https://issues.apache.org/ooo/show_bug.cgi?id=118878
--- Comment #4 from yuanlin <[email protected]> --- I found the root cause. The issue is caused by that if the user change width value and column value together, In SwFmt::SetFmtAttr(), it will update all the modified value first. Then in SwFlyFrm::Modify(), it will enumerate all the changed items one by one and call SwFlyFrm::_UpdateAttr() to handle the value changed for each item. In this case, frame size value changed item will be handled first, it will call SwFlyFrm::FrmSizeChg() to handle it. In that function, it will call SwLayoutFrm::AdjustColumns() to re-calculate the column size in the frame. When enumerate the columns in the frame, it use the new column number value set in SwFmt::SetFmtAttr(). However, the real column object in frame is not updated. That work will be done in column number value changed handler in SwFlyFrm::_UpdateAttr() later. So if the new column value is larger than previous, in SwLayoutFrm::AdjustColumns(), it will enumerate a null column object. So crash will happen. According to my investigation, the crash should happen on all kinds of platforms. -- You are receiving this mail because: You are the assignee for the bug.
