https://bugs.documentfoundation.org/show_bug.cgi?id=159719
--- Comment #6 from Armin Le Grand <armin.le.gr...@me.com> --- Looking at the attached stack: LineNumbers do not fit to master. getTargetPool calls getTargetPool -> 1st IsInRange was false. Uses mpSecondary for next call to getTargetPool, that gets us to a wrong this ptr -> mpSecondary is not initialized (?) mpSecondary is a rtl::Reference<SfxItemPool> mpSecondary; and gets initialized in both constructors using , mpSecondary() (not really needed, but is even done) so should contain nullptr. Another possibility may be SfxRequest_Impl::~SfxRequest_Impl: it destroys a set SfxPoolItemHolder aRetVal using the remembered pool. If that pool is already deleted that may happen (but would have led to problems before?). There is also SfxRequest_Impl::SetPool that may change the pool member. In that case aRetVal *should* be reset which is not done yet. OTOH that was std::unique_ptr<SfxPoolItem> pRetVal; // Return value belongs to itself before, so ~SfxPoolItem would have been called in the same situation, but would indeed *survive* without/changed/deleted pool. Hmmm... Need to reproduce - any tipps..? -- You are receiving this mail because: You are the assignee for the bug.