Created attachment 45757 [details] Crash log 1. Start Writer 2. Insert -> Indexes and tables -> Indexes and tables 3. Select type 'Bibliography' 4. Select tab 'Enries' 5. Select, for example, 'Sh' in 'Structure' and click 'Remove' LO crashed here.
Indeed it does. The crash log suggests it's somewhere between VCL and Writer. I'll give this to Caolan.
This may also be related to 36524 and 36957
Looks somewhat different to 36524, a better trace (of master) is: 0 0x00000000 in ?? () #1 0xb692198a in PushButton::SetState (this=0x8fca3b0, eState=STATE_NOCHECK) at /data/opt/libreoffice/bootstrap/clone/libs-gui/vcl/source/control/button.cxx:1763 #2 0xabf9282d in PushButton::Check (this=0x8fca3b0, bCheck=0 '\000') at /data/opt/libreoffice/bootstrap/solver/300/unxlngi6.pro/inc/vcl/button.hxx:216 #3 0xabf8efa3 in SwTokenWindow::TbxFocusHdl (this=0x8f87488, pEdit=0x8fab6c0) at /data/opt/libreoffice/bootstrap/sw/source/ui/index/cnttab.cxx:3597 #4 0xabf8ef2a in SwTokenWindow::LinkStubTbxFocusHdl (pThis=0x8f87488, pCaller=0x8fab6c0) at /data/opt/libreoffice/bootstrap/sw/source/ui/index/cnttab.cxx:3590 #5 0xb6635089 in Link::Call (this=0x8fab7c0, pCaller=0x8fab6c0) at /data/opt/libreoffice/bootstrap/solver/300/unxlngi6.pro/inc/tools/link.hxx:140 #6 0xb692d2b8 in Control::ImplCallEventListenersAndHandler (this=0x8fab6c0, nEvent=1100, rHandler=..., pCaller=0x8fab6c0) at /data/opt/libreoffice/bootstrap/clone/libs-gui/vcl/source/control/ctrl.cxx:384 #7 0xb692ceeb in Control::Notify (this=0x8fab6c0, rNEvt=...) at /data/opt/libreoffice/bootstrap/clone/libs-gui/vcl/source/control/ctrl.cxx:308 #8 0xb68f7e44 in Window::GetFocus (this=0x8fab6c0) at /data/opt/libreoffice/bootstrap/clone/libs-gui/vcl/source/window/window.cxx:4854 #9 0xb692c765 in Control::GetFocus (this=0x8fab6c0) at /data/opt/libreoffice/bootstrap/clone/libs-gui/vcl/source/control/ctrl.cxx:98 Will re-run in valgrind; for step 5. I selected '#' and hit 'delete', since I don't have a 'Remove' button to click it seems :-)
Oooh - looking further it seems we are simply doing a chunk of work on this button while it is being destroyed: #1 0xb692198a in PushButton::SetState (this=0x8fca3b0, eState=STATE_NOCHECK) at /data/opt/libreoffice/bootstrap/clone/libs-gui/vcl/source/control/button.cxx:1763 #2 0xabf9282d in PushButton::Check (this=0x8fca3b0, bCheck=0 '\000') at /data/opt/libreoffice/bootstrap/solver/300/unxlngi6.pro/inc/vcl/button.hxx:216 #3 0xabf8efa3 in SwTokenWindow::TbxFocusHdl (this=0x8f87488, pEdit=0x8fab6c0) at /data/opt/libreoffice/bootstrap/sw/source/ui/index/cnttab.cxx:3597 ... #16 0xb68ffa93 in Window::GrabFocus (this=0x8f876b4) at /data/opt/libreoffice/bootstrap/clone/libs-gui/vcl/source/window/window.cxx:7617 #17 0xb68f7104 in Window::~Window (this=0x8fca3b0, __in_chrg=<value optimized out>) at /data/opt/libreoffice/bootstrap/clone/libs-gui/vcl/source/window/window.cxx:4557 #18 0xb692c6e2 in Control::~Control (this=0x8fca3b0, __in_chrg=<value optimized out>) at /data/opt/libreoffice/bootstrap/clone/libs-gui/vcl/source/control/ctrl.cxx:89 #19 0xb691c127 in Button::~Button (this=0x8fca3b0, __in_chrg=<value optimized out>) at /data/opt/libreoffice/bootstrap/clone/libs-gui/vcl/source/control/button.cxx:144 #20 0xb692041d in PushButton::~PushButton (this=0x8fca3b0, __in_chrg=<value optimized out>) at /data/opt/libreoffice/bootstrap/clone/libs-gui/vcl/source/control/button.cxx:1326 #21 0xabf96e35 in SwTOXButton::~SwTOXButton (this=0x8fca3b0, __in_chrg=<value optimized out>) at /data/opt/libreoffice/bootstrap/sw/source/ui/index/cnttab.cxx:1707 #22 0xabf96e89 in SwTOXButton::~SwTOXButton (this=0x8fca3b0, __in_chrg=<value optimized out>) at /data/opt/libreoffice/bootstrap/sw/source/ui/index/cnttab.cxx:1707 ... #30 0xabf8db21 in SwTokenWindow::RemoveControl (this=0x8f87488, pDel=0x8fca3b0, bInternalCall=1 '\001') at /data/opt/libreoffice/bootstrap/sw/source/ui/index/cnttab.cxx:3256 #31 0xabf85094 in SwTOXButton::KeyInput (this=0x8fca3b0, rKEvt=...) at /data/opt/libreoffice/bootstrap/sw/source/ui/index/cnttab.cxx:1815 #32 0xb690e50e in ImplHandleKey (pWindow=0x8dad0e8, nSVEvent=4, nKeyCode=1286, nCharCode=0, nRepeat=0, bForward=1 '\001')
Fixed by reverting an erroneous boost::ptr_vector conversion in master; Petr - reviewing & cherry-picking to libreoffice-3-4 - should be in Beta5.
*** Bug 36957 has been marked as a duplicate of this bug. ***
Three bugs in one go! Nice work Michael, thanks.
Verified with LibO_3.4.0beta5_Win_x86_install_multi.exe [pre-release] LibreOffice 3.4.0 DEV300m103 (Build:5) Steps as explained in Description: No crash. But please have a look at Bug 36957, which has been marked as a duplicate of this bug: I still can reproduce the crash there.
apparently fixed now