Yves, 

-can you attach a file example with your "closed multiline" here?

-can you try use more new LibreOffice version from libreoffice.org/download?

Created attachment 158030 [details]
Draw including a multilines form

I added a file example.
For a try with another release, I will try later.
Another user confirmed the crash with the same release.

Version: 7.0.0.0.alpha0+
Build ID: d7cab304e7dd22fd12443a1ee3b6a9c463bf9a3d
CPU threads: 4; OS: Linux 4.19; UI render: default; VCL: gtk3; 
Locale: en-US (en_US.UTF-8); UI-Language: en-US
Calc: threaded

Could you please try to reproduce it with the latest version of LibreOffice from https://www.libreoffice.org/download/libreoffice-fresh/ ?
I have set the bug's status to 'NEEDINFO'. Please change it back to 'UNCONFIRMED' if the bug is still present in the latest version.

Hello,
I can reproduce the crash with the just downloaded version.
crashreport.libreoffice.org/stats/crash_details/4cb63c1e-12f8-4b3e-ae0c-ea6273f5e56d

Note that the form has to be closed No crash occurs if the form is open.

If I follow the steps, the insert mode is left immediately, when I press Ctrl-key. No crash.

But when I do these steps it crashes:
Start with insert a point and keep mouse button down. You see preview lines for the to be inserted point.
Press Ctrl-key, still mouse button down.
Release mouse button, still pressing Ctrl-key. A point is inserted.
Still pressing Ctrl-key, click somewhere in the shape.
Crash

Tested with Version: 7.0.0.0.alpha0+ (x64)
Build ID: cf96cb11e2a46c452a273ded1c66c556118983cf
CPU threads: 8; OS: Windows 10.0 Build 18362; UI render: default; VCL: win; 
Locale: de-DE (en_US); UI-Language: en-US
Calc: threaded

Can reproduce it. Steps:

1. Open attached document
2. Press F9
3. Select the shape
4. Click on insert point in toolbar
5. Click on the shape while holding Ctrl

Regression introduced by:

https://cgit.freedesktop.org/libreoffice/core/commit/?id=b4fc996520b47a6212661a9de3a1c72ccfc379a4

author	Noel Grandin <noel.grandin@collabora.co.uk>	2018-09-21 15:30:02 +0200
committer	Noel Grandin <noel.grandin@collabora.co.uk>	2018-09-25 13:57:36 +0200
commit b4fc996520b47a6212661a9de3a1c72ccfc379a4 (patch)
tree 2dcb66d687dcdd1d91a75f9e498ca04742a7c564
parent c30bdfbd22807e3f0c77f13a246ec243153ad7ae (diff)
loplugin:useuniqueptr in SdrHdlList

Bisected with: bibisect-linux64-6.2

Adding Cc: to Noel Grandin

Also reproduced in

Versión: 6.4.2.2 (x86)
Id. de compilación: 4e471d8c02c9c90f512f7f9ead8875b57fcb1ec3
Subprocs. CPU: 2; SO: Windows 6.1 Service Pack 1 Build 7601; Repres. IU: predet.; VCL: win; 
Configuración regional: es-ES (es_ES); Idioma de IU: es-ES
Calc: threaded

Created attachment 160034 [details]
before and after (with patch)

I think the case distinction in /include/svx/svdhdl.hxx#462 is lost.

before b4fc996520b47a6212661a9de3a1c72ccfc379a4
SdrHdl* GetHdl(size_t nNum) const { return nNum<aList.size() ? aList[nNum] : nullptr; }

after
SdrHdl* GetHdl(size_t nNum) const { return maList[nNum].get(); }

There seems to be an error in addition. The Ctrl-key toggles snap/no-snap when inserting glue points, but similar is broken (removed?) for inserting a path point. I see it working in OOo3.2.1, but not in AOO4.
If currently Ctrl-key is used, flow goes into the then-case in SdrPathObj::NbcInsPoint. And there a new one-point polygon is added to the selected polypolygon instead adding the point to the existing polygon in the else-case.

(In reply to Regina Henschel from comment #11)
> I think the case distinction in /include/svx/svdhdl.hxx#462 is lost.
> 

Yes that was deliberate, to flush out code calling getHdl with a bad parameter.

I'll just revert that part since the svx code is such a nightmare it doesn't seem possible to fix properly (someone else is welcome to try and prove me wrong)

Noel Grandin committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/31a44b5d08a1419aa1693996376514db577a5e01

tdf#130792 Draw crashes when trying to add a point in a multiline

It will be available in 7.0.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.

Verified in

Version: 7.0.0.0.alpha0+
Build ID: 017f90788c330d2e35a9c05a5...
CPU threads: 4; OS: Linux 4.19; UI render: default; VCL: gtk3; 
Locale: en-US (en_US.UTF-8); UI: en-US
Calc: threaded

@Noel, thanks for fixing this issue!

Noel Grandin committed a patch related to this issue.
It has been pushed to "libreoffice-6-4":

https://git.libreoffice.org/core/commit/ee74bd26ef3cd6522ed1687ee2ddc573fba36fff

tdf#130792 Draw crashes when trying to add a point in a multiline

It will be available in 6.4.5.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.