<html>
    <head>
      <base href="https://bugs.documentfoundation.org/">
    </head>
    <body><span class="vcard"><a class="email" href="mailto:serval2412@yahoo.fr" title="Julien Nabet <serval2412@yahoo.fr>"> <span class="fn">Julien Nabet</span></a>
</span> changed
          <a class="bz_bug_link 
          bz_status_NEW "
   title="NEW - CRASH: bad dynamic_cast! after redo operation"
   href="https://bugs.documentfoundation.org/show_bug.cgi?id=108124">bug 108124</a>
          <br>
             <table border="1" cellspacing="0" cellpadding="8">
          <tr>
            <th>What</th>
            <th>Removed</th>
            <th>Added</th>
          </tr>

         <tr>
           <td style="text-align:right;">CC</td>
           <td>
                
           </td>
           <td>mstahl@redhat.com, serval2412@yahoo.fr
           </td>
         </tr></table>
      <p>
        <div>
            <b><a class="bz_bug_link 
          bz_status_NEW "
   title="NEW - CRASH: bad dynamic_cast! after redo operation"
   href="https://bugs.documentfoundation.org/show_bug.cgi?id=108124#c4">Comment # 4</a>
              on <a class="bz_bug_link 
          bz_status_NEW "
   title="NEW - CRASH: bad dynamic_cast! after redo operation"
   href="https://bugs.documentfoundation.org/show_bug.cgi?id=108124">bug 108124</a>
              from <span class="vcard"><a class="email" href="mailto:serval2412@yahoo.fr" title="Julien Nabet <serval2412@yahoo.fr>"> <span class="fn">Julien Nabet</span></a>
</span></b>
        <pre>On pc Debian x86-64 with master sources updated 3 days ago, I could reproduce
this.
This assert is triggered because it's a SwGrfNode
$4 = (SwNode &) @0x555558385210: {<BigPtrEntry> = {_vptr.BigPtrEntry =
0x7fffca649208 <vtable for SwGrfNode+208>, m_pBlock = 0x555557861a90, m_nOffset
= 18}, 
  m_nNodeType = SwNodeType::Grf, m_nAFormatNumLvl = 0 '\000', m_bSetNumLSpace =
false, m_bIgnoreDontExpand = false, static s_nSerial = 89, m_nSerial = 80, 
  m_pAnchoredFlys = std::unique_ptr<std::__debug::vector<SwFrameFormat*,
std::allocator<SwFrameFormat*> >> containing 0x0, m_pStartOfSection =
0x55555bebad60}

Here's the test which fails:
   1507     // anchor only to paragraphs, or start nodes in case of
RndStdIds::FLY_AT_FLY
   1508     // also allow table node, this is used when a table is selected and
is converted to a frame by the UI
   1509     assert(!pPos
   1510             || ((RndStdIds::FLY_AT_FLY == nAnchorId) &&
   1511                     dynamic_cast<SwStartNode*>(&pPos->nNode.GetNode()))
   1512             || (RndStdIds::FLY_AT_PARA == nAnchorId &&
dynamic_cast<SwTableNode*>(&pPos->nNode.GetNode()))
   1513             || dynamic_cast<SwTextNode*>(&pPos->nNode.GetNode()));
(see
<a href="http://opengrok.libreoffice.org/xref/core/sw/source/core/layout/atrfrm.cxx#1505">http://opengrok.libreoffice.org/xref/core/sw/source/core/layout/atrfrm.cxx#1505</a>)

Michael: noticing
<a href="https://cgit.freedesktop.org/libreoffice/core/commit/?id=0ed73a0817ad0ff0107cb297208252c0afe3b4a9">https://cgit.freedesktop.org/libreoffice/core/commit/?id=0ed73a0817ad0ff0107cb297208252c0afe3b4a9</a>,
thought you might have some idea here.</pre>
        </div>
      </p>


      <hr>
      <span>You are receiving this mail because:</span>

      <ul>
          <li>You are the assignee for the bug.</li>
      </ul>
    </body>
</html>