Bug 36957 - EDITING: Insert TOC – Edit – Writer crashes
Summary: EDITING: Insert TOC – Edit – Writer crashes
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
(earliest affected)
3.4.0 Beta3
Hardware: x86 (IA32) Windows (All)
: medium major
Assignee: Cédric Bosdonnat
Keywords: regression
Depends on:
Reported: 2011-05-08 02:46 UTC by manj_k
Modified: 2011-10-29 07:38 UTC (History)
3 users (show)

See Also:
Crash report or crash signature:

Sample document 'heading1_libo340b3.odt' for reproducing the crash (12.53 KB, application/x-zip)
2011-05-08 02:50 UTC, manj_k

Note You need to log in before you can comment on or make changes to this bug.
Description manj_k 2011-05-08 02:46:15 UTC
[LibO 3.4 Beta3 and Beta4 –
LibreOffice 3.4.0 
DEV300m103 (Build:3) and (Build:4)
on Win XP]

1. Open the attached sample (heading1_libo340b3.odt)
1.1 New empty Writer document
1.2 Let the first line (paragraph style 'Default') empty for TOC
1.3 New paragraph – Type: Heading 1
1.4 Apply paragraph style 'Heading 1'

2. Set cursor in the first line
3. [Menu] Insert > Indexes and Tables > Indexes and Tables
4. Tab 'Entries' (Level 1) Structure
5. Set cursor between 'Chapter Number' (E#) and 'Entry' (E)
6. Click on 'Tab stop'

Bug: Writer crashes.

(Crash also with step 6: Click on 'Hyperlink')

Works fine with LibO 3.3.2
Comment 1 manj_k 2011-05-08 02:50:12 UTC
Created attachment 46445 [details]
Sample document 'heading1_libo340b3.odt' for reproducing the crash
Comment 2 manj_k 2011-05-08 08:37:00 UTC
Maybe causal relation to "Bug 36524 - EDITING: Delete Index causes crash"?
I cannot check it with 3.4 Beta2 (not installed).
Comment 3 Cor Nouws 2011-05-08 12:58:31 UTC
Reproduced on Ubuntu 11.04

Program received signal SIGSEGV, Segmentation fault.
0xb7dee4e8 in vtable for __cxxabiv1::__si_class_type_info ()
   from /home/cono/LibO340beta4/libreoffice/program/../basis-link/ure-link/lib/libstdc++.so.6

I also did (gdb) thread apply all backtrace - for if that could be interesting.
Comment 4 Duncan Lithgow 2011-05-09 06:02:31 UTC
Maybe also related to bug #36340 'LibreOffice 3.4 beta1 crashed on edit bibliography entries style' and as Manj_K suggests bug #36524.

I'm on Windows 7, 64bit, LO 3.4 Beta4

I've been seeing this too, I don't think this was in LO 3.4 Beta3 but it is in Beta4. I also sometimes get the error:

Runtime Error!

Program: C:\Program Files (x86)\LibreOffice 3\program\soffice.bin

This program has requested the Runtime to terminate in an unusual way.
Please contact the application's support team for more information.

My JRE is Sun Microsystems Inc. 1.6.0_24
Comment 5 Michael Meeks 2011-05-10 06:11:06 UTC
Thanks for the great report :-) Luckily, I just fixed this - it should be in Beta5.

*** This bug has been marked as a duplicate of bug 36340 ***
Comment 6 manj_k 2011-05-11 15:37:39 UTC
LibO_3.4.0beta5_Win_x86_install_multi.exe [pre-release]
LibreOffice 3.4.0 
DEV300m103 (Build:5)

I can confirm that Bug 36340 has been fixed.

But I still can reproduce the crash with the TOC, described in this bug.
I'll let the Status RESOLVED DUPLICATE untouched until someone else can confirm the continuous crash.
Comment 7 vitriol 2011-05-11 22:02:25 UTC
I confirm the crash with Beta 5 pre on Win7. Nothing changed.
Comment 8 Duncan Lithgow 2011-05-11 23:45:28 UTC
Marking as REOPENED after previous two comments.
Comment 9 Don't use this account, use tml@iki.fi 2011-05-12 03:31:42 UTC
Debugging this now on Windows.
Comment 10 Don't use this account, use tml@iki.fi 2011-05-12 03:45:25 UTC
Stack trace:

 	[Frames below may be incorrect and/or missing, no symbols loaded for msvcr90.dll]	
>	swuimi.dll!std::_Vector_const_iterator<Control *,std::allocator<Control *> >::operator+=(int _Off=88359)  Line 164	C++
 	swuimi.dll!std::_Vector_iterator<Control *,std::allocator<Control *> >::operator+=(int _Off=88359)  Line 376	C++
 	swuimi.dll!std::_Vector_iterator<Control *,std::allocator<Control *> >::operator+(int _Off=88359)  Line 382 + 0xc bytes	C++
 	swuimi.dll!std::vector<Control *,std::allocator<Control *> >::insert(std::_Vector_const_iterator<Control *,std::allocator<Control *> > _Where=0x0cc1dc88 {aFormToken={...} aPrevNextControlLink={...} bNextControl=0 ...}, Control * const & _Val=0x0cc1dc88)  Line 878 + 0x1b bytes	C++
 	swuimi.dll!SwTokenWindow::InsertAtSelection(const String & rText={...}, const SwFormToken & rToken={...})  Line 3212	C++
 	swuimi.dll!SwTOXEntryTabPage::InsertTokenHdl(PushButton * pBtn=0x0cbe9d94)  Line 2470	C++
 	swuimi.dll!SwTOXEntryTabPage::LinkStubInsertTokenHdl(void * pThis=0x0cbe8e68, void * pCaller=0x0cbe9d94)  Line 2419 + 0xf bytes	C++
 	vclmi.dll!Control::ImplCallEventListenersAndHandler()  + 0x48 bytes	C++
 	vclmi.dll!Button::Click()  + 0x12 bytes	C++
 	vclmi.dll!PushButton::Tracking()  + 0xbe bytes	C++
 	vclmi.dll!Window::EndTracking()  + 0xe2 bytes	C++
 	vclmi.dll!ImplHandleMouseEvent()  + 0xaf9 bytes	C++
Comment 11 Don't use this account, use tml@iki.fi 2011-05-12 06:05:21 UTC

commit f6db07885fc147264a7471fe055c8e842c825ef2
Author: Tor Lillqvist <tlillqvist@novell.com>
Date:   Thu May 12 15:11:12 2011 +0300

    Assign to iterator the return value of insert(), fixes fdo#36957
    Note that the code path through the else branch is likely broken, too.

diff --git a/sw/source/ui/index/cnttab.cxx b/sw/source/ui/index/cnttab.cxx
index f8de59b..ae7dfad 100644
--- a/sw/source/ui/index/cnttab.cxx
+++ b/sw/source/ui/index/cnttab.cxx
@@ -3187,7 +3187,7 @@ void      SwTokenWindow::InsertAtSelection(
         SwFormToken aTmpToken(TOKEN_TEXT);
         SwTOXEdit* pEdit = new SwTOXEdit(&aCtrlParentWin, this, aTmpToken);
-        aControlList.insert(iterInsert, pEdit);
+        iterInsert = aControlList.insert(iterInsert, pEdit);

Will commit to the 3-4 branch once approved.
Comment 12 Don't use this account, use tml@iki.fi 2011-05-12 22:11:46 UTC
Has now been committed to libreoffice-3-4, will be merged to master eventually.
Comment 13 manj_k 2011-05-19 11:48:08 UTC
Verified with 
LibO 3.4 RC1 – LibreOffice 3.4.0 OOO340m1 (Build:11) [on WinXP 32b]

Editing the TOC (tested: 'Tab stop' and 'Hyperlink') works well.