https://bugs.documentfoundation.org/show_bug.cgi?id=158451
--- Comment #9 from Regina Henschel <[email protected]> --- It crashes because of an invalid pointer. The problem is in https://opengrok.libreoffice.org/xref/core/sw/source/core/text/itrform2.cxx?r=a58c0d4c#3061 pRet = sw::DrawFlyCntPortion::Create(*rInf.GetTextFrame(), *pFrameFormat, aTmpBase, nTmpAscent, nTmpDescent, nFlyAsc, nFlyDesc, nMode); Look at: rInf > member m_aTextFly (from SwTextPaintInfo) > mpAnchoredObjList. That list has one item. That item is a pointer to an object of SwAnchoredObject. The target has a member mpDrawObj. mpDrawObj points to an object of SwFlyLayFrame before the statement in #3061. mpDrawObj is an invalid pointer after the statement in #3061. It is an invalid pointer, not a nullptr. The item itself, that is the pointer, do not change, but the target is no longer valid. Later on, the program tries to access mpDrawObj and deference it, what causes the crash. For a group with shape without text, the mpAnchoredObjList is empty. If the group (with text) is not anchored as-char, but to-char, the statement in #3061 is not reached and it does not crash. Albeit, in that case, the text of the shape is outside the shape. Example will follow. I have no idea for a fix. I appreciate any help. -- You are receiving this mail because: You are the assignee for the bug.
