] coverity#1399014 Unchecked return value
git bisect bad 56859198c2e49aa465c49bbfc5a18bfaef05620

Is there any need to finish the bisection, if the patch fixes it?
Comment 8 Commit Notification 2017-05-07 10:16:46 UTC
Julien Nabet committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=3d4938d2d8dc18c7b741efe90686f55f524fcfe2

tdf#107644: Crash on inserting formula

It will be available in 5.4.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 9 Commit Notification 2017-05-07 14:02:52 UTC
Julien Nabet committed a patch related to this issue.
It has been pushed to "libreoffice-5-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=2e20df6eb9fe206b89d5eecbf88eea54d0719268&h=libreoffice-5-3

tdf#107644: Crash on inserting formula

It will be available in 5.3.4.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 10 sam tygier 2017-05-10 09:12:05 UTC
For reference bisect says this was introduced in commit 8228227168a7eb3ebf14629bec87f01536c23970 ( https://cgit.freedesktop.org/libreoffice/core/commit/?id=8228227168a7eb3ebf14629bec87f01536c23970 )