Bug 170671 - Crash pasting followed by undo swlo!BigPtrArray::operator
Summary: Crash pasting followed by undo swlo!BigPtrArray::operator
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
26.2.0.0 alpha0+ master
Hardware: All All
: high critical
Assignee: Not Assigned
URL:
Whiteboard:
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks: Crash-BigPtrArray
  Show dependency tree / graph
 
Reported: 2026-02-08 19:54 UTC by Telesto
Modified: 2026-07-29 08:56 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:

Attachments
GDB trace of crash (8.05 KB, text/plain)
2026-07-29 08:56 UTC, Buovjaga 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Telesto 2026-02-08 19:54:42 UTC 
Description:
Crash pasting followed by undo swlo!BigPtrArray::operator

Steps to Reproduce:
1. Open attachment 117323 [details]
2. CTRL+A
3. CTRL+C
4. CTRL+N
5. CTRL+V
6. CTRL+Z -> Crash

Actual Results:
Crash

Expected Results:
No crash


Reproducible: Always


User Profile Reset: No

Additional Info:
Version: 26.8.0.0.alpha0+ (X86_64)
Build ID: 680(Build:0)
CPU threads: 4; OS: Windows 10 X86_64 (build 19045); UI render: Skia/Raster; VCL: win
Locale: nl-NL (nl_NL); UI: en-US
Calc: CL threaded
Comment 1 Mateusz Wlazłowski 2026-02-09 17:50:08 UTC 
Crash

Version: 26.8.0.0.alpha0+ (X86_64)
Build ID: d4c50dd103ca97ae2b767afdafe50fd1e3521b48
CPU threads: 8; OS: Linux 6.17; UI render: default; VCL: gtk3
Locale: en-GB (en_US.UTF-8); UI: en-US
Calc: threaded


Even the document recovery crashed after being unresponsive
Comment 2 Telesto 2026-02-09 21:46:18 UTC 
Also in
Version: 7.0.0.3
Build ID: 8061b3e9204bef6b321a21033174034a5e2ea88e
CPU threads: 8; OS: Mac OS X 10.16; UI render: default; VCL: osx
Locale: nl-NL (nl_NL.UTF-8); UI: en-US
Calc: threaded
Comment 3 Telesto 2026-02-12 19:15:16 UTC 
No crash with
Version: 24.8.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 7afd11f8e476884662c18db85445752cc030b2e2
CPU threads: 4; OS: Windows 10.0 Build 19045; UI render: Skia/Raster; VCL: win
Locale: nl-NL (nl_NL); UI: en-US
Calc: CL threaded

adding a tentative bibisectrequest. Not sure if this even possible due to bug 164931
Comment 4 Noah deFer 2026-04-01 13:05:00 UTC 
I was also able to reproduce the crash in
Version: 4.2.0.0.alpha1+
Build ID: fc8f44e82de4ebdd50ac5fbb9207cd1a59a927e3

and

Version: 26.8.0.0.alpha0+ (X86_64)
Build ID: da945e13437a8a04fc663014b2e2c9e0ddcca0b6
CPU threads: 16; OS: Windows 11 X86_64 (build 26200); UI render: Skia/Vulkan; VCL: win
Locale: en-US (en_US); UI: en-US
Calc: CL threaded
Comment 5 bnhep 2026-04-02 05:11:37 UTC 
Reproducible in latest master build:

Version: 26.8.0.0.alpha0+ (X86_64)
Build ID: da945e13437a8a04fc663014b2e2c9e0ddcca0b6
CPU threads: 24; OS: Windows 11 X86_64 (build 26200); UI render: Skia/Vulkan; VCL: win
Locale: de-DE (en_US); UI: en-US
Calc: CL threaded


Found that the issue persisted until it was fixed in:
Version: 7.0.0.0.alpha1+ (x64)
Build ID: 574c57090642347980d2395e1e183cc7b5c171ad
CPU threads: 24; OS: Windows 10.0 Build 26200; UI render: Skia/Vulkan; VCL: win
Locale: en-US (en_US); UI: en-US
Calc: CL

From there on, there has not been any crashes until 26.2.0.0.alpha1+ Windows, thus it's a regression:
Version: 26.2.0.0.alpha1+ (X86_64) / LibreOffice Community
Build ID: 68e1db614c8618f0155d157cb1dc4c6f259b8573
CPU threads: 24; OS: Windows 11 X86_64 (build 26200); UI render: Skia/Vulkan; VCL: win
Locale: en-US (en_US); UI: en-US
Calc: CL threaded

Bibisected with windows repository [bibisect-win64-26.2]
 1cab19c7235222fc406e73ee9b498297682e187d is the first bad commit
commit 1cab19c7235222fc406e73ee9b498297682e187d
Author: Jenkins Build User <tdf@tb102-2>
Date:   Sat Dec 27 06:08:20 2025 +0100

    source 68e1db614c8618f0155d157cb1dc4c6f259b8573

    tdf#148703 Fix Writer crash on undo after paste

Adding Cc: to David Hashe
Comment 6 Buovjaga 2026-07-29 08:48:31 UTC 
Still repro even after recent fix to bug 171068

Arch Linux 64-bit
Version: 27.2.0.0.alpha0+ (X86_64)
Build ID: 08f292b4ae5d817b191b1193ffb760a1003869db
CPU threads: 8; OS: Linux 7.1; UI render: default; VCL: gtk3
Locale: fi-FI (fi_FI.UTF-8); UI: en-US
Calc: CL threaded
Built on 28 July 2026
Comment 7 Buovjaga 2026-07-29 08:56:04 UTC 
Created attachment 207928 [details]
GDB trace of crash