Bug 91131 - UI: Crash when deleting List Style after trying to create new style with same name
Summary: UI: Crash when deleting List Style after trying to create new style with sam...
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
4.4.2.2 release
Hardware: x86-64 (AMD64) All
: medium major
Assignee: Michael Stahl (allotropia)
URL:
Whiteboard: target:5.2.0 target:5.1.2
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2015-05-07 12:22 UTC by Gordo
Modified: 2016-10-25 19:08 UTC (History)
5 users (show)

See Also:
Crash report or crash signature:

Attachments
backtraces (3.67 KB, application/zip)
2015-05-07 12:22 UTC, Gordo 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Gordo 2015-05-07 12:22:12 UTC 
Created attachment 115408 [details]
backtraces

Initial version:
1. New Text Document.
2. Styles and Formatting → List Styles → Right Click → New.
3. In Organiser tab, type “test” in Name and OK.
4. Styles and Formatting → Paragraph Styles → Right Click on “Heading 1” → New.
5. In Organiser tab, type “H1” in Name and OK.
6. In Outline & Numbering tab, change Outline level to “Level 1” and Numbering style to “test” and OK.
7. In document, type “test” and apply “H1” paragraph style.
8. Styles and Formatting → List Styles → Right Click on “test”→ Delete.
9. “One or more of the selected styles is in use in this document.
If you delete these styles, text will revert to the parent style.
Do you still wish to delete these styles?
Styles in use: test” and click Yes.
Note:
“test” no longer appears in list of styles.
10. Styles and Formatting → List Styles → Right Click → New.
11. In Organiser tab, type “test” in Name and OK.
12. “This name is already in use.” and click OK and Cancel.
Note:
“test” reappears in list of styles.
13. Styles and Formatting → Paragraph Styles → Right Click on “H1” → Modify.
14. In Outline & Numbering tab, change Outline level to “Body text” and Numbering style to “None” and OK.
15. Styles and Formatting → List Styles → Right Click on “test”→ Delete.
Result:
Crash.

After step 9, if you change to another Style Category and back to List Styles then “test” reappears.

I thought it was because there was no parent to fall back on since you cannot create a List Style based on another.  But then I trimmed the steps down and excluded the style being used.

Distilled version:
1. New Text Document.
2. Styles and Formatting → List Styles → Right Click → New.
3. In Organiser tab, type “test” in Name and OK.
4. Styles and Formatting → List Styles → Right Click → New.
5. In Organiser tab, type “test” in Name and OK.
6. “This name is already in use.” and click OK and Cancel.
7. Styles and Formatting → List Styles → Right Click on “test”→ Delete.
Result:
Crash.

Tried the same (distilled) with Paragraph, Character, Frame, and Page Styles but no crash.

Version: 4.4.3.2
Build ID: 88805f81e9fe61362df02b9941de8e38a9b5fd16
Comment 1 Gordo 2015-05-08 17:47:58 UTC 
Same thing here.

Version: 5.0.0.0.alpha1+
Build ID: 520400e8faf8e7346d16f34babb6258033673e12
TinderBox: Win-x86@39, Branch:master, Time: 2015-05-08_12:19:40
Comment 2 Buovjaga 2015-05-15 10:00:32 UTC 
Reproduced crash.

4.2.8.2 doesn't crash, but has a different quirk: after you delete the test list style, go to paragraph styles and then back to list styles, the test style has re-appeared! You can even delete it again.

Win 7 Pro 64-bit Version: 5.0.0.0.alpha1+
Build ID: 9de1d53a2ce3ee7036b4688b373db7b2235af4d9
TinderBox: Win-x86@39, Branch:master, Time: 2015-05-14_00:07:12
Locale: fi-FI (fi_FI)

Ubuntu 15.04 64-bit 
Version: 4.4.2.2
Build ID: 40m0(Build:2)
Locale: en_US

Version: 4.2.8.2
Build ID: 48d50dbfc06349262c9d50868e5c1f630a573ebd
Comment 3 Julien Nabet 2015-06-17 20:10:56 UTC 
On pc Debian x86-64 with master sources updated today, I could reproduce this.
I noticed this on console:
warn:legacy.osl:4233:1:sw/source/core/undo/docundo.cxx:247: EndUndo(): given ID different from StartUndo()
Comment 4 raal 2015-11-19 20:52:15 UTC 
This seems to have begun at the below commit.
Adding Cc: to Michael Stahl ; Could you possibly take a look at this one?
Thanks
 90012cb7ba832730701e29655d352a5929a14161 is the first bad commit
commit 90012cb7ba832730701e29655d352a5929a14161
Author: Matthew Francis <mjay.francis@gmail.com>
Date:   Sat Mar 14 23:46:36 2015 +0800

    source-hash-81b594afa7162552fc2489ba0c7e1e8b5addb4f2
    
    commit 81b594afa7162552fc2489ba0c7e1e8b5addb4f2
    Author:     Michael Stahl <mstahl@redhat.com>
    AuthorDate: Thu Jul 24 13:42:00 2014 +0200
    Commit:     Michael Stahl <mstahl@redhat.com>
    CommitDate: Thu Jul 24 13:45:55 2014 +0200
    
        svl: remove some odd and obsolete debugging code related to MI_HATS_REPARIERT
    
        This was apparently disabled before the MI_HATS_REPARIERT check was
        removed in f03a3edf2523c208948059861e0df48567834d0d, and then yesterday
        something in the header inclusions changed to enable the DBG macros that
        still used the removed stuff, but _only_ on Windows... now clean this up.
    
        Change-Id: I4222db252f4a886b3497ca0c22dbec26eaa6c994

bibisect-44max$ git bisect log
# bad: [cf6ea17155fabb2a120ba07c150735591ac861d7] source-hash-3f94c9e9ddfd807b449f3bb9b232cf2041fa12d2
# good: [fc71ac001f16209654d15ef8c1c4018aa55769f5] source-hash-c15927f20d4727c3b8de68497b6949e72f9e6e9e
git bisect start 'latest' 'oldest'
# bad: [8cf60cc706948588e2f33a6d98b7c55d454e362a] source-hash-f340f0454627939f1830826fb5cc53a90e6c62a4
git bisect bad 8cf60cc706948588e2f33a6d98b7c55d454e362a
# good: [d9885f526fc7a09cc8f9f8ee643af1b966be24bb] source-hash-d1465c64c6f64ad8dd25e40cdc69649b24b305ea
git bisect good d9885f526fc7a09cc8f9f8ee643af1b966be24bb
# bad: [c779cf7967f4d14c5e649a5c696b07279d550efd] source-hash-e9c5022580f14c0ca97503f8b3cc56b530fff174
git bisect bad c779cf7967f4d14c5e649a5c696b07279d550efd
# good: [030e0477638f9d9110ad62f88fd4b881521e0541] source-hash-1a6e47e3fda10e6d220b67d766ec6fbdfd852b80
git bisect good 030e0477638f9d9110ad62f88fd4b881521e0541
# good: [c9e7f255b30a0410226b2074702aeba9b49dce13] source-hash-2d5a7c36ee9ae7ff39d8415f81fb911ff822548e
git bisect good c9e7f255b30a0410226b2074702aeba9b49dce13
# bad: [0996e94321008e9f1857c299efad9dc3bc6e5ff2] source-hash-6c1f2ea2aa11b2c8fd42b455c7c452194ed2c1e7
git bisect bad 0996e94321008e9f1857c299efad9dc3bc6e5ff2
# good: [c69835b63d379747e58c9d6315dbf32a09e842ef] source-hash-d5fb4b731938c22fcf9c5e3280da8f722b5492e4
git bisect good c69835b63d379747e58c9d6315dbf32a09e842ef
# bad: [90012cb7ba832730701e29655d352a5929a14161] source-hash-81b594afa7162552fc2489ba0c7e1e8b5addb4f2
git bisect bad 90012cb7ba832730701e29655d352a5929a14161
# good: [1c81f4ba81c4e3b78798881afd8f4099156dedb2] source-hash-d6551bde0bcd06e4ed6b9aaa47f7891e47511264
git bisect good 1c81f4ba81c4e3b78798881afd8f4099156dedb2
# good: [33219b2f24783028d49cc92dd56e79b1f923e721] source-hash-b8a72f7e344fec02a0ea0fcc3848d5960a21fc0b
git bisect good 33219b2f24783028d49cc92dd56e79b1f923e721
# good: [ab96982967eb1bbfb7690ed03e6610b5604869fb] source-hash-fb743559fb993d2d8d8b61354e734c27d9d13e1c
git bisect good ab96982967eb1bbfb7690ed03e6610b5604869fb
# good: [30dc08dd79c93996723a8add24705e790868ddef] source-hash-e08fc65e5fe716c838b0c0dc29d337967df5380f
git bisect good 30dc08dd79c93996723a8add24705e790868ddef
# good: [3001a2cb287cded294078fba259e51557086feef] source-hash-e904562af54545684b32d2042ded6bdb9459edca
git bisect good 3001a2cb287cded294078fba259e51557086feef
# first bad commit: [90012cb7ba832730701e29655d352a5929a14161] source-hash-81b594afa7162552fc2489ba0c7e1e8b5addb4f2
Comment 5 Robinson Tryon (qubit) 2015-12-13 11:13:22 UTC Comment hidden (obsolete)
Comment 6 Michael Stahl (allotropia) 2016-03-02 14:10:38 UTC 
the crash is somewhat intermittent, so no surprise that the bibisect in comment #4 is bogus...

==12226== Invalid read of size 8
==12226==    at 0x3CB85C1B: SwList::GetListId() const (list.cxx:227)
==12226==    by 0x3CB0533F: sw::DocumentListsManager::deleteListForListStyle(rtl::OUString const&) (DocumentListsManager.cxx:142)
==12226==    by 0x3CAA501D: SwDoc::DelNumRule(rtl::OUString const&, bool) (docnum.cxx:1029)
==12226==    by 0x3D4FF5DD: SwDocStyleSheetPool::Remove(SfxStyleSheetBase*) (docstyle.cxx:2367)
==12226==    by 0x3D4F3BDB: SwDocShell::Delete(rtl::OUString const&, unsigned short) (docst.cxx:876)
==12226==    by 0x3D4F1CB6: SwDocShell::ExecStyleSheet(SfxRequest&) (docst.cxx:461)
==12226==    by 0x3D4D7AC7: SfxStubSwDocShellExecStyleSheet(SfxShell*, SfxRequest&) (swslots.hxx:1351)
==12226==    by 0x8E96FEB: SfxShell::CallExec(void (*)(SfxShell*, SfxRequest&), SfxRequest&) (shell.hxx:204)
==12226==    by 0x8E8DFD1: SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, bool) (dispatch.cxx:262)
==12226==    by 0x8E90F1F: SfxDispatcher::_Execute(SfxShell&, SfxSlot const&, SfxRequest&, SfxCallMode) (dispatch.cxx:852)
==12226==    by 0x8E91679: SfxDispatcher::Execute(unsigned short, SfxCallMode, SfxPoolItem const**, unsigned short, SfxPoolItem const**) (dispatch.cxx:970)
==12226==    by 0x8FE543A: SfxCommonTemplateDialog_Impl::Execute_Impl(unsigned short, rtl::OUString const&, rtl::OUString const&, unsigned short, unsigned short, unsigned short*, unsigned short const*) (templdlg.cxx:1609)
==12226==    by 0x8FE764B: SfxCommonTemplateDialog_Impl::DeleteHdl(void*) (templdlg.cxx:1975)
==12226==    by 0x8FE867C: SfxCommonTemplateDialog_Impl::MenuSelectAsyncHdl(void*) (templdlg.cxx:2150)
==12226==    by 0x8FE85FC: SfxCommonTemplateDialog_Impl::LinkStubMenuSelectAsyncHdl(void*, void*) (templdlg.cxx:2145)
==12226==    by 0xD1EADAA: Link<void*, void>::Call(void*) const (link.hxx:84)
==12226==    by 0xD1E7C59: ImplHandleUserEvent(ImplSVEvent*) (winproc.cxx:1960)
==12226==    by 0xD1E961E: ImplWindowFrameProc(vcl::Window*, unsigned short, void const*) (winproc.cxx:2528)
==12226==    by 0xD731984: SalFrame::CallCallback(unsigned short, void const*) const (salframe.hxx:269)
==12226==    by 0xD741848: SalGenericDisplay::DispatchInternalEvent() (gendisp.cxx:86)
==12226==    by 0x28BAE543: GtkData::userEventFn(void*) (gtk3gtkdata.cxx:809)
==12226==    by 0x28BAE5D0: call_userEventFn (gtk3gtkdata.cxx:819)
==12226==    by 0x15206E39: g_main_dispatch (gmain.c:3154)
==12226==    by 0x15206E39: g_main_context_dispatch (gmain.c:3769)
==12226==    by 0x152071CF: g_main_context_iterate.isra.29 (gmain.c:3840)
==12226==    by 0x1520727B: g_main_context_iteration (gmain.c:3901)
==12226==    by 0x28BAD3E1: GtkData::Yield(bool, bool) (gtk3gtkdata.cxx:467)
==12226==    by 0x28BB0672: GtkInstance::DoYield(bool, bool, unsigned long) (gtkinst.cxx:407)
==12226==    by 0xD5F0BAC: ImplYield(bool, bool, unsigned long) (svapp.cxx:509)
==12226==    by 0xD5EC9D3: Application::Yield() (svapp.cxx:551)
==12226==    by 0xD5EC84D: Application::Execute() (svapp.cxx:471)
==12226==    by 0x5110852: desktop::Desktop::DoExecute() (app.cxx:1332)
==12226==    by 0x5111A13: desktop::Desktop::Main() (app.cxx:1657)
==12226==    by 0xD5FB313: ImplSVMain() (svmain.cxx:167)
==12226==    by 0xD5FB455: SVMain() (svmain.cxx:204)
==12226==    by 0x51620D7: soffice_main (sofficemain.cxx:135)
==12226==    by 0x40095D: sal_main (main.c:48)
==12226==    by 0x400943: main (main.c:47)
==12226==  Address 0x32ca2120 is 0 bytes inside a block of size 8 free'd
==12226==    at 0x4C2A2B0: operator delete(void*) (vg_replace_malloc.c:576)
==12226==    by 0x3CB04ECC: sw::DocumentListsManager::deleteList(rtl::OUString const&) (DocumentListsManager.cxx:68)
==12226==    by 0x3CB05578: sw::DocumentListsManager::deleteListsByDefaultListStyle(rtl::OUString const&) (DocumentListsManager.cxx:169)
==12226==    by 0x3CAA5045: SwDoc::DelNumRule(rtl::OUString const&, bool) (docnum.cxx:1030)
==12226==    by 0x3D0BFC01: SwUndoNumruleCreate::UndoImpl(sw::UndoRedoContext&) (SwUndoFmt.cxx:393)
==12226==    by 0x3D0E4313: SwUndo::UndoWithContext(SfxUndoContext&) (undobj.cxx:218)
==12226==    by 0x9B46451: SfxListUndoAction::UndoWithContext(SfxUndoContext&) (undo.cxx:1347)
==12226==    by 0x9B43612: SfxUndoManager::ImplUndo(SfxUndoContext*) (undo.cxx:806)
==12226==    by 0x9B433D0: SfxUndoManager::UndoWithContext(SfxUndoContext&) (undo.cxx:774)
==12226==    by 0x3D0C4477: sw::UndoManager::impl_DoUndoRedo(sw::UndoManager::UndoOrRedo_t) (docundo.cxx:488)
==12226==    by 0x3D0C45F6: sw::UndoManager::Undo() (docundo.cxx:521)
==12226==    by 0x3CD0325E: SwEditShell::Undo(unsigned short) (edundo.cxx:131)
==12226==    by 0x3D4F3648: SwDocShell::Edit(rtl::OUString const&, rtl::OUString const&, unsigned short, unsigned short, bool, rtl::OString const&, SwWrtShell*, bool) (docst.cxx:817)
==12226==    by 0x3D4F10DE: SwDocShell::ExecStyleSheet(SfxRequest&) (docst.cxx:298)
==12226==    by 0x3D4D7AC7: SfxStubSwDocShellExecStyleSheet(SfxShell*, SfxRequest&) (swslots.hxx:1351)
==12226==    by 0x8E96FEB: SfxShell::CallExec(void (*)(SfxShell*, SfxRequest&), SfxRequest&) (shell.hxx:204)
==12226==    by 0x8E8DFD1: SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, bool) (dispatch.cxx:262)
==12226==    by 0x8E90F1F: SfxDispatcher::_Execute(SfxShell&, SfxSlot const&, SfxRequest&, SfxCallMode) (dispatch.cxx:852)
==12226==    by 0x8E91679: SfxDispatcher::Execute(unsigned short, SfxCallMode, SfxPoolItem const**, unsigned short, SfxPoolItem const**) (dispatch.cxx:970)
==12226==    by 0x8FE543A: SfxCommonTemplateDialog_Impl::Execute_Impl(unsigned short, rtl::OUString const&, rtl::OUString const&, unsigned short, unsigned short, unsigned short*, unsigned short const*) (templdlg.cxx:1609)
==12226==    by 0x8FE6E8A: SfxCommonTemplateDialog_Impl::NewHdl(void*) (templdlg.cxx:1888)
==12226==    by 0x8FE8656: SfxCommonTemplateDialog_Impl::MenuSelectAsyncHdl(void*) (templdlg.cxx:2148)
==12226==    by 0x8FE85FC: SfxCommonTemplateDialog_Impl::LinkStubMenuSelectAsyncHdl(void*, void*) (templdlg.cxx:2145)
==12226==    by 0xD1EADAA: Link<void*, void>::Call(void*) const (link.hxx:84)
==12226==    by 0xD1E7C59: ImplHandleUserEvent(ImplSVEvent*) (winproc.cxx:1960)
==12226==    by 0xD1E961E: ImplWindowFrameProc(vcl::Window*, unsigned short, void const*) (winproc.cxx:2528)
==12226==    by 0xD731984: SalFrame::CallCallback(unsigned short, void const*) const (salframe.hxx:269)
==12226==    by 0xD741848: SalGenericDisplay::DispatchInternalEvent() (gendisp.cxx:86)
==12226==    by 0x28BAE543: GtkData::userEventFn(void*) (gtk3gtkdata.cxx:809)
==12226==    by 0x28BAE5D0: call_userEventFn (gtk3gtkdata.cxx:819)
==12226==    by 0x15206E39: g_main_dispatch (gmain.c:3154)
==12226==    by 0x15206E39: g_main_context_dispatch (gmain.c:3769)
==12226==    by 0x152071CF: g_main_context_iterate.isra.29 (gmain.c:3840)
==12226==    by 0x1520727B: g_main_context_iteration (gmain.c:3901)
==12226==    by 0x28BAD3E1: GtkData::Yield(bool, bool) (gtk3gtkdata.cxx:467)
==12226==    by 0x28BB0672: GtkInstance::DoYield(bool, bool, unsigned long) (gtkinst.cxx:407)
==12226==    by 0xD5F0BAC: ImplYield(bool, bool, unsigned long) (svapp.cxx:509)
==12226==    by 0xD5EC9D3: Application::Yield() (svapp.cxx:551)
==12226==    by 0xD5EC84D: Application::Execute() (svapp.cxx:471)
==12226==    by 0x5110852: desktop::Desktop::DoExecute() (app.cxx:1332)
==12226==    by 0x5111A13: desktop::Desktop::Main() (app.cxx:1657)
==12226==    by 0xD5FB313: ImplSVMain() (svmain.cxx:167)
==12226==    by 0xD5FB455: SVMain() (svmain.cxx:204)
==12226==    by 0x51620D7: soffice_main (sofficemain.cxx:135)
==12226==    by 0x40095D: sal_main (main.c:48)
==12226==    by 0x400943: main (main.c:47)
==12226==  Block was alloc'd at
==12226==    at 0x4C29326: operator new(unsigned long) (vg_replace_malloc.c:334)
==12226==    by 0x3CB04DBE: sw::DocumentListsManager::createList(rtl::OUString const&, rtl::OUString const&) (DocumentListsManager.cxx:56)
==12226==    by 0x3CB05126: sw::DocumentListsManager::createListForListStyle(rtl::OUString const&) (DocumentListsManager.cxx:112)
==12226==    by 0x3CAA97E1: SwDoc::AddNumRule(SwNumRule*) (docnum.cxx:2142)
==12226==    by 0x3CAA9A13: SwDoc::MakeNumRule(rtl::OUString const&, SwNumRule const*, bool, SvxNumberFormat::SvxNumPositionAndSpaceMode) (docnum.cxx:2174)
==12226==    by 0x3D4FE391: SwDocStyleSheet::Create() (docstyle.cxx:2018)
==12226==    by 0x3D4FF2C3: SwDocStyleSheetPool::Make(rtl::OUString const&, SfxStyleFamily, unsigned short) (docstyle.cxx:2300)
==12226==    by 0x3D4F2945: SwDocShell::Edit(rtl::OUString const&, rtl::OUString const&, unsigned short, unsigned short, bool, rtl::OString const&, SwWrtShell*, bool) (docst.cxx:647)
==12226==    by 0x3D4F10DE: SwDocShell::ExecStyleSheet(SfxRequest&) (docst.cxx:298)
==12226==    by 0x3D4D7AC7: SfxStubSwDocShellExecStyleSheet(SfxShell*, SfxRequest&) (swslots.hxx:1351)
==12226==    by 0x8E96FEB: SfxShell::CallExec(void (*)(SfxShell*, SfxRequest&), SfxRequest&) (shell.hxx:204)
==12226==    by 0x8E8DFD1: SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, bool) (dispatch.cxx:262)
==12226==    by 0x8E90F1F: SfxDispatcher::_Execute(SfxShell&, SfxSlot const&, SfxRequest&, SfxCallMode) (dispatch.cxx:852)
==12226==    by 0x8E91679: SfxDispatcher::Execute(unsigned short, SfxCallMode, SfxPoolItem const**, unsigned short, SfxPoolItem const**) (dispatch.cxx:970)
==12226==    by 0x8FE543A: SfxCommonTemplateDialog_Impl::Execute_Impl(unsigned short, rtl::OUString const&, rtl::OUString const&, unsigned short, unsigned short, unsigned short*, unsigned short const*) (templdlg.cxx:1609)
==12226==    by 0x8FE6E8A: SfxCommonTemplateDialog_Impl::NewHdl(void*) (templdlg.cxx:1888)
==12226==    by 0x8FE8656: SfxCommonTemplateDialog_Impl::MenuSelectAsyncHdl(void*) (templdlg.cxx:2148)
==12226==    by 0x8FE85FC: SfxCommonTemplateDialog_Impl::LinkStubMenuSelectAsyncHdl(void*, void*) (templdlg.cxx:2145)
==12226==    by 0xD1EADAA: Link<void*, void>::Call(void*) const (link.hxx:84)
==12226==    by 0xD1E7C59: ImplHandleUserEvent(ImplSVEvent*) (winproc.cxx:1960)
==12226==    by 0xD1E961E: ImplWindowFrameProc(vcl::Window*, unsigned short, void const*) (winproc.cxx:2528)
==12226==    by 0xD731984: SalFrame::CallCallback(unsigned short, void const*) const (salframe.hxx:269)
==12226==    by 0xD741848: SalGenericDisplay::DispatchInternalEvent() (gendisp.cxx:86)
==12226==    by 0x28BAE543: GtkData::userEventFn(void*) (gtk3gtkdata.cxx:809)
==12226==    by 0x28BAE5D0: call_userEventFn (gtk3gtkdata.cxx:819)
==12226==    by 0x15206E39: g_main_dispatch (gmain.c:3154)
==12226==    by 0x15206E39: g_main_context_dispatch (gmain.c:3769)
==12226==    by 0x152071CF: g_main_context_iterate.isra.29 (gmain.c:3840)
==12226==    by 0x1520727B: g_main_context_iteration (gmain.c:3901)
==12226==    by 0x28BAD3E1: GtkData::Yield(bool, bool) (gtk3gtkdata.cxx:467)
==12226==    by 0x28BB0672: GtkInstance::DoYield(bool, bool, unsigned long) (gtkinst.cxx:407)
==12226==    by 0xD5F0BAC: ImplYield(bool, bool, unsigned long) (svapp.cxx:509)
==12226==    by 0xD5EC9D3: Application::Yield() (svapp.cxx:551)
==12226==    by 0xD5EC84D: Application::Execute() (svapp.cxx:471)
==12226==    by 0x5110852: desktop::Desktop::DoExecute() (app.cxx:1332)
==12226==    by 0x5111A13: desktop::Desktop::Main() (app.cxx:1657)
==12226==    by 0xD5FB313: ImplSVMain() (svmain.cxx:167)
==12226==    by 0xD5FB455: SVMain() (svmain.cxx:204)
==12226==    by 0x51620D7: soffice_main (sofficemain.cxx:135)
==12226==    by 0x40095D: sal_main (main.c:48)
==12226==    by 0x400943: main (main.c:47)
==12226==


the code in SwWrtShell::Edit was last changed by:

commit 39f306df1d5f8daa4747f1e3b26e853c001669f5
Author:     Caolán McNamara <caolanm@redhat.com>
AuthorDate: Fri Apr 3 11:19:10 2015 +0100

    Resolves: tdf#90099 group new style and change style together as one undo
    

let's see if reverting that gets rid of the valgrind warning...
no, get the same warning, so it's even older than that...
4.3.7.2 does not produce the valgrind warning...

well no idea what caused this regression but i think i have fixed the problem on master.
Comment 7 Commit Notification 2016-03-02 14:12:33 UTC 
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=69ff012f1a2d10b3284586474f2add4e88eabcfb

sw: tdf#91131 when renaming a SwNumRule, also ...

It will be available in 5.2.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 8 Commit Notification 2016-03-03 16:13:16 UTC 
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-5-1":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=ff202419fc61081d8dff17fbf8a543fc0f47bf48&h=libreoffice-5-1

sw: tdf#91131 when renaming a SwNumRule, also ...

It will be available in 5.1.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.