soffice.bin crashed with SIGSEGV in size()

[royden]

Using "accept or reject changes" listbox, highlighted a change and chose "accept" button. Crash ensued. Same happens with reject. No difference if document format .doc or .odt

ProblemType: Crash
DistroRelease: Ubuntu 12.10
Package: libreoffice-core 1:3.6.0~rc4-0ubuntu3
ProcVersionSignature: Ubuntu 3.5.0-11.11-generic 3.5.2
Uname: Linux 3.5.0-11-generic i686
ApportVersion: 2.5.1-0ubuntu2
Architecture: i386
CrashCounter: 1
Date: Fri Aug 24 13:05:03 2012
ExecutablePath: /usr/lib/libreoffice/program/soffice.bin
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Alpha i386 (20120201.1)
ProcCmdline: /usr/lib/libreoffice/program/soffice.bin --writer --splash-pipe=6
SegvAnalysis:
 Segfault happened at: 0xb6c35386: mov (%eax),%edx
 PC (0xb6c35386) ok
 source "(%eax)" (0xeeeeeeef) not located in a known VMA region (needed readable region)!
 destination "%edx" ok
SegvReason: reading unknown VMA
Signal: 11
SourcePackage: libreoffice
StacktraceTop:
 ?? () from /usr/lib/libreoffice/program/libsvtlo.so
 ?? () from /usr/lib/libreoffice/program/libsvtlo.so
 SvListView::ActionRemoving(SvListEntry*) () from /usr/lib/libreoffice/program/libsvtlo.so
 SvListView::ModelNotification(unsigned short, SvListEntry*, SvListEntry*, unsigned long) () from /usr/lib/libreoffice/program/libsvtlo.so
 SvTreeListBox::ModelNotification(unsigned short, SvListEntry*, SvListEntry*, unsigned long) () from /usr/lib/libreoffice/program/libsvtlo.so
Title: soffice.bin crashed with SIGSEGV in SvListView::ActionRemoving()
UpgradeStatus: Upgraded to quantal on 2012-08-10 (13 days ago)
UserGroups: adm cdrom debian-tor dialout lpadmin plugdev sambashare

[Apport retracing service (apport)]

StacktraceTop:
 size (this=0xeeeeeeef) at /usr/include/c++/4.7/bits/stl_vector.h:626
 SvTreeEntryList::First (this=0xeeeeeeef) at /build/buildd/libreoffice-3.6.0~rc4/solver/unxlngi6.pro/inc/svtools/treelist.hxx:138
 SvListView::RemoveViewData (this=0xa31df34, pParent=0xa334da0) at /build/buildd/libreoffice-3.6.0~rc4/svtools/source/contnr/treelist.cxx:1637
 SvListView::ActionRemoving (this=0xa31df34, pEntry=0xa334da0) at /build/buildd/libreoffice-3.6.0~rc4/svtools/source/contnr/treelist.cxx:1676
 SvListView::ModelNotification (this=0xa31df34, nActionId=2, pEntry1=0xa334da0, pEntry2=0x0, nPos=0) at /build/buildd/libreoffice-3.6.0~rc4/svtools/source/contnr/treelist.cxx:1714

[royden (ryts)]

The version of libreoffice now in proposed 1:3.6.1~rc2-1ubuntu3 does not display the crash.

[penalvch (penalvch)]

royden, marking Fix Committed as per https://wiki.ubuntu.com/Bugs/Status .

[penalvch (penalvch)]

royden, marking Invalid as specific patch unverifiable. Please reopen if bug still reproducible.