Version: svn (1.5.9x) (using KDE KDE 3.5.2) Installed from: Ubuntu Packages Compiler: gcc (GCC) 3.3.6 (Ubuntu 1:3.3.6-8ubuntu1) OS: Linux I work on an odt document, which has 44 pages (including 5 pages TOC at the end of the document). When I let kword update the toc, it chrashes. Here's the backtrace: [KCrash handler] #6 0xb5bdec9b in KoTextParag::setPrev () at qcstring.h:65 #7 0xb6006531 in KWInsertTOCCommand::removeTOC () at qcstring.h:144 #8 0xb5f9de19 in KWTextFrameSet::insertTOC () at qshared.h:49 #9 0xb5f5d197 in KWView::insertContents () at qshared.h:49 #10 0xb5f770fc in KWView::qt_invoke () at qshared.h:49 #11 0xb72f3929 in QObject::activate_signal () from /usr/lib/libqt-mt.so.3 #12 0xb72f43c4 in QObject::activate_signal () from /usr/lib/libqt-mt.so.3 #13 0xb6d5aa26 in KAction::activated () from /usr/lib/libkdeui.so.4 #14 0xb6d9122b in KAction::slotActivated () from /usr/lib/libkdeui.so.4 #15 0xb6dacf4b in KAction::slotPopupActivated () from /usr/lib/libkdeui.so.4 #16 0xb6dad282 in KAction::qt_invoke () from /usr/lib/libkdeui.so.4 #17 0xb72f3929 in QObject::activate_signal () from /usr/lib/libqt-mt.so.3 #18 0xb7652e92 in QSignal::signal () from /usr/lib/libqt-mt.so.3 #19 0xb7311344 in QSignal::activate () from /usr/lib/libqt-mt.so.3 #20 0xb7416963 in QPopupMenu::mouseReleaseEvent () from /usr/lib/libqt-mt.so.3 #21 0xb6d66e80 in KPopupMenu::mouseReleaseEvent () from /usr/lib/libkdeui.so.4 #22 0xb732e356 in QWidget::event () from /usr/lib/libqt-mt.so.3 #23 0xb728af80 in QApplication::internalNotify () from /usr/lib/libqt-mt.so.3 #24 0xb728b500 in QApplication::notify () from /usr/lib/libqt-mt.so.3 #25 0xb791d17c in KApplication::notify () from /usr/lib/libkdecore.so.4 #26 0xb721be25 in QApplication::sendSpontaneousEvent () from /usr/lib/libqt-mt.so.3 #27 0xb7217072 in QETWidget::translateMouseEvent () from /usr/lib/libqt-mt.so.3 #28 0xb721566f in QApplication::x11ProcessEvent () from /usr/lib/libqt-mt.so.3 #29 0xb722efff in QEventLoop::processEvents () from /usr/lib/libqt-mt.so.3 #30 0xb72a2cfb in QEventLoop::enterLoop () from /usr/lib/libqt-mt.so.3 #31 0xb72a2c1e in QEventLoop::exec () from /usr/lib/libqt-mt.so.3 #32 0xb7289c13 in QApplication::exec () from /usr/lib/libqt-mt.so.3 #33 0xb677e338 in kdemain () from /usr/lib/libkdeinit_kword.so #34 0xb7f7f7f8 in kdeinitmain (argc=1, argv=0x8146ce8) at kword/kdeinit_kword.la.cpp:2 #35 0x0804dffc in ?? () #36 0x00000001 in ?? () #37 0x08146ce8 in ?? () #38 0xbffb03a8 in ?? () #39 0x0804e020 in ?? () #40 0x00000000 in ?? () #41 0x00000000 in ?? () #42 0x00000000 in ?? () #43 0xb7d5a354 in free () from /lib/tls/i686/cmov/libc.so.6 #44 0x0804e5da in ?? () #45 0x00000000 in ?? () #46 0x00000001 in ?? () #47 0x08146ad3 in ?? () #48 0x00000000 in ?? () #49 0x00000000 in ?? () #50 0x00000000 in ?? () #51 0x08146ad7 in ?? () #52 0x00000000 in ?? () #53 0x00000000 in ?? () #54 0x00000000 in ?? () #55 0x00000001 in ?? () #56 0x00000001 in ?? () #57 0x00000008 in ?? () #58 0x08146ab8 in ?? () #59 0x08146abc in ?? () #60 0x08146ac2 in ?? () #61 0x00000000 in ?? () #62 0x00000001 in ?? () #63 0x08146ac6 in ?? () #64 0x00000000 in ?? () #65 0x00000000 in ?? () #66 0x08146ad7 in ?? () #67 0x08146ac6 in ?? () #68 0x00000000 in ?? () #69 0xbffb0668 in ?? () #70 0x08051400 in vtable for QCString () #71 0x08087380 in ?? () #72 0x08051400 in vtable for QCString () #73 0x081465c8 in ?? () #74 0xbffb045c in ?? () #75 0xbffb04dc in ?? () #76 0x0000000a in ?? () #77 0x00000049 in ?? () #78 0x00000000 in ?? () #79 0xbffb04dc in ?? () #80 0x00000000 in ?? () #81 0xbffb045c in ?? () #82 0xbffb04dc in ?? () #83 0xbffb0668 in ?? () #84 0x0804ebcc in ?? () #85 0xffffffff in ?? () #86 0x00000000 in ?? () #87 0x0000000a in ?? () #88 0x00000000 in ?? () #89 0x00000000 in ?? () #90 0x00000000 in ?? () #91 0x00000000 in ?? () #92 0x00000000 in ?? () #93 0x00000000 in ?? () #94 0x00000000 in ?? () #95 0x00000000 in ?? () #96 0x00000000 in ?? () #97 0x00000000 in ?? () #98 0x00000000 in ?? () #99 0x00000000 in ?? () #100 0x00000000 in ?? () #101 0x00000000 in ?? () #102 0x00000000 in ?? () #103 0x00000000 in ?? () #104 0x00000000 in ?? () #105 0x00000000 in ?? () #106 0x00000000 in ?? () #107 0x00000000 in ?? () #108 0x00000000 in ?? () #109 0x00000000 in ?? () #110 0x00000000 in ?? () #111 0x00000000 in ?? () #112 0x00000000 in ?? () #113 0x00000000 in ?? () #114 0x00000000 in ?? () #115 0x00000000 in ?? () #116 0x00000000 in ?? () #117 0x00000000 in ?? () #118 0x00000000 in ?? () #119 0x00000000 in ?? () #120 0x00000000 in ?? () #121 0x00000000 in ?? () #122 0x00000000 in ?? () #123 0x00000000 in ?? () #124 0x00000000 in ?? () #125 0x00000000 in ?? () #126 0x00000000 in ?? () #127 0x00000000 in ?? () #128 0x00000000 in ?? () #129 0x00000000 in ?? () #130 0x00000000 in ?? () #131 0x00000000 in ?? () #132 0x00000000 in ?? () #133 0x00000000 in ?? () #134 0x00000000 in ?? () #135 0x00000000 in ?? () #136 0x00000000 in ?? () #137 0x00000000 in ?? () #138 0x00000000 in ?? () #139 0x00000000 in ?? () #140 0x00000000 in ?? () #141 0x00000000 in ?? () #142 0x00000000 in ?? () #143 0x00000000 in ?? () #144 0x00000000 in ?? () #145 0x00000000 in ?? () #146 0x00000000 in ?? () #147 0x00000000 in ?? () #148 0x00000000 in ?? () #149 0x00000000 in ?? () #150 0x00000000 in ?? () #151 0x00000000 in ?? () #152 0x00000100 in ?? () #153 0x00000000 in ?? () #154 0x00000000 in ?? () #155 0x00000000 in ?? () #156 0x00000000 in ?? () #157 0x00000000 in ?? () #158 0x00000000 in ?? () #159 0x00000000 in ?? () #160 0x00000000 in ?? () #161 0x00000000 in ?? () #162 0x00000000 in ?? () #163 0x00000000 in ?? () #164 0x00000000 in ?? () #165 0x00000000 in ?? () #166 0x00000000 in ?? () #167 0x00000000 in ?? () #168 0x00000000 in ?? () #169 0x00000000 in ?? () #170 0x00000000 in ?? () #171 0x00000000 in ?? () #172 0x00000000 in ?? () #173 0x00000000 in ?? () #174 0x00000000 in ?? () #175 0x00000000 in ?? () #176 0x00000000 in ?? () #177 0x00000000 in ?? () #178 0x00000000 in ?? () #179 0x00000000 in ?? () #180 0x00000000 in ?? () #181 0x00000000 in ?? () #182 0x00000000 in ?? () #183 0x00000000 in ?? () #184 0x00002d1b in ?? () #185 0x00000000 in ?? () #186 0x00000000 in ?? () #187 0x00000000 in ?? () #188 0x00000022 in ?? () #189 0x00000006 in ?? () #190 0x00000000 in ?? () #191 0x0805de00 in ?? () #192 0x00000000 in ?? () #193 0x00000002 in ?? () #194 0x00000000 in ?? () #195 0x00000000 in ?? () #196 0x00000000 in ?? () #197 0x00000000 in ?? () #198 0x00000000 in ?? () #199 0xb7786948 in vtable for QPtrCollection () from /usr/lib/libqt-mt.so.3 #200 0x00000101 in ?? () #201 0xb7e22930 in __malloc_initialize_hook () from /lib/tls/i686/cmov/libc.so.6 #202 0xb7e16da0 in in6addr_any () from /lib/tls/i686/cmov/libc.so.6 #203 0x00000000 in ?? () #204 0xb7786630 in vtable for QGArray () from /usr/lib/libqt-mt.so.3 #205 0x00000000 in ?? () #206 0x01010000 in ?? () #207 0x00000000 in ?? () #208 0x53454400 in ?? () #209 0xb7e20ff4 in ?? () from /lib/tls/i686/cmov/libc.so.6 #210 0xb7e22800 in __malloc_initialize_hook () from /lib/tls/i686/cmov/libc.so.6 #211 0x0805a390 in ?? () #212 0x00000003 in ?? () #213 0x00000008 in ?? () #214 0x00000002 in ?? () #215 0x00fb0808 in ?? () #216 0x00000002 in ?? () #217 0x0805a3b0 in ?? () #218 0x0805de00 in ?? () #219 0xbffb0808 in ?? () #220 0x0804fac1 in ?? () #221 0x00000004 in ?? () #222 0xbffb07fb in ?? () #223 0x00000001 in ?? () #224 0xbffb1fea in ?? () #225 0xb7d5c3b1 in malloc () from /lib/tls/i686/cmov/libc.so.6 Another thing related to TOCs: If I add the TOC to the beginning of the document (after the title page), the pagenumbers in the TOC doesn't match with the document. An example: the first paragraph was on page 2 before adding the TOC. after adding the TOC (4 new pages), it is on page 6. But the TOC shows it on page 2...

Hi Andy, may you are able to upload the document somewhere, mail it to me (maiil at dipe dot org) or attach a compressed version here? That would enable me/us to reproduce the bug and look more detailed where the problem may located or if the bug is already fixed. Thanks in advance :)

No, It isn't fixed. The latest svn version chrashes also... I send the document to you via mail...

A lot of thanks to Andy for the provided testcase which allowed me to produce a document that reproduces the crasher. So, I attach another document that outlines the crash + I deleted the (secret) document you send me, Andy. Lot of thanks again! [KCrash handler] #5 0xb5e8879e in KoTextParag::setPrev (this=0x0, s=0x8aeacd0) at KoTextParag.cpp:152 #6 0xb62cbe31 in KWInsertTOCCommand::removeTOC (fs=0x8808638, cursor=0x8af05e0) at KWInsertTOCCommand.cpp:194 #7 0xb6268f71 in KWTextFrameSet::insertTOC (this=0x8808638, cursor=0x8af05e0) at KWTextFrameSet.cpp:2668 #8 0xb6254a51 in KWTextFrameSetEdit::insertTOC (this=0x83f18e8) at KWTextFrameSet.h:451 At #5 this is NULL. See the KWInsertTOCCommand::removeTOC method which checks on various places if p is NULL and then just does p->setPrev( prev ); what results in the crash. I'll try to find a fix next hours :)

Created an attachment (id=17432) [details] Another odt-document that shows the crash.

The crash is fixed now and the fix will be part of KOffice 1.6 beta1/final. Lot of thanks for the feedback + the testcase, Andy :)