Bug 169651 - Crash in: SwLayAction::FormatContent(SwPageFrame*)::{lambda()#1}::operator()() const [clone .lto_priv.0]
Summary: Crash in: SwLayAction::FormatContent(SwPageFrame*)::{lambda()#1}::operator()(...
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
25.8.3.2 release
Hardware: All All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: Frame Crash
  Show dependency tree / graph
 
Reported: 2025-11-24 03:01 UTC by Jim Raykowski
Modified: 2026-01-23 17:37 UTC (History)
1 user (show)

See Also:
Crash report or crash signature: ["SwLayAction::FormatContent(SwPageFrame*)::{lambda()#1}::operator()() const [clone .lto_priv.0]"]

Attachments
Document to reproduce crash (35.84 KB, application/vnd.oasis.opendocument.text)
2025-11-24 03:01 UTC, Jim Raykowski 		Details
Demonstration of the patch (388.96 KB, video/x-matroska)
2025-12-15 09:53 UTC, Jim Raykowski 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jim Raykowski 2025-11-24 03:01:23 UTC 
Created attachment 204239 [details]
Document to reproduce crash

This bug was filed from the crash reporting server and is br-8abb5fd4-128e-403a-a603-ce982d282702.
=========================================

Came across this while poking around for a solution to bug 136419. 

Steps to repro:

Using the attached document, right-click on the Text Frame to select it and show the context menu, select "Unfloat Frame Content"

Results: Crash

Note the frame content has a shape object anchored to the text inside of it. I think the reason for the crash is that pAnchorPage is nullptr for the shape object here. Please see sw/source/core/layout/layact.cxx SwLayAction::FormatContent
Comment 1 Sarah Lim 2025-12-03 13:52:12 UTC 
This is reproducible in 
Version: 26.2.0.0.alpha1+ (X86_64) / LibreOffice Community
Build ID: 620(Build:0)
CPU threads: 12; OS: Windows 11 X86_64 (build 26200); UI render: Skia/Vulkan; VCL: win
Locale: en-US (en_FI); UI: en-GB
Calc: threaded
Comment 2 Sarah Lim 2025-12-10 13:01:35 UTC 
Additional information : this is reproducible from current 
Version: 26.8.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 680(Build:0)
CPU threads: 12; OS: Windows 11 X86_64 (build 26200); UI render: Skia/Vulkan; VCL: win
Locale: en-US (en_FI); UI: en-GB
Calc: threaded

up to 
Version: 24.2.8.0.0+ (X86_64) / LibreOffice Community
Build ID: 2a06848352e0ba2e35bc84f8491d06cece32e707
CPU threads: 12; OS: Windows 10.0 Build 26200; UI render: Skia/Vulkan; VCL: win
Locale: en-US (en_FI); UI: en-US
Calc: threaded

while this can't be replicated on much older versions as it doesn't show "unfloat frame content" on the context menu

starting from
Version: 7.6.8.0.0+ (X86_64) / LibreOffice Community
Build ID: 3a0801282a0aabc64a15f9afc3aedeac6226a979
CPU threads: 12; OS: Windows 10.0 Build 26200; UI render: Skia/Vulkan; VCL: win
Locale: en-US (en_FI); UI: en-US
Calc: threaded
Comment 3 Jim Raykowski 2025-12-15 09:53:03 UTC 
Created attachment 204647 [details]
Demonstration of the patch

Effort to fix this bug is here:
https://gerrit.libreoffice.org/c/core/+/195650
Comment 4 BogdanB 2026-01-23 17:37:50 UTC 
Also crash in
Version: 26.2.0.2 (X86_64)
Build ID: 750d5fef117734aeeb00d37a069d6c814e9eb8ce
CPU threads: 16; OS: Linux 6.14; UI render: default; VCL: gtk3
Locale: en-US (en_US.UTF-8); UI: en-US
Calc: threaded