Whow, stupid me :-)
Forgotten the essential step!

(In reply to comment #0)

> - enter, paste special > formatted text (rtf)

- now select cells
- choose menu Table > Merge cells

>   > crash

run with gdb:

[Thread 0xb223bb70 (LWP 4155) exited]
[New Thread 0xb223bb70 (LWP 4171)]
[Thread 0xb223bb70 (LWP 4171) exited]

Program received signal SIGSEGV, Segmentation fault.
0xaa74cf99 in SwModify::Add(SwClient*) () from /home/cono/LibreOffice/350rc3/libreoffice3.5/program/../program/libswlo.so

(does that make sense?)

According to Backtrace this is a Writer bug.

can not reproduce this in 3.3.4, 3.5.0 rc3 and 3.6.0 master on Fedora 64 bit
in 3.5.0 and 3.6.0 nothing inserts into Writer (empty cells copied)
and 3.6.0 complains on console while inserting as formatted RTF:
warn:vcl:2182:1:/home/s/libre-master/core/vcl/source/control/button.cxx:1775: No handler installed for OKButton
warn:legacy.osl:2182:1:/home/s/libre-master/core/writerfilter/source/dmapper/DomainMapper.cxx:1426: PropertyMap has to be valid!
warn:legacy.osl:2182:1:/home/s/libre-master/core/writerfilter/source/dmapper/DomainMapper_Impl.cxx:380: no context of this type available
warn:legacy.osl:2182:1:/home/s/libre-master/core/writerfilter/source/dmapper/DomainMapper_Impl.cxx:354: section stack already empty
warn:legacy.osl:2182:1:/home/s/libre-master/core/writerfilter/source/dmapper/DomainMapper_Impl.cxx:380: no context of this type available
warn:legacy.osl:2182:1:/home/s/libre-master/core/writerfilter/source/dmapper/DomainMapper_Impl.cxx:3534: Section context is not in the stack!

version of master: 97fdf02-9eed775-f061262

@sacha:

(In reply to comment #4)
> can not reproduce this in 3.3.4, 3.5.0 rc3 and 3.6.0 master on Fedora 64 bit

have you noticed that I was so studpid to forget the essential step in my intial report? I corrected that in comment #2!
thanks - Cor

I used these steps:
1. Start Calc and select 2 empty cells
2. press Ctrl-C
3. Start Writer and press Ctrl-Shift-V and selected "Formatted RTF
at this place in 3.3.4 appears table with 2 cells, and in 3.5.0 and 3.6.0 appears nothing
in 3.3.4:
4. Select both cells and use Table-> merge cells

if in step 1 enter something into cells, then in step 3 table appears allways, but not crashes.
My be this problem is 32 bit specific?

(In reply to comment #6)

> at this place in 3.3.4 appears table with 2 cells, and in 3.5.0 and 3.6.0 appears nothing

maybe the boundaries are not visible (Table > Table-boundaries ) ?

> in 3.3.4:
> 4. Select both cells and use Table-> merge cells

It is a 3.5.0 only crash.

> My be this problem is 32 bit specific?

Might be...

Just started Win7 in a virtualBox. Same crash there!

I can reproduce crash on Ubuntu 64 bit, LO 3.5.0RC3
LibreOffice 3.5.0rc3 
Build ID: 7e68ba2-a744ebf-1f241b7-c506db1-7d53735

Created attachment 57735 [details]
bt 3.5 branch with symbols

Reproduced the bug in 3.5 branch (last commit b3a326c16127c9f696e6e4e264729991c4ef4981 from 23/02/2012).
I attached bt with symbols.

Reproduced in (2 days old) master; e9d045f0f476c80060a350c08d8b253eaf41c41f

Steps I used:
1. Create a new spreadsheet document.
2. Type "a" into one cell and "b" into the cell next to it.
3. Copy both cells.
4. Create a new writer document.
5. Paste special (RTF)
6. Merge the cells (in writer).

If I merge beforehand (in spreadsheet), the paste works fine, it's the merge operation which fails.

Trimmed back trace:

#0  SwTableLine::GetUpper (this=0x0)
    at sw/inc/swtable.hxx:347
#1  SwTable::IsTblComplex (this=0x2abd0a0)
    at sw/source/core/table/swtable.cxx:1543
#2  GetTblSel (rCrsr=..., rBoxes=..., eSearchType=2)
    at sw/source/core/frmedt/tblsel.cxx:208
#3  GetTblSel (rShell=..., rBoxes=..., eSearchType=2)
    at sw/source/core/frmedt/tblsel.cxx:180
#4  SwTableShell::GetState (this=0x2a97840, rSet=...)
    at sw/source/ui/shells/tabsh.cxx:1314
#5  SfxStubSwTableShellGetState (pShell=0x2a97840, rSet=...)
    at workdir/unxlngx6.pro/SdiTarget/sw/sdi/swslots.hxx:9872
#6  SfxDispatcher::_FillState(SfxSlotServer const&, SfxItemSet&, SfxSlot const*)()
    from solver/unxlngx6.pro/installation/opt/program/libsfxlo.so
#7  ?? ()
    from solver/unxlngx6.pro/installation/opt/program/libsfxlo.so
#8  ?? ()
    from solver/unxlngx6.pro/installation/opt/program/libsfxlo.so
#9  Timer::ImplTimerCallbackProc() ()
    from solver/unxlngx6.pro/installation/opt/program/libvcllo.so
#10 ?? ()
    from solver/unxlngx6.pro/installation/opt/program/libvclplug_gtklo.so

(In reply to comment #3)
> According to Backtrace this is a Writer bug.

Unless the data pasted from Calc is too special ? ;-)

Checked the contents xml for a table pasted frm Calc and one created in Writer:

PASTED as RTF FROM CALC
<table:table table:name="Table1" table:style-name="Table1">
<table:table-column table:style-name="Table1.A"/>
<table:table-column table:style-name="Table1.B"/>
<table:table-row table:style-name="Table1.1">
<table:table-cell table:style-name="Table1.A1" office:value-type="string">
<text:p text:style-name="P1"/>
</table:table-cell>
<table:table-cell table:style-name="Table1.A1" office:value-type="string">
<text:p text:style-name="P1"/>
</table:table-cell>
</table:table-row>
</table:table>

CREATED IN WRITER
</text:p><table:table table:name="Table2" table:style-name="Table2">
<table:table-column table:style-name="Table2.A"/>
<table:table-column table:style-name="Table2.B"/>
<table:table-row>
<table:table-cell office:value-type="string">
<text:p text:style-name="Table_20_Contents"/>
</table:table-cell>
<table:table-cell office:value-type="string">
<text:p text:style-name="Table_20_Contents"/>
</table:table-cell>
</table:table-row>
</table:table>

I would say, nothing odd..

It occurs that when I create a document, save it, merge to crash and then let the document be recovered, it does not crash again.
Also sometimes after a bit edit /  save the crash does not happen.

So seems to be related to something as a dead reference to whatever ... ?

For the record: Experimental features disabled

Checked with:
LO 3.5.4.2 
Build ID: own W7 debug build
Windows 7 Professional SP1 64 bit

Could not reproduce.

Cannot reproduce this any more in 3.6.0 beta 3
so close as