Comment 25 for bug 854626

Revision history for this message
In , Björn Michaelsen (bjoern-michaelsen) wrote :

Created attachment 49780
structure of the layout at the beginning of destruction and at the time of crash

In the attached file, you will find a representation of the layout at the beginning of the destruction and which frms are already deleted at the crash.
You will find that the text frame 0x7fffc1fb4228 is already removed from the layout but still has a follow, the text frame 0x7fffc1fb4330, that is still in the layout. When it tries to delete 0x7fffc1fb4330, 0x7fffc1fb4330 tries to find its master by iterating backwards through the layout, which must fail.

I am still unsure why this does not happen in 3.3.3 -- that might be worth a look. However, in general the solution seems to be to remove all footnotes before a textframe gets removed at sw/source/core/layout/ssfrm.cxx:606 ...