Steps to reproduce: 1) Open the attached document 2) Make sure the Writer window has a low enough width: reduce it until the horizontal scroll-bar appears. 3) Scroll down to the first empty line, and click on it, so the cursor gets moved there (it's between A41 and A43). 4) Hit backspace to delete the line. 5) Hit page down a few times -> crash. git bisect says: e34dfee7aac32df393a62a13c36fa13f8a6e9589 is the first bad commit commit e34dfee7aac32df393a62a13c36fa13f8a6e9589 Author: Caolán McNamara <caolanm@redhat.com> Date: Wed Jan 15 12:59:37 2014 +0000 Related: #i17171# foul addition of MAX value to offset Change-Id: I5e1cdedeb09883f8ca3410ec51b5b87b7bbd67e3 :040000 040000 651836ba2024f1ebdb242f97a3fb09ba7420826c 18000ee3c1d8a1624ecc948599fa1677fb6d0922 M sw
Created attachment 98292 [details] Reproducer document
Miklos Vajna committed a patch related to this issue. It has been pushed to "master": http://cgit.freedesktop.org/libreoffice/core/commit/?id=cedbbe2f78a6a07d79b43d71f36738b46cf62c38 fdo#78153 SwTxtFrm::ManipOfst() requires a valid position The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.