Bug 94013 - selection of vertical text in Frame leads to crash when using GTK3
Summary: selection of vertical text in Frame leads to crash when using GTK3
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: graphics stack (show other bugs)
Version:
(earliest affected)
5.0.1.2 release
Hardware: Other All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard: target:5.1.0 target:5.0.3
Keywords:
: 93836 94012 94021 94293 94629 (view as bug list)
Depends on:
Blocks:
 
Reported: 2015-09-08 08:25 UTC by Tomáš Čech
Modified: 2016-10-25 19:20 UTC (History)
7 users (show)

See Also:
Crash report or crash signature:


Attachments
bug reproducer document (9.39 KB, application/vnd.oasis.opendocument.text)
2015-09-08 08:25 UTC, Tomáš Čech
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Tomáš Čech 2015-09-08 08:25:52 UTC
Created attachment 118513 [details]
bug reproducer document

I found reproducible problem with GTK3 (gtk and gen works correctly). I attached document I used to reproduce. Contains just empty document with frame containing caption with vertical orientation. I didn't verified whether the orientation is relevant but you should have all the required information available.

Feel free to ask for more, I have stored the dump.

How to reproduce:
1] open attached document
2] hover your mouse cursor above the text (without selecting the frame)
3] select the text
4] click outside of frame (so the selected text is unselected again)
5] BOOM!

backtrace:
(gdb) bt
#0  0x00007f09e58a0dce in VclGtkClipboard::ClipboardGet(_GtkClipboard*, _GtkSelectionData*, unsigned int) () from /usr/lib64/libreoffice/program/libvclplug_gtk3lo.so
#1  0x00007f09e43e2d65 in g_closure_invoke (closure=0x61f5700, return_value=0x0, n_param_values=4, param_values=0x7ffc6441b710, invocation_hint=0x7ffc6441b6b0) at gclosure.c:768
#2  0x00007f09e43f3e81 in signal_emit_unlocked_R (node=node@entry=0x2f84240, detail=detail@entry=0, instance=instance@entry=0x3392570, emission_return=emission_return@entry=0x0, 
    instance_and_params=instance_and_params@entry=0x7ffc6441b710) at gsignal.c:3549
#3  0x00007f09e43fc77e in g_signal_emit_valist (instance=instance@entry=0x3392570, signal_id=signal_id@entry=50, detail=detail@entry=0, var_args=var_args@entry=0x7ffc6441b910) at gsignal.c:3305
#4  0x00007f09e43fcf95 in g_signal_emit_by_name (instance=instance@entry=0x3392570, detailed_signal=detailed_signal@entry=0x7f09e5357762 "selection-get") at gsignal.c:3401
#5  0x00007f09e520b5fb in gtk_selection_invoke_handler (widget=0x3392570, data=0x7ffc6441bab0, time=0) at gtkselection.c:3059
#6  0x00007f09e520cfc6 in _gtk_selection_request (widget=0x3392570, event=0x43970f0) at gtkselection.c:2456
#7  0x00007f09e518add7 in _gtk_marshal_BOOLEAN__BOXEDv (closure=0x2f840f0, return_value=0x7ffc6441bc80, instance=<optimized out>, args=<optimized out>, marshal_data=<optimized out>, n_params=<optimized out>, param_types=0x2f84120)
    at gtkmarshalers.c:130
#8  0x00007f09e43e2f94 in _g_closure_invoke_va (closure=0x2f840f0, return_value=0x7ffc6441bc80, instance=0x3392570, args=0x7ffc6441bd88, n_params=<optimized out>, param_types=0x2f84120) at gclosure.c:831
#9  0x00007f09e43fbfbc in g_signal_emit_valist (instance=0x3392570, signal_id=<optimized out>, detail=0, var_args=var_args@entry=0x7ffc6441bd88) at gsignal.c:3214
#10 0x00007f09e43fcae2 in g_signal_emit (instance=instance@entry=0x3392570, signal_id=<optimized out>, detail=detail@entry=0) at gsignal.c:3361
#11 0x00007f09e52baeac in gtk_widget_event_internal (widget=0x3392570, event=0x43970f0) at gtkwidget.c:7787
#12 0x00007f09e5189e0a in gtk_main_do_event (event=0x43970f0) at gtkmain.c:1698
#13 0x00007f09e4d10672 in gdk_event_source_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at gdkeventsource.c:364
#14 0x00007f09eb899cc7 in g_main_dispatch (context=0x2f9d5f0) at gmain.c:3122
#15 g_main_context_dispatch (context=context@entry=0x2f9d5f0) at gmain.c:3737
#16 0x00007f09eb899ef8 in g_main_context_iterate (context=context@entry=0x2f9d5f0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3808
#17 0x00007f09eb899f9c in g_main_context_iteration (context=0x2f9d5f0, may_block=1) at gmain.c:3869
#18 0x00007f09e589e897 in GtkData::Yield(bool, bool) () from /usr/lib64/libreoffice/program/libvclplug_gtk3lo.so
#19 0x00007f09f8539443 in ImplYield (i_bAllEvents=false, i_bWait=true) at /usr/src/debug/libreoffice-5.0.1.2/vcl/source/app/svapp.cxx:353
#20 Application::Yield () at /usr/src/debug/libreoffice-5.0.1.2/vcl/source/app/svapp.cxx:382
#21 0x00007f09f85394c5 in Application::Execute () at /usr/src/debug/libreoffice-5.0.1.2/vcl/source/app/svapp.cxx:336
#22 0x00007f09f76d5f5b in desktop::Desktop::Main (this=0x7ffc6441c3e0) at /usr/src/debug/libreoffice-5.0.1.2/desktop/source/app/app.cxx:1605
#23 0x00007f09f853e4d1 in ImplSVMain () at /usr/src/debug/libreoffice-5.0.1.2/vcl/source/app/svmain.cxx:162
#24 0x00007f09f853e512 in SVMain () at /usr/src/debug/libreoffice-5.0.1.2/vcl/source/app/svmain.cxx:196
#25 0x00007f09f76f314f in soffice_main () at /usr/src/debug/libreoffice-5.0.1.2/desktop/source/app/sofficemain.cxx:96
#26 0x000000000040071b in sal_main () at /usr/src/debug/libreoffice-5.0.1.2/desktop/source/app/main.c:48
#27 main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/libreoffice-5.0.1.2/desktop/source/app/main.c:47



full backtrace:
#0  0x00007f09e58a0dce in VclGtkClipboard::ClipboardGet(_GtkClipboard*, _GtkSelectionData*, unsigned int) () from /usr/lib64/libreoffice/program/libvclplug_gtk3lo.so
No symbol table info available.
#1  0x00007f09e43e2d65 in g_closure_invoke (closure=0x61f5700, return_value=0x0, n_param_values=4, param_values=0x7ffc6441b710, invocation_hint=0x7ffc6441b6b0) at gclosure.c:768
        marshal = <optimized out>
        marshal_data = <optimized out>
        in_marshal = 0
        real_closure = 0x61f56e0
        __func__ = "g_closure_invoke"
#2  0x00007f09e43f3e81 in signal_emit_unlocked_R (node=node@entry=0x2f84240, detail=detail@entry=0, instance=instance@entry=0x3392570, emission_return=emission_return@entry=0x0, 
    instance_and_params=instance_and_params@entry=0x7ffc6441b710) at gsignal.c:3549
        tmp = <optimized out>
        handler = 0x58e6150
        accumulator = 0x0
        emission = {next = 0x7ffc6441bcc0, instance = 0x3392570, ihint = {signal_id = 50, detail = 0, run_type = G_SIGNAL_RUN_FIRST}, state = EMISSION_RUN, chain_type = 4}
        handler_list = <optimized out>
        return_accu = 0x0
        accu = {g_type = 0, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, 
              v_float = 0, v_double = 0, v_pointer = 0x0}}}
        signal_id = 50
        max_sequential_handler_number = 11779
        return_value_altered = 0
#3  0x00007f09e43fc77e in g_signal_emit_valist (instance=instance@entry=0x3392570, signal_id=signal_id@entry=50, detail=detail@entry=0, var_args=var_args@entry=0x7ffc6441b910) at gsignal.c:3305
        instance_and_params = 0x7ffc6441b710
        signal_return_type = <optimized out>
        param_values = 0x7ffc6441b728
        i = <optimized out>
        n_params = <optimized out>
        __func__ = "g_signal_emit_valist"
#4  0x00007f09e43fcf95 in g_signal_emit_by_name (instance=instance@entry=0x3392570, detailed_signal=detailed_signal@entry=0x7f09e5357762 "selection-get") at gsignal.c:3401
        var_args = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7ffc6441ba50, reg_save_area = 0x7ffc6441b960}}
        detail = 0
        signal_id = 50
        itype = 102714032
        __func__ = "g_signal_emit_by_name"
#5  0x00007f09e520b5fb in gtk_selection_invoke_handler (widget=0x3392570, data=0x7ffc6441bab0, time=0) at gtkselection.c:3059
        target_list = <optimized out>
        info = 13
#6  0x00007f09e520cfc6 in _gtk_selection_request (widget=0x3392570, event=0x43970f0) at gtkselection.c:2456
        data = {selection = 0x1, target = 0x46, type = 0x2fa8074, format = 4096, data = 0x0, length = -1, display = 0x2fb2050}
        items = 4294967296
        display = <optimized out>
        info = 0x660cc30
        tmp_list = <optimized out>
        i = 0
        selection_max_size = 262144
        __func__ = "_gtk_selection_request"
#7  0x00007f09e518add7 in _gtk_marshal_BOOLEAN__BOXEDv (closure=0x2f840f0, return_value=0x7ffc6441bc80, instance=<optimized out>, args=<optimized out>, marshal_data=<optimized out>, n_params=<optimized out>, param_types=0x2f84120)
    at gtkmarshalers.c:130
        cc = <optimized out>
        data1 = <optimized out>
        data2 = <optimized out>
        callback = <optimized out>
        arg0 = 0x43970f0
        args_copy = {{gp_offset = 32, fp_offset = 48, overflow_arg_area = 0x7ffc6441be60, reg_save_area = 0x7ffc6441bda0}}
        v_return = <optimized out>
        __func__ = "_gtk_marshal_BOOLEAN__BOXEDv"
#8  0x00007f09e43e2f94 in _g_closure_invoke_va (closure=0x2f840f0, return_value=0x7ffc6441bc80, instance=0x3392570, args=0x7ffc6441bd88, n_params=<optimized out>, param_types=0x2f84120) at gclosure.c:831
        marshal = <optimized out>
        marshal_data = <optimized out>
        in_marshal = 0
        real_closure = 0x2f840d0
        __func__ = "_g_closure_invoke_va"
#9  0x00007f09e43fbfbc in g_signal_emit_valist (instance=0x3392570, signal_id=<optimized out>, detail=0, var_args=var_args@entry=0x7ffc6441bd88) at gsignal.c:3214
        return_accu = <optimized out>
        accu = {g_type = 20, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, 
              v_float = 0, v_double = 0, v_pointer = 0x0}}}
        accumulator = 0x2f83f50
        emission = {next = 0x0, instance = 0x3392570, ihint = {signal_id = 47, detail = 0, run_type = G_SIGNAL_RUN_LAST}, state = EMISSION_RUN, chain_type = 102714032}
        signal_id = <optimized out>
        instance_type = <optimized out>
        emission_return = {g_type = 20, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, 
              v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
        rtype = 20
        static_scope = 0
        fastpath_handler = <optimized out>
        closure = <optimized out>
        run_type = <optimized out>
        l = <optimized out>
        fastpath = <optimized out>
        instance_and_params = <optimized out>
        signal_return_type = <optimized out>
        param_values = <optimized out>
        i = <optimized out>
        n_params = <optimized out>
        __func__ = "g_signal_emit_valist"
#10 0x00007f09e43fcae2 in g_signal_emit (instance=instance@entry=0x3392570, signal_id=<optimized out>, detail=detail@entry=0) at gsignal.c:3361
        var_args = {{gp_offset = 24, fp_offset = 48, overflow_arg_area = 0x7ffc6441be60, reg_save_area = 0x7ffc6441bda0}}
#11 0x00007f09e52baeac in gtk_widget_event_internal (widget=0x3392570, event=0x43970f0) at gtkwidget.c:7787
        signal_num = <optimized out>
        return_val = 0
        handled = 0
        event = 0x43970f0
        widget = 0x3392570
#12 0x00007f09e5189e0a in gtk_main_do_event (event=0x43970f0) at gtkmain.c:1698
        event_widget = 0x3392570
        grab_widget = 0x3392570
        topmost_widget = <optimized out>
        window_group = 0x58e6130
        rewritten_event = <optimized out>
        device = 0x0
        tmp_list = <optimized out>
        __func__ = "gtk_main_do_event"
#13 0x00007f09e4d10672 in gdk_event_source_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at gdkeventsource.c:364
        display = <optimized out>
        event = <optimized out>
#14 0x00007f09eb899cc7 in g_main_dispatch (context=0x2f9d5f0) at gmain.c:3122
        dispatch = 0x7f09e4d10650 <gdk_event_source_dispatch>
        prev_source = 0x0
        was_in_call = 0
        user_data = 0x0
        callback = 0x0
        cb_funcs = <optimized out>
        cb_data = <optimized out>
        need_destroy = <optimized out>
        source = 0x2fb4550
        current = 0x2fdc890
        i = 0
#15 g_main_context_dispatch (context=context@entry=0x2f9d5f0) at gmain.c:3737
No locals.
#16 0x00007f09eb899ef8 in g_main_context_iterate (context=context@entry=0x2f9d5f0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3808
        max_priority = 0
        timeout = 0
        some_ready = 1
        nfds = <optimized out>
        allocated_nfds = 3
        fds = 0x30070c0
#17 0x00007f09eb899f9c in g_main_context_iteration (context=0x2f9d5f0, may_block=1) at gmain.c:3869
        retval = <optimized out>
        i = 0
#15 g_main_context_dispatch (context=context@entry=0x2f9d5f0) at gmain.c:3737
No locals.
#16 0x00007f09eb899ef8 in g_main_context_iterate (context=context@entry=0x2f9d5f0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3808
        max_priority = 0
        timeout = 0
        some_ready = 1
        nfds = <optimized out>
        allocated_nfds = 3
        fds = 0x30070c0
#17 0x00007f09eb899f9c in g_main_context_iteration (context=0x2f9d5f0, may_block=1) at gmain.c:3869
        retval = <optimized out>
---Type <return> to continue, or q <return> to quit---
#18 0x00007f09e589e897 in GtkData::Yield(bool, bool) () from /usr/lib64/libreoffice/program/libvclplug_gtk3lo.so
No symbol table info available.
#19 0x00007f09f8539443 in ImplYield (i_bAllEvents=false, i_bWait=true) at /usr/src/debug/libreoffice-5.0.1.2/vcl/source/app/svapp.cxx:353
        pSVData = 0x7f09f977fb80 <rtl::Static<ImplSVData, (anonymous namespace)::private_aImplSVData>::get()::instance>
#20 Application::Yield () at /usr/src/debug/libreoffice-5.0.1.2/vcl/source/app/svapp.cxx:382
No locals.
#21 0x00007f09f85394c5 in Application::Execute () at /usr/src/debug/libreoffice-5.0.1.2/vcl/source/app/svapp.cxx:336
        pSVData = 0x7f09f977fb80 <rtl::Static<ImplSVData, (anonymous namespace)::private_aImplSVData>::get()::instance>
#22 0x00007f09f76d5f5b in desktop::Desktop::Main (this=0x7ffc6441c3e0) at /usr/src/debug/libreoffice-5.0.1.2/desktop/source/app/app.cxx:1605
        layer2 = {m_aEnvTypeName = {pData = 0x34bbf00}, m_xPreviousContext = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x3016978}, <No data fields>}}
        bTerminateRequested = false
        layer = {m_aEnvTypeName = {pData = 0x30069d0}, m_xPreviousContext = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x2367a28}, <No data fields>}}
        rCmdLineArgs = <optimized out>
        aUnknown = {pData = 0x7f09f5c75f40 <aImplEmpty_rtl_uString>}
        aConfigErrHandler = {m_pContext = 0x0, m_xHandler = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x0}, <No data fields>}}
        inst_fin = <optimized out>
        xContext = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x2391990}, <No data fields>}
        xRestartManager = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x30df4f8}, <No data fields>}
        xDesktop = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x0}, <No data fields>}
        aAppearanceCfg = {<utl::ConfigItem> = {<utl::ConfigurationBroadcaster> = {_vptr.ConfigurationBroadcaster = 0x7f09f9583318 <vtable for SvtTabAppearanceCfg+16>, mpList = 0x0, m_nBroadcastBlocked = 0, m_nBlockedHint = 0}, 
            sSubTree = {pData = 0x33bdb10}, m_xHierarchyAccess = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x33bf0b8}, <No data fields>}, xChangeLstnr = {<com::sun::star::uno::BaseReference> = {
                _pInterface = 0x0}, <No data fields>}, m_nMode = ConfigItemMode::DelayedUpdate, m_bIsModified = false, m_bEnableInternalNotification = false, m_nInValueChange = 0}, nDragMode = 2, nScaleFactor = 100, nSnapMode = 2, 
          nMiddleMouse = MouseMiddleButtonAction::PasteSelection, nAAMinPixelHeight = 8, bMenuMouseFollow = true, bFontAntialiasing = true, static bInitialized = true}
        aOptions = {<utl::detail::Options> = {<utl::ConfigurationBroadcaster> = {_vptr.ConfigurationBroadcaster = 0x7f09f9583268 <vtable for SvtAccessibilityOptions+16>, mpList = 0x0, m_nBroadcastBlocked = 0, 
              m_nBlockedHint = 0}, <utl::ConfigurationListener> = {_vptr.ConfigurationListener = 0x7f09f95832a0 <vtable for SvtAccessibilityOptions+72>}, <No data fields>}, <SfxListener> = {
            _vptr.SfxListener = 0x7f09f95832c8 <vtable for SvtAccessibilityOptions+112>, mpImpl = 0x34bb3b0}, static sm_pSingleImplConfig = 0x33c1070, static sm_nAccessibilityRefCount = 5}
#23 0x00007f09f853e4d1 in ImplSVMain () at /usr/src/debug/libreoffice-5.0.1.2/vcl/source/app/svmain.cxx:162
        pSVData = 0x7f09f977fb80 <rtl::Static<ImplSVData, (anonymous namespace)::private_aImplSVData>::get()::instance>
        nReturn = 1
        bInit = <optimized out>
#24 0x00007f09f853e512 in SVMain () at /usr/src/debug/libreoffice-5.0.1.2/vcl/source/app/svmain.cxx:196
        nRet = 32521
#25 0x00007f09f76f314f in soffice_main () at /usr/src/debug/libreoffice-5.0.1.2/desktop/source/app/sofficemain.cxx:96
        aDesktop = {<Application> = {_vptr.Application = 0x7f09f9499d70 <vtable for desktop::Desktop+16>}, m_rSplashScreen = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x0}, <No data fields>}, 
          m_bCleanedExtensionCache = false, m_bServicesRegistered = true, m_aBootstrapError = desktop::Desktop::BE_OK, m_aBootstrapErrorMessage = {pData = 0x7f09f5c75f40 <aImplEmpty_rtl_uString>}, 
          m_aBootstrapStatus = desktop::Desktop::BS_OK, m_xLockfile = {px = 0x309f6a0}, m_firstRunTimer = {<Scheduler> = {_vptr.Scheduler = 0x7f09f96bfe70 <vtable for Timer+16>, mpSchedulerData = 0x0, mpDebugName = 0x0, 
              mePriority = SchedulerPriority::HIGHEST, mbActive = false}, maTimeoutHdl = {function_ = 0x0, instance_ = 0x0}, mnTimeout = 1, mbAuto = false}, static pResMgr = 0x3049770}
        rCmdLineArgs = @0x7f09f97543c0: {<boost::noncopyable_::noncopyable> = {<No data fields>}, m_cwdUrl = {<boost::optional_detail::optional_base<rtl::OUString>> = {<boost::optional_detail::optional_tag> = {<No data fields>}, 
              m_initialized = true, m_storage = {dummy_ = {data = "\340o6\002\000\000\000", aligner_ = {<No data fields>}}}}, <No data fields>}, m_minimized = false, m_invisible = false, m_norestore = false, m_headless = false, 
          m_quickstart = false, m_noquickstart = false, m_terminateafterinit = false, m_nologo = false, m_nolockcheck = false, m_nodefault = false, m_help = false, m_writer = true, m_calc = false, m_draw = false, m_impress = false, 
          m_global = false, m_math = false, m_web = false, m_base = false, m_helpwriter = false, m_helpcalc = false, m_helpdraw = false, m_helpbasic = false, m_helpmath = false, m_helpimpress = false, m_helpbase = false, 
          m_version = false, m_splashpipe = true, m_textcat = false, m_unknown = {pData = 0x7f09f5c75f40 <aImplEmpty_rtl_uString>}, m_bEmpty = false, m_bDocumentArgs = true, m_accept = std::vector of length 0, capacity 0, 
          m_unaccept = std::vector of length 0, capacity 0, m_openlist = std::vector of length 0, capacity 0, m_viewlist = std::vector of length 0, capacity 0, m_startlist = std::vector of length 0, capacity 0, 
          m_forceopenlist = std::vector of length 0, capacity 0, m_forcenewlist = std::vector of length 0, capacity 0, m_printlist = std::vector of length 0, capacity 0, m_printtolist = std::vector of length 0, capacity 0, 
          m_printername = {pData = 0x7f09f5c75f40 <aImplEmpty_rtl_uString>}, m_conversionlist = std::vector of length 0, capacity 0, m_conversionparams = {pData = 0x7f09f5c75f40 <aImplEmpty_rtl_uString>}, m_conversionout = {
            pData = 0x7f09f5c75f40 <aImplEmpty_rtl_uString>}, m_infilter = std::vector of length 0, capacity 0, m_language = {pData = 0x7f09f5c75f40 <aImplEmpty_rtl_uString>}, m_pidfile = {pData = 0x7f09f5c75f40 <aImplEmpty_rtl_uString>}}
        aUnknown = {pData = 0x7f09f5c75f40 <aImplEmpty_rtl_uString>}
#26 0x000000000040071b in sal_main () at /usr/src/debug/libreoffice-5.0.1.2/desktop/source/app/main.c:48
        ret = <optimized out>
#27 main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/libreoffice-5.0.1.2/desktop/source/app/main.c:47
        ret = 0
Comment 1 Maxim Monastirsky 2015-09-08 13:17:32 UTC
Can't reproduce the crash myself (latest 5-0 and master branches under Fedora 22 64-bit), but there is a similar backtrace in Bug 94021, and also downstream at [1]. Apparently there was an attempt to fix the latter in [2], but that commit wasn't backported to the 5-0 branch.

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=795131

[2] http://cgit.freedesktop.org/libreoffice/core/commit/?id=e5539b0b53ebaf9b792652e4866eeacf8c10b101
Comment 2 Maxim Monastirsky 2015-09-17 20:41:40 UTC
As the Debian bug suggests, it's reproducible with a running clipboard manager. I reproduced it with Parcellite. The good news is that it seems fixed by the combination of the commit from Bug 93887 and the commit I mentioned in the previous comment (yes, both seem needed). I backported also the latter to 5-0 in [1], so guess we can mark this bug as RESOLVED FIXED.

[1] https://gerrit.libreoffice.org/18672/
Comment 3 Maxim Monastirsky 2015-09-17 20:50:05 UTC
*** Bug 94021 has been marked as a duplicate of this bug. ***
Comment 4 Maxim Monastirsky 2015-09-17 20:57:37 UTC
*** Bug 93836 has been marked as a duplicate of this bug. ***
Comment 5 Maxim Monastirsky 2015-09-24 21:33:27 UTC
*** Bug 94293 has been marked as a duplicate of this bug. ***
Comment 6 Maxim Monastirsky 2015-09-30 07:03:03 UTC
*** Bug 94629 has been marked as a duplicate of this bug. ***
Comment 7 Maxim Monastirsky 2015-10-11 21:21:53 UTC
*** Bug 94012 has been marked as a duplicate of this bug. ***