Created attachment 118513 [details] bug reproducer document I found reproducible problem with GTK3 (gtk and gen works correctly). I attached document I used to reproduce. Contains just empty document with frame containing caption with vertical orientation. I didn't verified whether the orientation is relevant but you should have all the required information available. Feel free to ask for more, I have stored the dump. How to reproduce: 1] open attached document 2] hover your mouse cursor above the text (without selecting the frame) 3] select the text 4] click outside of frame (so the selected text is unselected again) 5] BOOM! backtrace: (gdb) bt #0 0x00007f09e58a0dce in VclGtkClipboard::ClipboardGet(_GtkClipboard*, _GtkSelectionData*, unsigned int) () from /usr/lib64/libreoffice/program/libvclplug_gtk3lo.so #1 0x00007f09e43e2d65 in g_closure_invoke (closure=0x61f5700, return_value=0x0, n_param_values=4, param_values=0x7ffc6441b710, invocation_hint=0x7ffc6441b6b0) at gclosure.c:768 #2 0x00007f09e43f3e81 in signal_emit_unlocked_R (node=node@entry=0x2f84240, detail=detail@entry=0, instance=instance@entry=0x3392570, emission_return=emission_return@entry=0x0, instance_and_params=instance_and_params@entry=0x7ffc6441b710) at gsignal.c:3549 #3 0x00007f09e43fc77e in g_signal_emit_valist (instance=instance@entry=0x3392570, signal_id=signal_id@entry=50, detail=detail@entry=0, var_args=var_args@entry=0x7ffc6441b910) at gsignal.c:3305 #4 0x00007f09e43fcf95 in g_signal_emit_by_name (instance=instance@entry=0x3392570, detailed_signal=detailed_signal@entry=0x7f09e5357762 "selection-get") at gsignal.c:3401 #5 0x00007f09e520b5fb in gtk_selection_invoke_handler (widget=0x3392570, data=0x7ffc6441bab0, time=0) at gtkselection.c:3059 #6 0x00007f09e520cfc6 in _gtk_selection_request (widget=0x3392570, event=0x43970f0) at gtkselection.c:2456 #7 0x00007f09e518add7 in _gtk_marshal_BOOLEAN__BOXEDv (closure=0x2f840f0, return_value=0x7ffc6441bc80, instance=<optimized out>, args=<optimized out>, marshal_data=<optimized out>, n_params=<optimized out>, param_types=0x2f84120) at gtkmarshalers.c:130 #8 0x00007f09e43e2f94 in _g_closure_invoke_va (closure=0x2f840f0, return_value=0x7ffc6441bc80, instance=0x3392570, args=0x7ffc6441bd88, n_params=<optimized out>, param_types=0x2f84120) at gclosure.c:831 #9 0x00007f09e43fbfbc in g_signal_emit_valist (instance=0x3392570, signal_id=<optimized out>, detail=0, var_args=var_args@entry=0x7ffc6441bd88) at gsignal.c:3214 #10 0x00007f09e43fcae2 in g_signal_emit (instance=instance@entry=0x3392570, signal_id=<optimized out>, detail=detail@entry=0) at gsignal.c:3361 #11 0x00007f09e52baeac in gtk_widget_event_internal (widget=0x3392570, event=0x43970f0) at gtkwidget.c:7787 #12 0x00007f09e5189e0a in gtk_main_do_event (event=0x43970f0) at gtkmain.c:1698 #13 0x00007f09e4d10672 in gdk_event_source_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at gdkeventsource.c:364 #14 0x00007f09eb899cc7 in g_main_dispatch (context=0x2f9d5f0) at gmain.c:3122 #15 g_main_context_dispatch (context=context@entry=0x2f9d5f0) at gmain.c:3737 #16 0x00007f09eb899ef8 in g_main_context_iterate (context=context@entry=0x2f9d5f0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3808 #17 0x00007f09eb899f9c in g_main_context_iteration (context=0x2f9d5f0, may_block=1) at gmain.c:3869 #18 0x00007f09e589e897 in GtkData::Yield(bool, bool) () from /usr/lib64/libreoffice/program/libvclplug_gtk3lo.so #19 0x00007f09f8539443 in ImplYield (i_bAllEvents=false, i_bWait=true) at /usr/src/debug/libreoffice-5.0.1.2/vcl/source/app/svapp.cxx:353 #20 Application::Yield () at /usr/src/debug/libreoffice-5.0.1.2/vcl/source/app/svapp.cxx:382 #21 0x00007f09f85394c5 in Application::Execute () at /usr/src/debug/libreoffice-5.0.1.2/vcl/source/app/svapp.cxx:336 #22 0x00007f09f76d5f5b in desktop::Desktop::Main (this=0x7ffc6441c3e0) at /usr/src/debug/libreoffice-5.0.1.2/desktop/source/app/app.cxx:1605 #23 0x00007f09f853e4d1 in ImplSVMain () at /usr/src/debug/libreoffice-5.0.1.2/vcl/source/app/svmain.cxx:162 #24 0x00007f09f853e512 in SVMain () at /usr/src/debug/libreoffice-5.0.1.2/vcl/source/app/svmain.cxx:196 #25 0x00007f09f76f314f in soffice_main () at /usr/src/debug/libreoffice-5.0.1.2/desktop/source/app/sofficemain.cxx:96 #26 0x000000000040071b in sal_main () at /usr/src/debug/libreoffice-5.0.1.2/desktop/source/app/main.c:48 #27 main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/libreoffice-5.0.1.2/desktop/source/app/main.c:47 full backtrace: #0 0x00007f09e58a0dce in VclGtkClipboard::ClipboardGet(_GtkClipboard*, _GtkSelectionData*, unsigned int) () from /usr/lib64/libreoffice/program/libvclplug_gtk3lo.so No symbol table info available. #1 0x00007f09e43e2d65 in g_closure_invoke (closure=0x61f5700, return_value=0x0, n_param_values=4, param_values=0x7ffc6441b710, invocation_hint=0x7ffc6441b6b0) at gclosure.c:768 marshal = <optimized out> marshal_data = <optimized out> in_marshal = 0 real_closure = 0x61f56e0 __func__ = "g_closure_invoke" #2 0x00007f09e43f3e81 in signal_emit_unlocked_R (node=node@entry=0x2f84240, detail=detail@entry=0, instance=instance@entry=0x3392570, emission_return=emission_return@entry=0x0, instance_and_params=instance_and_params@entry=0x7ffc6441b710) at gsignal.c:3549 tmp = <optimized out> handler = 0x58e6150 accumulator = 0x0 emission = {next = 0x7ffc6441bcc0, instance = 0x3392570, ihint = {signal_id = 50, detail = 0, run_type = G_SIGNAL_RUN_FIRST}, state = EMISSION_RUN, chain_type = 4} handler_list = <optimized out> return_accu = 0x0 accu = {g_type = 0, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}} signal_id = 50 max_sequential_handler_number = 11779 return_value_altered = 0 #3 0x00007f09e43fc77e in g_signal_emit_valist (instance=instance@entry=0x3392570, signal_id=signal_id@entry=50, detail=detail@entry=0, var_args=var_args@entry=0x7ffc6441b910) at gsignal.c:3305 instance_and_params = 0x7ffc6441b710 signal_return_type = <optimized out> param_values = 0x7ffc6441b728 i = <optimized out> n_params = <optimized out> __func__ = "g_signal_emit_valist" #4 0x00007f09e43fcf95 in g_signal_emit_by_name (instance=instance@entry=0x3392570, detailed_signal=detailed_signal@entry=0x7f09e5357762 "selection-get") at gsignal.c:3401 var_args = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7ffc6441ba50, reg_save_area = 0x7ffc6441b960}} detail = 0 signal_id = 50 itype = 102714032 __func__ = "g_signal_emit_by_name" #5 0x00007f09e520b5fb in gtk_selection_invoke_handler (widget=0x3392570, data=0x7ffc6441bab0, time=0) at gtkselection.c:3059 target_list = <optimized out> info = 13 #6 0x00007f09e520cfc6 in _gtk_selection_request (widget=0x3392570, event=0x43970f0) at gtkselection.c:2456 data = {selection = 0x1, target = 0x46, type = 0x2fa8074, format = 4096, data = 0x0, length = -1, display = 0x2fb2050} items = 4294967296 display = <optimized out> info = 0x660cc30 tmp_list = <optimized out> i = 0 selection_max_size = 262144 __func__ = "_gtk_selection_request" #7 0x00007f09e518add7 in _gtk_marshal_BOOLEAN__BOXEDv (closure=0x2f840f0, return_value=0x7ffc6441bc80, instance=<optimized out>, args=<optimized out>, marshal_data=<optimized out>, n_params=<optimized out>, param_types=0x2f84120) at gtkmarshalers.c:130 cc = <optimized out> data1 = <optimized out> data2 = <optimized out> callback = <optimized out> arg0 = 0x43970f0 args_copy = {{gp_offset = 32, fp_offset = 48, overflow_arg_area = 0x7ffc6441be60, reg_save_area = 0x7ffc6441bda0}} v_return = <optimized out> __func__ = "_gtk_marshal_BOOLEAN__BOXEDv" #8 0x00007f09e43e2f94 in _g_closure_invoke_va (closure=0x2f840f0, return_value=0x7ffc6441bc80, instance=0x3392570, args=0x7ffc6441bd88, n_params=<optimized out>, param_types=0x2f84120) at gclosure.c:831 marshal = <optimized out> marshal_data = <optimized out> in_marshal = 0 real_closure = 0x2f840d0 __func__ = "_g_closure_invoke_va" #9 0x00007f09e43fbfbc in g_signal_emit_valist (instance=0x3392570, signal_id=<optimized out>, detail=0, var_args=var_args@entry=0x7ffc6441bd88) at gsignal.c:3214 return_accu = <optimized out> accu = {g_type = 20, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}} accumulator = 0x2f83f50 emission = {next = 0x0, instance = 0x3392570, ihint = {signal_id = 47, detail = 0, run_type = G_SIGNAL_RUN_LAST}, state = EMISSION_RUN, chain_type = 102714032} signal_id = <optimized out> instance_type = <optimized out> emission_return = {g_type = 20, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}} rtype = 20 static_scope = 0 fastpath_handler = <optimized out> closure = <optimized out> run_type = <optimized out> l = <optimized out> fastpath = <optimized out> instance_and_params = <optimized out> signal_return_type = <optimized out> param_values = <optimized out> i = <optimized out> n_params = <optimized out> __func__ = "g_signal_emit_valist" #10 0x00007f09e43fcae2 in g_signal_emit (instance=instance@entry=0x3392570, signal_id=<optimized out>, detail=detail@entry=0) at gsignal.c:3361 var_args = {{gp_offset = 24, fp_offset = 48, overflow_arg_area = 0x7ffc6441be60, reg_save_area = 0x7ffc6441bda0}} #11 0x00007f09e52baeac in gtk_widget_event_internal (widget=0x3392570, event=0x43970f0) at gtkwidget.c:7787 signal_num = <optimized out> return_val = 0 handled = 0 event = 0x43970f0 widget = 0x3392570 #12 0x00007f09e5189e0a in gtk_main_do_event (event=0x43970f0) at gtkmain.c:1698 event_widget = 0x3392570 grab_widget = 0x3392570 topmost_widget = <optimized out> window_group = 0x58e6130 rewritten_event = <optimized out> device = 0x0 tmp_list = <optimized out> __func__ = "gtk_main_do_event" #13 0x00007f09e4d10672 in gdk_event_source_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at gdkeventsource.c:364 display = <optimized out> event = <optimized out> #14 0x00007f09eb899cc7 in g_main_dispatch (context=0x2f9d5f0) at gmain.c:3122 dispatch = 0x7f09e4d10650 <gdk_event_source_dispatch> prev_source = 0x0 was_in_call = 0 user_data = 0x0 callback = 0x0 cb_funcs = <optimized out> cb_data = <optimized out> need_destroy = <optimized out> source = 0x2fb4550 current = 0x2fdc890 i = 0 #15 g_main_context_dispatch (context=context@entry=0x2f9d5f0) at gmain.c:3737 No locals. #16 0x00007f09eb899ef8 in g_main_context_iterate (context=context@entry=0x2f9d5f0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3808 max_priority = 0 timeout = 0 some_ready = 1 nfds = <optimized out> allocated_nfds = 3 fds = 0x30070c0 #17 0x00007f09eb899f9c in g_main_context_iteration (context=0x2f9d5f0, may_block=1) at gmain.c:3869 retval = <optimized out> i = 0 #15 g_main_context_dispatch (context=context@entry=0x2f9d5f0) at gmain.c:3737 No locals. #16 0x00007f09eb899ef8 in g_main_context_iterate (context=context@entry=0x2f9d5f0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3808 max_priority = 0 timeout = 0 some_ready = 1 nfds = <optimized out> allocated_nfds = 3 fds = 0x30070c0 #17 0x00007f09eb899f9c in g_main_context_iteration (context=0x2f9d5f0, may_block=1) at gmain.c:3869 retval = <optimized out> ---Type <return> to continue, or q <return> to quit--- #18 0x00007f09e589e897 in GtkData::Yield(bool, bool) () from /usr/lib64/libreoffice/program/libvclplug_gtk3lo.so No symbol table info available. #19 0x00007f09f8539443 in ImplYield (i_bAllEvents=false, i_bWait=true) at /usr/src/debug/libreoffice-5.0.1.2/vcl/source/app/svapp.cxx:353 pSVData = 0x7f09f977fb80 <rtl::Static<ImplSVData, (anonymous namespace)::private_aImplSVData>::get()::instance> #20 Application::Yield () at /usr/src/debug/libreoffice-5.0.1.2/vcl/source/app/svapp.cxx:382 No locals. #21 0x00007f09f85394c5 in Application::Execute () at /usr/src/debug/libreoffice-5.0.1.2/vcl/source/app/svapp.cxx:336 pSVData = 0x7f09f977fb80 <rtl::Static<ImplSVData, (anonymous namespace)::private_aImplSVData>::get()::instance> #22 0x00007f09f76d5f5b in desktop::Desktop::Main (this=0x7ffc6441c3e0) at /usr/src/debug/libreoffice-5.0.1.2/desktop/source/app/app.cxx:1605 layer2 = {m_aEnvTypeName = {pData = 0x34bbf00}, m_xPreviousContext = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x3016978}, <No data fields>}} bTerminateRequested = false layer = {m_aEnvTypeName = {pData = 0x30069d0}, m_xPreviousContext = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x2367a28}, <No data fields>}} rCmdLineArgs = <optimized out> aUnknown = {pData = 0x7f09f5c75f40 <aImplEmpty_rtl_uString>} aConfigErrHandler = {m_pContext = 0x0, m_xHandler = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x0}, <No data fields>}} inst_fin = <optimized out> xContext = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x2391990}, <No data fields>} xRestartManager = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x30df4f8}, <No data fields>} xDesktop = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x0}, <No data fields>} aAppearanceCfg = {<utl::ConfigItem> = {<utl::ConfigurationBroadcaster> = {_vptr.ConfigurationBroadcaster = 0x7f09f9583318 <vtable for SvtTabAppearanceCfg+16>, mpList = 0x0, m_nBroadcastBlocked = 0, m_nBlockedHint = 0}, sSubTree = {pData = 0x33bdb10}, m_xHierarchyAccess = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x33bf0b8}, <No data fields>}, xChangeLstnr = {<com::sun::star::uno::BaseReference> = { _pInterface = 0x0}, <No data fields>}, m_nMode = ConfigItemMode::DelayedUpdate, m_bIsModified = false, m_bEnableInternalNotification = false, m_nInValueChange = 0}, nDragMode = 2, nScaleFactor = 100, nSnapMode = 2, nMiddleMouse = MouseMiddleButtonAction::PasteSelection, nAAMinPixelHeight = 8, bMenuMouseFollow = true, bFontAntialiasing = true, static bInitialized = true} aOptions = {<utl::detail::Options> = {<utl::ConfigurationBroadcaster> = {_vptr.ConfigurationBroadcaster = 0x7f09f9583268 <vtable for SvtAccessibilityOptions+16>, mpList = 0x0, m_nBroadcastBlocked = 0, m_nBlockedHint = 0}, <utl::ConfigurationListener> = {_vptr.ConfigurationListener = 0x7f09f95832a0 <vtable for SvtAccessibilityOptions+72>}, <No data fields>}, <SfxListener> = { _vptr.SfxListener = 0x7f09f95832c8 <vtable for SvtAccessibilityOptions+112>, mpImpl = 0x34bb3b0}, static sm_pSingleImplConfig = 0x33c1070, static sm_nAccessibilityRefCount = 5} #23 0x00007f09f853e4d1 in ImplSVMain () at /usr/src/debug/libreoffice-5.0.1.2/vcl/source/app/svmain.cxx:162 pSVData = 0x7f09f977fb80 <rtl::Static<ImplSVData, (anonymous namespace)::private_aImplSVData>::get()::instance> nReturn = 1 bInit = <optimized out> #24 0x00007f09f853e512 in SVMain () at /usr/src/debug/libreoffice-5.0.1.2/vcl/source/app/svmain.cxx:196 nRet = 32521 #25 0x00007f09f76f314f in soffice_main () at /usr/src/debug/libreoffice-5.0.1.2/desktop/source/app/sofficemain.cxx:96 aDesktop = {<Application> = {_vptr.Application = 0x7f09f9499d70 <vtable for desktop::Desktop+16>}, m_rSplashScreen = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x0}, <No data fields>}, m_bCleanedExtensionCache = false, m_bServicesRegistered = true, m_aBootstrapError = desktop::Desktop::BE_OK, m_aBootstrapErrorMessage = {pData = 0x7f09f5c75f40 <aImplEmpty_rtl_uString>}, m_aBootstrapStatus = desktop::Desktop::BS_OK, m_xLockfile = {px = 0x309f6a0}, m_firstRunTimer = {<Scheduler> = {_vptr.Scheduler = 0x7f09f96bfe70 <vtable for Timer+16>, mpSchedulerData = 0x0, mpDebugName = 0x0, mePriority = SchedulerPriority::HIGHEST, mbActive = false}, maTimeoutHdl = {function_ = 0x0, instance_ = 0x0}, mnTimeout = 1, mbAuto = false}, static pResMgr = 0x3049770} rCmdLineArgs = @0x7f09f97543c0: {<boost::noncopyable_::noncopyable> = {<No data fields>}, m_cwdUrl = {<boost::optional_detail::optional_base<rtl::OUString>> = {<boost::optional_detail::optional_tag> = {<No data fields>}, m_initialized = true, m_storage = {dummy_ = {data = "\340o6\002\000\000\000", aligner_ = {<No data fields>}}}}, <No data fields>}, m_minimized = false, m_invisible = false, m_norestore = false, m_headless = false, m_quickstart = false, m_noquickstart = false, m_terminateafterinit = false, m_nologo = false, m_nolockcheck = false, m_nodefault = false, m_help = false, m_writer = true, m_calc = false, m_draw = false, m_impress = false, m_global = false, m_math = false, m_web = false, m_base = false, m_helpwriter = false, m_helpcalc = false, m_helpdraw = false, m_helpbasic = false, m_helpmath = false, m_helpimpress = false, m_helpbase = false, m_version = false, m_splashpipe = true, m_textcat = false, m_unknown = {pData = 0x7f09f5c75f40 <aImplEmpty_rtl_uString>}, m_bEmpty = false, m_bDocumentArgs = true, m_accept = std::vector of length 0, capacity 0, m_unaccept = std::vector of length 0, capacity 0, m_openlist = std::vector of length 0, capacity 0, m_viewlist = std::vector of length 0, capacity 0, m_startlist = std::vector of length 0, capacity 0, m_forceopenlist = std::vector of length 0, capacity 0, m_forcenewlist = std::vector of length 0, capacity 0, m_printlist = std::vector of length 0, capacity 0, m_printtolist = std::vector of length 0, capacity 0, m_printername = {pData = 0x7f09f5c75f40 <aImplEmpty_rtl_uString>}, m_conversionlist = std::vector of length 0, capacity 0, m_conversionparams = {pData = 0x7f09f5c75f40 <aImplEmpty_rtl_uString>}, m_conversionout = { pData = 0x7f09f5c75f40 <aImplEmpty_rtl_uString>}, m_infilter = std::vector of length 0, capacity 0, m_language = {pData = 0x7f09f5c75f40 <aImplEmpty_rtl_uString>}, m_pidfile = {pData = 0x7f09f5c75f40 <aImplEmpty_rtl_uString>}} aUnknown = {pData = 0x7f09f5c75f40 <aImplEmpty_rtl_uString>} #26 0x000000000040071b in sal_main () at /usr/src/debug/libreoffice-5.0.1.2/desktop/source/app/main.c:48 ret = <optimized out> #27 main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/libreoffice-5.0.1.2/desktop/source/app/main.c:47 ret = 0
Can't reproduce the crash myself (latest 5-0 and master branches under Fedora 22 64-bit), but there is a similar backtrace in Bug 94021, and also downstream at [1]. Apparently there was an attempt to fix the latter in [2], but that commit wasn't backported to the 5-0 branch. [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=795131 [2] http://cgit.freedesktop.org/libreoffice/core/commit/?id=e5539b0b53ebaf9b792652e4866eeacf8c10b101
As the Debian bug suggests, it's reproducible with a running clipboard manager. I reproduced it with Parcellite. The good news is that it seems fixed by the combination of the commit from Bug 93887 and the commit I mentioned in the previous comment (yes, both seem needed). I backported also the latter to 5-0 in [1], so guess we can mark this bug as RESOLVED FIXED. [1] https://gerrit.libreoffice.org/18672/
*** Bug 94021 has been marked as a duplicate of this bug. ***
*** Bug 93836 has been marked as a duplicate of this bug. ***
*** Bug 94293 has been marked as a duplicate of this bug. ***
*** Bug 94629 has been marked as a duplicate of this bug. ***
*** Bug 94012 has been marked as a duplicate of this bug. ***