Bug 1096520

Created attachment 894438 [details]
File: backtrace

Created attachment 894439 [details]
File: cgroup

Created attachment 894440 [details]
File: core_backtrace

Created attachment 894441 [details]
File: dso_list

Created attachment 894442 [details]
File: environ

Created attachment 894443 [details]
File: exploitable

Created attachment 894444 [details]
File: limits

Created attachment 894445 [details]
File: maps

Created attachment 894446 [details]
File: open_fds

Created attachment 894447 [details]
File: proc_pid_status

Created attachment 894448 [details]
File: var_log_messages

Are you able to reproduce this problem again ?

Somehow I reproduced (twice shortly in row) this with Impress:

libreoffice-4.3.6.2-8.fc21.x86_64

IIRC it involved fast changes of focus between text field (edit mode)
and the slide as such (non-edit, items-move mode) and perhaps pressing
Esc key1.

It occurred when I was reintroducing myself to LibreOffice.
Now I am a bit calmer and/or not reproducing the issue with
libreoffice-4.3.6.2-9.fc21.x86_64.  At least yet, will report back
if the issue is reproduced.

Reformatted backtrace of failing thread:

> #0  EditDoc::operator[](int)
>     (nPos=5, this=0x40a0bc00000000a8)
>     at /usr/src/debug/libreoffice-4.3.6.2/editeng/source/editeng/editdoc.cxx:2126
> 
> #1  EditDoc::operator[](int)
>     (this=0x40a0bc00000000a8, nPos=5)
>     at /usr/src/debug/libreoffice-4.3.6.2/editeng/source/editeng/editdoc.cxx:2127
> 
> #2  EditEngine::CreateEditPaM
>     (rEPaM=..., this=<optimized out>)
>     at /usr/src/debug/libreoffice-4.3.6.2/editeng/source/editeng/impedit.hxx:1028
> 
> #3  EditEngine::CreateEditPaM
>     (this=<optimized out>, rEPaM=...)
>     at /usr/src/debug/libreoffice-4.3.6.2/editeng/source/editeng/editeng.cxx:779
> 
> #4  EditUndoRemoveChars::Undo
>         aPaM = {
>         pNode = 0x7f63bc172d80,
>         nIndex = -1137340304
>         }
>         aSel = {
>         aStartPaM = {
>         pNode = 0x7f63ba7eaeb0,
>         nIndex = -1855265504
>         },
>         aEndPaM = {
>         pNode = 0x7f63bc359070,
>         nIndex = -1855231066
>         }
>         }
> 
> #5  SfxListUndoAction::Undo
>         i = 1
> 
> #6  SfxUndoManager::ImplUndo
>         aGuard = {
>         m_rManagerData = @0x7f63ba4de2d0,
>         m_aGuard = {
>         <osl::ClearableGuard<osl::Mutex>> = {
>         pT = 0x0
>         },
>         members of osl::ResettableGuard<osl::Mutex>:
>         pResetT = 0x7f63ba4de2d0
>         },
>         m_aUndoActionsCleanup = empty std::list,
>         m_notifiers = empty std::list
>         }
>         aDoingGuard = {
>         <comphelper::ScopeGuard> = {
>         <boost::noncopyable_::noncopyable> = {<No data fields>},
>         members of comphelper::ScopeGuard:
>         m_func = {
>         <boost::function_base> = {
>         vtable = 0x7f63b56d23a1 <void
>             boost::function0<void>::assign_to<boost::_bi::bind_t<void,
>             void (*)(bool&),
>             boost::_bi::list1<boost::reference_wrapper<bool> > >
>             >(boost::_bi::bind_t<void, void (*)(bool&),
>             boost::_bi::list1<boost::reference_wrapper<bool> >
>             >)::stored_vtable+1>,
>         functor = {
>         obj_ptr = 0x7f63b54a5340
>             <comphelper::FlagGuard::ResetFlag(bool&)>,
>         type = {
>         type = 0x7f63b54a5340
>             <comphelper::FlagGuard::ResetFlag(bool&)>,
>         const_qualified = 249,
>         volatile_qualified = 226
>         },
>         func_ptr = 0x7f63b54a5340
>             <comphelper::FlagGuard::ResetFlag(bool&)>,
>         bound_memfunc_ptr = {
>         memfunc_ptr = (void
>             (boost::detail::function::X::*)(boost::detail::function::X
>             * const, int)) 0x7f63b54a5340
>             <comphelper::FlagGuard::ResetFlag(bool&)>, this adjustment
>             140066304156409,
>         obj_ptr = 0x7f63bc359070
>         },
>         obj_ref = {
>         obj_ptr = 0x7f63b54a5340
>             <comphelper::FlagGuard::ResetFlag(bool&)>,
>         is_const_qualified = 249,
>         is_volatile_qualified = 226
>         },
>         data = 64 '@'
>         }
>         },
>         members of boost::function0<void>:
>         static args = <optimized out>,
>         static arity = <optimized out>
>         },
>         m_excHandling = comphelper::ScopeGuard::IGNORE_EXCEPTIONS
>         }, <No data fields>}
>         sActionComment = "Delete"
>         aLockGuard = {
>         m_manager = @0x7f63ba4df230
>         }
>         pAction = 0x7f63bbe37880
> 
> #7  SdrObjEditView::SdrEndTextEdit
>         eRet = SDRENDTEXTEDIT_UNCHANGED
>         pTEObj = <optimized out>
>         pTEOutliner = 0x7f63bbae6420
>         pTECursorMerker = 0x0
>         pTEWin = 0x7f63ba115290
>         pTEOutlinerView = <optimized out>
>         pUndoEditUndoManager = <optimized out>
>         bNeedToUndoSavedRedoTextEdit = <optimized out>
> 
> #8  sd::View::SdrEndTextEdit
>         xObj = {
>         mpWeakConnection = 0x7f63bb13c450
>         }
>         bDefaultTextRestored = false
>         eKind = <optimized out>
> 
> #9  SdrObjEditView::EndTextEditHdl
> 
> #10 SdrUndoManager::Undo
>         bRetval = false
>         this = 0x7f63ba4df230
> 
> #11 SdrUndoManager::Undo
>         bRetval = false
>         this = 0x7f63ba4df230
> 
> #12 sd::ViewShell::ImpSidUndo
>         nCount = <optimized out>
>         pUndoManager = 0x7f63ba4df230
>         nNumber = 0
> 
> #13 sd::DrawViewShell::FuSupport
> 
> #14 SfxShell::CallExec
> 
> #15 SfxDispatcher::Call_Impl
>         bThisDispatcherAlive = true
>         pOldInCallAliveFlag = 0x0
>         pFunc = 0x7f63736ec400
>             <SfxStubDrawViewShellFuSupport(SfxShell*, SfxRequest&)>
>         bAutoUpdate = false
> 
> #16 SfxDispatcher::_Execute
> 
> #17 SfxBindings::Execute_Impl
> 
> #18 SfxDispatchController_Impl::dispatch
>         aReq = {
>         <SfxHint> = {
>         _vptr.SfxHint = 0x7f63b5e6c830 <vtable for SfxRequest+16>
>         },
>         members of SfxRequest:
>         nSlot = 5701,
>         pArgs = 0x0,
>         pImp = 0x7f63bbb00630
>         }
>         xSet = {
>         px = 0x0
>         }
>         pSlot = 0x7f6373a96c20 <aDrawViewShellSlots_Impl+3360>
>         aInternalSet = {
>         <SfxItemSet> = {
>         _vptr.SfxItemSet = 0x7f63b56d46d0 <vtable for
>             SfxAllItemSet+16>,
>         _pPool = 0x7f63b9e05ac0,
>         _pParent = 0x0,
>         _aItems = 0x7f63bb453f50,
>         _pWhichRanges = 0x7f63bc196b20,
>         _nCount = 1
>         },
>         members of SfxAllItemSet:
>         aDefault = {
>         <SfxPoolItem> = {
>         _vptr.SfxPoolItem = 0x7f63b56d4a90 <vtable for
>             SfxVoidItem+16>,
>         m_nRefCount = 0,
>         m_nWhich = 0,
>         m_nKind = 0
>         }, <No data fields>},
>         nFree = 8
>         }
>         pShell = 0x7f63ba570fa0
>         lNewArgs = empty uno::Sequence
>         nCall = <optimized out>
>         nModifier = <optimized out>
>         aAddArgs = std::vector of length 0, capacity 0
>         xFrameRef = uno::Reference to ((anonymous namespace)::Frame *)
>             0x7f637c0c76b0
>         pItem = 0x0
>         eMapUnit = SFX_MAPUNIT_100TH_MM
>         nMarkArg = <optimized out>
>         nAddArgs = <optimized out>
>         bSuccess = false
>         aURLObj = {
>         m_aAbsURIRef = ".uno:Undo",
>         m_aScheme = {
>         m_nBegin = 0,
>         m_nLength = 4
>         },
>         m_aUser = {
>         m_nBegin = -1,
>         m_nLength = 0
>         },
>         m_aAuth = {
>         m_nBegin = -1,
>         m_nLength = 0
>         },
>         m_aHost = {
>         m_nBegin = -1,
>         m_nLength = 0
>         },
>         m_aPort = {
>         m_nBegin = -1,
>         m_nLength = 0
>         },
>         m_aPath = {
>         m_nBegin = 5,
>         m_nLength = 4
>         },
>         m_aQuery = {
>         m_nBegin = -1,
>         m_nLength = 0
>         },
>         m_aFragment = {
>         m_nBegin = -1,
>         m_nLength = 0
>         },
>         m_eScheme = INET_PROT_UNO,
>         m_eSmartScheme = INET_PROT_HTTP
>         }
>         aGuard = {
>         m_solarMutex = @0x7f63b95a7f40
>         }
> 
> #19 SfxOfficeDispatch::dispatch
>         layer = {
>         m_aEnvTypeName = "gcc3",
>         m_xPreviousContext = uno::Reference to (svt::JavaContext *)
>             0x7f63b9f2ec40
>         }
> 
> #20 svt::AsyncAccelExec::impl_ts_asyncCallback
> 
> #21 vcl::EventPoster::LinkStubDoEvent_Impl
> 
> #22 vcl::EventPoster::LinkStubDoEvent_Impl
> 
> #23 vcl::EventPoster::LinkStubDoEvent_Impl
> 
> #24 ImplWindowFrameProc
>         nRet = false
> 
> #25 ImplWindowFrameProc
>         nRet = false
> 
> #26 ImplWindowFrameProc
>         nRet = false
> 
> #27 SalGenericDisplay::DispatchInternalEvent
>         pData = 0x7f63bbaf7ff0
>         pFrame = 0x7f63b9e08b00
>         nEvent = 22
> 
> #28 SalGenericDisplay::DispatchInternalEvent
>         pData = 0x7f63bbaf7ff0
>         pFrame = 0x7f63b9e08b00
>         nEvent = 22
> 
> #29 GtkData::userEventFn
>         bContinue = 1
>         aGuard = {
>         pT = 0x7f63b95a7f40
>         }
>         pThis = 0x7f63b95a8040
>         pData = <optimized out>
> 
> #30 call_userEventFn
> 
> #31 g_main_context_dispatch
>     (context=0x7f63b9d9b600)
>     at gmain.c:3111
>         dispatch = 0x7f63b257d340 <g_idle_dispatch>
>         prev_source = 0x0
>         was_in_call = 0
>         user_data = 0x7f63b95a8040
>         callback = 0x7f63a15fd310 <call_userEventFn(void*)>
>         cb_funcs = 0x7f63b286e8c0 <g_source_callback_funcs>
>         cb_data = 0x7f63badbc7f0
>         need_destroy = <optimized out>
>         source = 0x7f63bbb65ff0
>         current = 0x7f63b9e82f70
>         i = 0
> 
> #32 g_main_context_dispatch
>     (context=context@entry=0x7f63b9d9b600)
>     at gmain.c:3710
> 
> #33 g_main_context_iterate
>     (context=context@entry=0x7f63b9d9b600, block=block@entry=1,
>     dispatch=dispatch@entry=1, self=<optimized out>)
>     at gmain.c:3781
>         max_priority = -100
>         timeout = 0
>         some_ready = 1
>         nfds = <optimized out>
>         allocated_nfds = 3
>         fds = 0x7f63b9f94470
> 
> #34 g_main_context_iteration
>     (context=0x7f63b9d9b600, may_block=1)
>     at gmain.c:3842
>         retval = <optimized out>
> 
> #35 GtkData::Yield
>         nMaxEvents = <optimized out>
>         wasOneEvent = <optimized out>
>         aReleaser = {
>         m_nYieldCount = 1
>         }
>         bDispatchThread = true
>         bWasEvent = false
> 
> #36 Application::Yield
>         pSVData = 0x7f63b3effc40 <rtl::Static<ImplSVData, (anonymous
>             namespace)::private_aImplSVData>::get()::instance>
> 
> #37 Application::Yield
> 
> #38 Application::Execute
>         pSVData = 0x7f63b3effc40 <rtl::Static<ImplSVData, (anonymous
>             namespace)::private_aImplSVData>::get()::instance>
> 
> #39 desktop::Desktop::Main
>         layer2 = {
>         m_aEnvTypeName = "gcc3",
>         m_xPreviousContext = uno::Reference to
>             (desktop::DesktopContext *) 0x7f639a685b40
>         }
>         bTerminateRequested = false
>         nAcquireCount = <optimized out>
>         aConfigErrHandler = {
>         m_pContext = 0x0,
>         m_xHandler = empty uno::Reference
>         }
>         xRestartManager = uno::Reference to
>             (comphelper::OOfficeRestartManager *) 0x7f639a688ca0
>         layer = {
>         m_aEnvTypeName = "gcc3",
>         m_xPreviousContext = uno::Reference to
>             (DesktopEnvironmentContext *) 0x7f63b8a551f0
>         }
>         xContext = uno::Reference to (cppu::ComponentContext *)
>             0x7f63b89c6728
>         aOptions = {
>         <utl::detail::Options> = {
>         <utl::ConfigurationBroadcaster> = {
>         _vptr.ConfigurationBroadcaster = 0x7f63b5381850 <vtable for
>             SvtAccessibilityOptions+16>,
>         mpList = 0x0,
>         m_nBroadcastBlocked = 0,
>         m_nBlockedHint = 0
>         },
>         <utl::ConfigurationListener> = {
>         _vptr.ConfigurationListener = 0x7f63b5381888 <vtable for
>             SvtAccessibilityOptions+72>
>         }, <No data fields>},
>         <SfxListener> = {
>         _vptr.SfxListener = 0x7f63b53818b0 <vtable for
>             SvtAccessibilityOptions+112>,
>         aBCs = std::deque with 0 elements
>         },
>         members of SvtAccessibilityOptions:
>         static sm_pSingleImplConfig = 0x7f63b9eb0240,
>         static sm_nAccessibilityRefCount = 61
>         }
>         aUnknown = ""
>         inst_fin = <optimized out>
>         xDesktop = empty uno::Reference
>         aAppearanceCfg = {
>         <utl::ConfigItem> = {
>         <utl::ConfigurationBroadcaster> = {
>         _vptr.ConfigurationBroadcaster = 0x7f63b5381910 <vtable for
>             SvtTabAppearanceCfg+16>,
>         mpList = 0x0,
>         m_nBroadcastBlocked = 0,
>         m_nBlockedHint = 0
>         },
>         members of utl::ConfigItem:
>         sSubTree = "Office.Common/View",
>         m_xHierarchyAccess = uno::Reference to (configmgr::RootAccess
>             *) 0x7f639a385258,
>         xChangeLstnr = empty uno::Reference,
>         m_nMode = 1,
>         m_bIsModified = false,
>         m_bEnableInternalNotification = false,
>         m_nInValueChange = 0
>         },
>         members of SvtTabAppearanceCfg:
>         nDragMode = 2,
>         nScaleFactor = 100,
>         nSnapMode = 2,
>         nMiddleMouse = 2,
>         nAAMinPixelHeight = 8,
>         bMenuMouseFollow = true,
>         bFontAntialiasing = true,
>         static bInitialized = true
>         }
> 
> #40 ImplSVMain
>         pSVData = 0x7f63b3effc40 <rtl::Static<ImplSVData, (anonymous
>             namespace)::private_aImplSVData>::get()::instance>
>         nReturn = 1
>         bInit = <optimized out>
> 
> #41 SVMain
>         nRet = 32767
> 
> #42 soffice_main
>         aDesktop = {
>         <Application> = {
>         _vptr.Application = 0x7f63b8659b90 <vtable for
>             desktop::Desktop+16>
>         },
>         members of desktop::Desktop:
>         m_rSplashScreen = empty uno::Reference,
>         m_bCleanedExtensionCache = false,
>         m_bServicesRegistered = true,
>         m_aBootstrapError = desktop::Desktop::BE_OK,
>         m_aBootstrapErrorMessage = "",
>         m_aBootstrapStatus = desktop::Desktop::BS_OK,
>         m_xLockfile = {
>         px = 0x7f63b9df1370
>         },
>         m_firstRunTimer = {
>         _vptr.Timer = 0x7f63b3ef59b0 <vtable for Timer+16>,
>         mpTimerData = 0x0,
>         mnTimeout = 1,
>         mbActive = false,
>         mbAuto = false,
>         maTimeoutHdl = {
>         pInst = 0x0,
>         pFunc = 0x0
>         }
>         },
>         static pResMgr = 0x0
>         }
>         rCmdLineArgs = @0x7f63b865c2c0: {
>         <boost::noncopyable_::noncopyable> = {<No data fields>},
>         members of desktop::CommandLineArgs:
>         m_cwdUrl = {
>         <boost::optional_detail::optional_base<rtl::OUString>> = {
>         <boost::optional_detail::optional_tag> = {<No data fields>},
>         members of
>             boost::optional_detail::optional_base<rtl::OUString>:
>         m_initialized = true,
>         m_storage = {
>         dummy_ = {
>         data = "\bP\245\270c\177\000",
>         aligner_ = {<No data fields>}
>         }
>         }
>         }, <No data fields>},
>         m_minimized = false,
>         m_invisible = false,
>         m_norestore = false,
>         m_headless = false,
>         m_quickstart = false,
>         m_noquickstart = false,
>         m_terminateafterinit = false,
>         m_nofirststartwizard = false,
>         m_nologo = false,
>         m_nolockcheck = false,
>         m_nodefault = false,
>         m_help = false,
>         m_writer = false,
>         m_calc = false,
>         m_draw = false,
>         m_impress = true,
>         m_global = false,
>         m_math = false,
>         m_web = false,
>         m_base = false,
>         m_helpwriter = false,
>         m_helpcalc = false,
>         m_helpdraw = false,
>         m_helpbasic = false,
>         m_helpmath = false,
>         m_helpimpress = false,
>         m_helpbase = false,
>         m_version = false,
>         m_splashpipe = true,
>         m_unknown = "",
>         m_bEmpty = false,
>         m_bDocumentArgs = true,
>         m_accept = std::vector of length 0, capacity 0,
>         m_unaccept = std::vector of length 0, capacity 0,
>         m_openlist = std::vector of length 0, capacity 0,
>         m_viewlist = std::vector of length 0, capacity 0,
>         m_startlist = std::vector of length 0, capacity 0,
>         m_forceopenlist = std::vector of length 0, capacity 0,
>         m_forcenewlist = std::vector of length 0, capacity 0,
>         m_printlist = std::vector of length 0, capacity 0,
>         m_printtolist = std::vector of length 0, capacity 0,
>         m_printername = "",
>         m_conversionlist = std::vector of length 0, capacity 0,
>         m_conversionparams = "",
>         m_conversionout = "",
>         m_infilter = std::vector of length 0, capacity 0,
>         m_language = "",
>         m_pidfile = ""
>         }
>         aUnknown = ""
> 
> #43 main
>     at /usr/src/debug/libreoffice-4.3.6.2/desktop/source/app/main.c:48
>         ret = <optimized out>
>         ret = 0
> 
> #44 main
>     (argc=<optimized out>, argv=<optimized out>)
>     at /usr/src/debug/libreoffice-4.3.6.2/desktop/source/app/main.c:47
>         ret = 0

Please let me know if some inputs required.
For the time being, keeping the bug closed and dropping previous needinfo.

Re [comment 13]:
> (twice shortly in row)

The other (again slightly reformatted backtrace):

> #0  0x0000000000000001 in  ()
> 
> #1  SdrObjEditView::SdrEndTextEdit
>     at /usr/src/debug/libreoffice-4.3.6.2/svx/source/svdraw/svdedxv.cxx:907
>         aObjName = "é\x868ç¼\000\xffff\xffff\xffff\xffff\xffff\xfff
>             f\xffff\xffff\001\000\000\000a\000\000\000\xa790î³ç¼\000
>             ï à©®ç¼\000ìà©«ç¼", '\000' <repeats 25 times>, "ïé§
>             ¼è¹ë¿º`\000\000\000!\000\000\000ê¼°\xa64ç¼\000Ôç¼\0
>             00\001\000\000\000\061\000\000\000ï \xa5fç¼\000ã¶\xa64ç
>             ¼\000ì®î§Å\000\000\000\000\000\000\b\000\000!", '\000'
>             <repeats 15 times>, "\061\000\000\000è°Ï«ç¼\000\002\000\
>             002\000\001\000\002\000\002\000\xff00\xffffã à¨§ç¼\000A\
>             000\000\000\000\000\000\000\b", '\000' <repeats 19 times>,
>             "@\000\000\000!\000\000\000!\000\060\000à©°\000\000\000\00
>             1\000\000\000\061\000\000\000\000\000\000\000"...
>         pTxtUndo = 0x0
>         pTextObj = <optimized out>
>         bUndo = true
>         pDelUndo = <optimized out>
>         bDelObj = <optimized out>
>         bModified = <optimized out>
>         eRet = SDRENDTEXTEDIT_UNCHANGED
>         pTEObj = 0x7f120a431320
>         pTEOutliner = 0x7f120a6bc610
>         pTECursorMerker = 0x0
>         pTEWin = 0x7f120a2e3800
>         pTEOutlinerView = <optimized out>
>         pUndoEditUndoManager = <optimized out>
>         bNeedToUndoSavedRedoTextEdit = <optimized out>
> 
> #2  sd::View::SdrEndTextEdit
>     at /usr/src/debug/libreoffice-4.3.6.2/sd/source/ui/view/sdview.cxx:784
>         xObj = {
>         mpWeakConnection = 0x7f120a557fd0
>         }
>         bDefaultTextRestored = false
>         eKind = <optimized out>
> 
> #3  sd::FuText::MouseButtonDown
>     at /usr/src/debug/libreoffice-4.3.6.2/sd/source/ui/func/futext.cxx:273
>         bReturn = false
>         aVEvt = {
>         pHdl = 0x0,
>         pObj = 0x7f120a2a0ea0,
>         pRootObj = 0x7f120a2a0ea0,
>         pPV = 0x7f120a2ef100,
>         pURLField = 0x0,
>         aLogicPos = Point = {
>         x = 15984,
>         y = 3628
>         },
>         eHit = SDRHIT_UNMARKEDOBJECT,
>         eEvent = SDREVENT_MARKOBJ,
>         eHdlKind = HDL_MOVE,
>         eEndCreateCmd = SDRCREATE_NEXTPOINT,
>         nMouseClicks = 1,
>         nMouseMode = 3,
>         nMouseCode = 1,
>         nHlplIdx = 0,
>         nGlueId = 0,
>         bMouseDown = true,
>         bMouseUp = false,
>         bDoubleHdlSize = false,
>         bIsAction = false,
>         bIsTextEdit = true,
>         bTextEditHit = false,
>         bAddMark = false,
>         bUnmark = false,
>         bPrevNextMark = false,
>         bMarkPrev = false,
>         bInsPointNewObj = false,
>         bDragWithCopy = false,
>         bCaptureMouse = true,
>         bReleaseMouse = false
>         }
>         eHit = SDRHIT_UNMARKEDOBJECT
> 
> #4  sd::ViewShell::MouseButtonDown
>         xSelectionController = empty rtl::Reference
>         bConsumed = false
> 
> #5  sd::DrawViewShell::MouseButtonDown
>         pIPClient = <optimized out>
>         bIsOleActive = <optimized out>
> 
> #6  ImplHandleMouseEvent
>         pSVData = 0x7f1203eeac40 <rtl::Static<ImplSVData, (anonymous
>             namespace)::private_aImplSVData>::get()::instance>
>         pWinFrameData = <optimized out>
>         bCallHelpRequest = true
>         aChildPos = Point = {
>         x = 679,
>         y = 145
>         }
>         aMEvt = {
>         maPos = Point = {
>         x = 679,
>         y = 145
>         },
>         mnMode = 3,
>         mnClicks = 1,
>         mnCode = 1
>         }
>         aDelData = {
>         _vptr.ImplDelData = 0x7f1203eb4a50 <vtable for
>             ImplDelData+16>,
>         mpNext = 0x0,
>         mpWindow = 0x7f120a2e3800,
>         mbDel = false
>         }
>         aMousePos = Point = {
>         x = 981,
>         y = 294
>         }
>         pChild = 0x7f120a2e3800
>         bRet = false
>         nClicks = <optimized out>
>         nOldCode = <optimized out>
>         bDrag = false
>         aNEvt = {
>         mpWindow = 0x7f120a2e3800,
>         mpData = 0x7fff06795770,
>         mnType = 1,
>         mnRetValue = 0
>         }
> 
> #7  ImplWindowFrameProc
>         pMouseEvt = <optimized out>
>         aSalMouseEvent = {
>         mnTime = 64,
>         mnX = 139715444498464,
>         mnY = 0,
>         mnButton = 31440,
>         mnCode = 61592
>         }
>         nRet = false
> 
> #8  ImplWindowFrameProc
>         pMouseEvt = <optimized out>
>         aSalMouseEvent = {
>         mnTime = 64,
>         mnX = 139715444498464,
>         mnY = 0,
>         mnButton = 31440,
>         mnCode = 61592
>         }
>         nRet = false
> 
> #9  GtkSalFrame::signalButton
>         nEventType = 3
>         aDel = {
>         m_pNotifier = 0x7f120a164ae8
>         }
>         pThis = 0x7f120a164ae0
>         aEvent = {
>         mnTime = 2202325540,
>         mnX = 981,
>         mnY = 294,
>         mnButton = 1,
>         mnCode = 0
>         }
>         bClosePopups = false
> 
> #10 GtkSalFrame::signalButton
>         nEventType = 3
>         aDel = {
>         m_pNotifier = 0x7f120a164ae8
>         }
>         pThis = 0x7f120a164ae0
>         aEvent = {
>         mnTime = 2202325540,
>         mnX = 981,
>         mnY = 294,
>         mnButton = 1,
>         mnCode = 0
>         }
>         bClosePopups = false
>         #15 0x00007f11ff42034f in <emit signal ??? on instance
>             0x7f120971eeb0 [GtkWindow]>
>             (instance=instance@entry=0x7f120971eeb0,
>             signal_id=<optimized out>, detail=detail@entry=0) at
>             gsignal.c:3365
>         var_args = {{
>         gp_offset = 32,
>         fp_offset = 48,
>         overflow_arg_area = 0x7fff06795e20,
>         reg_save_area = 0x7fff06795d60
>         }}
>         #11 0x00007f11f0d4082d in _gtk_marshal_BOOLEAN__BOXED
>             (closure=0x7f120a164d70, return_value=0x7fff06795b00,
>             n_param_values=<optimized out>,
>             param_values=0x7fff06795bb0, invocation_hint=<optimized
>             out>, marshal_data=<optimized out>) at gtkmarshalers.c:86
>         callback = 0x7f11f1607730
>             <GtkSalFrame::signalButton(_GtkWidget*, _GdkEventButton*,
>             void*)>
>         cc = 0x7f120a164d70
>         data1 = 0x7f120971eeb0
>         data2 = 0x7f120a164ae0
>         v_return = <optimized out>
>         __FUNCTION__ = "_gtk_marshal_BOOLEAN__BOXED"
>         #12 0x00007f11ff405c55 in g_closure_invoke
>             (closure=0x7f120a164d70,
>             return_value=return_value@entry=0x7fff06795b00,
>             n_param_values=2,
>             param_values=param_values@entry=0x7fff06795bb0,
>             invocation_hint=invocation_hint@entry=0x7fff06795b50) at
>             gclosure.c:768
>         marshal = <optimized out>
>         marshal_data = <optimized out>
>         in_marshal = 0
>         real_closure = 0x7f120a164d50
>         __FUNCTION__ = "g_closure_invoke"
>         #13 0x00007f11ff4179e2 in signal_emit_unlocked_R
>             (node=node@entry=0x7f120971b290, detail=detail@entry=0,
>             instance=instance@entry=0x7f120971eeb0,
>             emission_return=emission_return@entry=0x7fff06795c60, inst
>             ance_and_params=instance_and_params@entry=0x7fff06795bb0)
>             at gsignal.c:3553
>         tmp = <optimized out>
>         handler = 0x7f120a0c7690
>         accumulator = 0x7f1209717aa0
>         emission = {
>         next = 0x0,
>         instance = 0x7f120971eeb0,
>         ihint = {
>         signal_id = 33,
>         detail = 0,
>         run_type = G_SIGNAL_RUN_FIRST
>         },
>         state = EMISSION_RUN,
>         chain_type = 4
>         }
>         handler_list = <optimized out>
>         return_accu = 0x7fff06795b00
>         accu = {
>         g_type = 20,
>         data = {{
>         v_int = 0,
>         v_uint = 0,
>         v_long = 0,
>         v_ulong = 0,
>         v_int64 = 0,
>         v_uint64 = 0,
>         v_float = 0,
>         v_double = 0,
>         v_pointer = 0x0
>         }, {
>         v_int = 0,
>         v_uint = 0,
>         v_long = 0,
>         v_ulong = 0,
>         v_int64 = 0,
>         v_uint64 = 0,
>         v_float = 0,
>         v_double = 0,
>         v_pointer = 0x0
>         }}
>         }
>         signal_id = 33
>         max_sequential_handler_number = 7113
>         return_value_altered = 0
>         #14 0x00007f11ff41fcf8 in g_signal_emit_valist
>             (instance=<optimized out>, signal_id=<optimized out>,
>             detail=<optimized out>,
>             var_args=var_args@entry=0x7fff06795d40) at gsignal.c:3319
>         return_value = {
>         g_type = 20,
>         data = {{
>         v_int = 0,
>         v_uint = 0,
>         v_long = 0,
>         v_ulong = 0,
>         v_int64 = 0,
>         v_uint64 = 0,
>         v_float = 0,
>         v_double = 0,
>         v_pointer = 0x0
>         }, {
>         v_int = 0,
>         v_uint = 0,
>         v_long = 0,
>         v_ulong = 0,
>         v_int64 = 0,
>         v_uint64 = 0,
>         v_float = 0,
>         v_double = 0,
>         v_pointer = 0x0
>         }}
>         }
>         error = 0x0
>         rtype = 20
>         static_scope = 0
>         instance_and_params = 0x7fff06795bb0
>         signal_return_type = <optimized out>
>         param_values = 0x7fff06795bc8
>         node = <optimized out>
>         i = <optimized out>
>         n_params = <optimized out>
>         __FUNCTION__ = "g_signal_emit_valist"
> 
> #16 gtk_widget_event_internal
>         signal_num = <optimized out>
>         return_val = 0
> 
> #17 IA__gtk_widget_event
>         __FUNCTION__ = "IA__gtk_widget_event"
> 
> #18 IA__gtk_propagate_event
>         tmp = <optimized out>
>         handled_event = <optimized out>
>         __FUNCTION__ = "IA__gtk_propagate_event"
> 
> #19 IA__gtk_main_do_event
>     (event=0x7f120a775c20)
>     at gtkmain.c:1696
>         event_widget = <optimized out>
>         grab_widget = 0x7f120971eeb0 [GtkWindow]
>         window_group = <optimized out>
>         rewritten_event = <optimized out>
>         tmp_list = <optimized out>
>         __FUNCTION__ = "IA__gtk_main_do_event"
> 
> #20 gdk_event_dispatch
>     (source=<optimized out>, callback=<optimized out>,
>     user_data=<optimized out>)
>     at gdkevents-x11.c:2425
>         display = <optimized out>
>         event = 0x7f120a775c20
> 
> #21 g_main_context_dispatch
>     (context=0x7f120970ede0)
>     at gmain.c:3111
>         dispatch = 0x7f11f0997600 <gdk_event_dispatch>
>         prev_source = 0x0
>         was_in_call = 0
>         user_data = 0x0
>         callback = 0x0
>         cb_funcs = 0x0
>         cb_data = 0x0
>         need_destroy = <optimized out>
>         source = 0x7f120970ecf0
>         current = 0x7f12097f6770
>         i = 0
> 
> #22 g_main_context_dispatch
>     (context=context@entry=0x7f120970ede0)
>     at gmain.c:3710
> 
> #23 g_main_context_iterate
>     (context=context@entry=0x7f120970ede0, block=block@entry=1,
>     dispatch=dispatch@entry=1, self=<optimized out>)
>     at gmain.c:3781
>         max_priority = 2147483647
>         timeout = 15
>         some_ready = 1
>         nfds = <optimized out>
>         allocated_nfds = 2
>         fds = 0x7f1209950d80
> 
> #24 g_main_context_iteration
>     (context=0x7f120970ede0, may_block=1)
>     at gmain.c:3842
>         retval = <optimized out>
> 
> #25 GtkData::Yield
>         nMaxEvents = <optimized out>
>         wasOneEvent = <optimized out>
>         aReleaser = {
>         m_nYieldCount = 1
>         }
>         bDispatchThread = true
>         bWasEvent = false
> 
> #26 Application::Yield
>         pSVData = 0x7f1203eeac40 <rtl::Static<ImplSVData, (anonymous
>             namespace)::private_aImplSVData>::get()::instance>
> 
> #27 Application::Yield
> 
> #28 Application::Execute
>         pSVData = 0x7f1203eeac40 <rtl::Static<ImplSVData, (anonymous
>             namespace)::private_aImplSVData>::get()::instance>
> 
> #29 desktop::Desktop::Main
>         layer2 = {
>         m_aEnvTypeName = "gcc3",
>         m_xPreviousContext = uno::Reference to
>             (desktop::DesktopContext *) 0x7f12088eaa80
>         }
>         bTerminateRequested = false
>         nAcquireCount = <optimized out>
>         aConfigErrHandler = {
>         m_pContext = 0x0,
>         m_xHandler = empty uno::Reference
>         }
>         xRestartManager = uno::Reference to
>             (comphelper::OOfficeRestartManager *) 0x7f12088f5c40
>         layer = {
>         m_aEnvTypeName = "gcc3",
>         m_xPreviousContext = uno::Reference to
>             (DesktopEnvironmentContext *) 0x7f1208a401b0
>         }
>         xContext = uno::Reference to (cppu::ComponentContext *)
>             0x7f12089b1728
>         aOptions = {
>         <utl::detail::Options> = {
>         <utl::ConfigurationBroadcaster> = {
>         _vptr.ConfigurationBroadcaster = 0x7f120536c850 <vtable for
>             SvtAccessibilityOptions+16>,
>         mpList = 0x0,
>         m_nBroadcastBlocked = 0,
>         m_nBlockedHint = 0
>         },
>         <utl::ConfigurationListener> = {
>         _vptr.ConfigurationListener = 0x7f120536c888 <vtable for
>             SvtAccessibilityOptions+72>
>         }, <No data fields>},
>         <SfxListener> = {
>         _vptr.SfxListener = 0x7f120536c8b0 <vtable for
>             SvtAccessibilityOptions+112>,
>         aBCs = std::deque with 0 elements
>         },
>         members of SvtAccessibilityOptions:
>         static sm_pSingleImplConfig = 0x7f1209842b40,
>         static sm_nAccessibilityRefCount = 12
>         }
>         aUnknown = ""
>         inst_fin = <optimized out>
>         xDesktop = empty uno::Reference
>         aAppearanceCfg = {
>         <utl::ConfigItem> = {
>         <utl::ConfigurationBroadcaster> = {
>         _vptr.ConfigurationBroadcaster = 0x7f120536c910 <vtable for
>             SvtTabAppearanceCfg+16>,
>         mpList = 0x0,
>         m_nBroadcastBlocked = 0,
>         m_nBlockedHint = 0
>         },
>         members of utl::ConfigItem:
>         sSubTree = "Office.Common/View",
>         m_xHierarchyAccess = uno::Reference to (configmgr::RootAccess
>             *) 0x7f11ea602558,
>         xChangeLstnr = empty uno::Reference,
>         m_nMode = 1,
>         m_bIsModified = false,
>         m_bEnableInternalNotification = false,
>         m_nInValueChange = 0
>         },
>         members of SvtTabAppearanceCfg:
>         nDragMode = 2,
>         nScaleFactor = 100,
>         nSnapMode = 2,
>         nMiddleMouse = 2,
>         nAAMinPixelHeight = 8,
>         bMenuMouseFollow = true,
>         bFontAntialiasing = true,
>         static bInitialized = true
>         }
> 
> #30 ImplSVMain
>         pSVData = 0x7f1203eeac40 <rtl::Static<ImplSVData, (anonymous
>             namespace)::private_aImplSVData>::get()::instance>
>         nReturn = 1
>         bInit = <optimized out>
> 
> #31 SVMain
>         nRet = 32767
> 
> #32 soffice_main
>         aDesktop = {
>         <Application> = {
>         _vptr.Application = 0x7f1208644b90 <vtable for
>             desktop::Desktop+16>
>         },
>         members of desktop::Desktop:
>         m_rSplashScreen = empty uno::Reference,
>         m_bCleanedExtensionCache = false,
>         m_bServicesRegistered = true,
>         m_aBootstrapError = desktop::Desktop::BE_OK,
>         m_aBootstrapErrorMessage = "",
>         m_aBootstrapStatus = desktop::Desktop::BS_OK,
>         m_xLockfile = {
>         px = 0x7f1209768db0
>         },
>         m_firstRunTimer = {
>         _vptr.Timer = 0x7f1203ee09b0 <vtable for Timer+16>,
>         mpTimerData = 0x0,
>         mnTimeout = 1,
>         mbActive = false,
>         mbAuto = false,
>         maTimeoutHdl = {
>         pInst = 0x0,
>         pFunc = 0x0
>         }
>         },
>         static pResMgr = 0x0
>         }
>         rCmdLineArgs = @0x7f12086472c0: {
>         <boost::noncopyable_::noncopyable> = {<No data fields>},
>         members of desktop::CommandLineArgs:
>         m_cwdUrl = {
>         <boost::optional_detail::optional_base<rtl::OUString>> = {
>         <boost::optional_detail::optional_tag> = {<No data fields>},
>         members of
>             boost::optional_detail::optional_base<rtl::OUString>:
>         m_initialized = true,
>         m_storage = {
>         dummy_ = {
>         data = "x\340\243\b\022\177\000",
>         aligner_ = {<No data fields>}
>         }
>         }
>         }, <No data fields>},
>         m_minimized = false,
>         m_invisible = false,
>         m_norestore = false,
>         m_headless = false,
>         m_quickstart = false,
>         m_noquickstart = false,
>         m_terminateafterinit = false,
>         m_nofirststartwizard = false,
>         m_nologo = false,
>         m_nolockcheck = false,
>         m_nodefault = false,
>         m_help = false,
>         m_writer = false,
>         m_calc = false,
>         m_draw = false,
>         m_impress = false,
>         m_global = false,
>         m_math = false,
>         m_web = false,
>         m_base = false,
>         m_helpwriter = false,
>         m_helpcalc = false,
>         m_helpdraw = false,
>         m_helpbasic = false,
>         m_helpmath = false,
>         m_helpimpress = false,
>         m_helpbase = false,
>         m_version = false,
>         m_splashpipe = true,
>         m_unknown = "",
>         m_bEmpty = false,
>         m_bDocumentArgs = true,
>         m_accept = std::vector of length 0, capacity 0,
>         m_unaccept = std::vector of length 0, capacity 0,
>         m_openlist = std::vector of length 1, capacity 1 =
>             {"/tmp/doc.ods"},
>         m_viewlist = std::vector of length 0, capacity 0,
>         m_startlist = std::vector of length 0, capacity 0,
>         m_forceopenlist = std::vector of length 0, capacity 0,
>         m_forcenewlist = std::vector of length 0, capacity 0,
>         m_printlist = std::vector of length 0, capacity 0,
>         m_printtolist = std::vector of length 0, capacity 0,
>         m_printername = "",
>         m_conversionlist = std::vector of length 0, capacity 0,
>         m_conversionparams = "",
>         m_conversionout = "",
>         m_infilter = std::vector of length 0, capacity 0,
>         m_language = "",
>         m_pidfile = ""
>         }
>         aUnknown = ""
> 
> #33 main
>     at /usr/src/debug/libreoffice-4.3.6.2/desktop/source/app/main.c:48
>         ret = <optimized out>
>         ret = 0
> 
> #34 main
>     (argc=<optimized out>, argv=<optimized out>)
>     at /usr/src/debug/libreoffice-4.3.6.2/desktop/source/app/main.c:47
>         ret = 0

Per non-sensible aObjName at frame #1, I guess we are observing some kind
of undo-stack corruption (elevating into frame corruption per frame #0).

Note that it might also be related to copy + paste of the whole slide.
Even now, with libreoffice-4.3.6.2-9.fc21.x86_64, it can do strange
things -- just now, I am unable to Undo such an action even though
I can see "Undo: Insert slides" active in the menu.