https://bugs.documentfoundation.org/show_bug.cgi?id=172678
--- Comment #1 from [email protected] --- Reproduced again today (2026-08-05, 10:26 CEST) on the same machine, now on libreoffice-fresh 26.2.5-1 (26.2.5.2) — same exact stack trace as the two July reproductions, so this survives at least one more point release. This time I pulled full debug symbols for the relevant libraries via debuginfod (Arch's official server has them for libreoffice-fresh, since it's built in the `extra` repo) and got source lines + resolved frame #7, which was previously just an offset into libvclplug_qt6lo.so: Frame #7 is `QtMimeData::~QtMimeData()` (vcl/inc/qt6/../qt5/QtTransferable.hxx:115), which destroys a `css::uno::Reference<css::datatransfer::XTransferable>` member — this confirms the hypothesis in the original report: the Qt VCL clipboard bridge (`QtMimeData`) is what's holding the last reference to the Writer `XTransferable`/`SwTransferable`, and dropping it here (this late in `QWaylandClipboard`'s destructor, itself only run during final `QWaylandIntegration` teardown) is what triggers the `SwDoc`/`SfxItemPool` destruction that crashes. Full symbolized trace (top of thread 1, `bt full` against the coredump, svl/sw source lines from the 26.2.5.2 tag): ``` #0 SfxItemPool::cleanupItemInfos() svl/source/items/itempool.cxx:344 #1 SfxItemPool::~SfxItemPool() svl/source/items/itempool.cxx:564 #2 SwAttrPool::~SwAttrPool() sw/source/core/attr/swatrset.cxx:88 #3 rtl::Reference<SwAttrPool>::clear() include/rtl/ref.hxx:193 #4 SwDoc::~SwDoc() sw/source/core/doc/docnew.cxx:627 #5 SwDoc::release() sw/source/core/doc/doc.cxx:137 #6 SwDoc::release() sw/source/core/doc/doc.cxx:132 #7 o3tl::default_delete<SwDocFac>::operator()() include/o3tl/deleter.hxx:46 #8 std::unique_ptr<SwDocFac,...>::reset() #9 SwTransferable::~SwTransferable() sw/source/uibase/dochdl/swdtflvr.cxx:296 #10 SwTransferable::~SwTransferable() [D0] sw/source/uibase/dochdl/swdtflvr.cxx:317 #11 css::uno::Reference<XTransferable>::~Reference() include/com/sun/star/uno/Reference.hxx:114 #12 QtMimeData::~QtMimeData() vcl/inc/qt6/../qt5/QtTransferable.hxx:115 #13 QtMimeData::~QtMimeData() [D0] vcl/inc/qt6/../qt5/QtTransferable.hxx:115 #14 QtWaylandClient::QWaylandClipboard::~QWaylandClipboard() qtbase/src/plugins/platforms/wayland/qwaylandclipboard.cpp:32 ...(matches the rest of the originally reported trace from here on) ``` Locals were mostly optimized out in the release build, but the crashing frame (`cleanupItemInfos`, itempool.cxx:344) is the loop `for (auto& rInfo : maItemInfos) { if (rInfo->getItem()->isDynamicDefault()) ... }` — `rInfo->getItem()` returns a dangling/invalid pointer at the point of the crash, consistent with the destruction-order theory: something this `SfxItemPool` depends on for `maItemInfos` was already torn down earlier in global shutdown, before `SwDoc`'s destructor (deferred via the clipboard reference) got a chance to run. Happy to attach this coredump too if useful (same machine, reproduced identically). -- You are receiving this mail because: You are the assignee for the bug.
