Crash during Traditional Chinese <-> Simplified Chinese conversion

[Matteo Casalin]

Hi all,
     I've been lately struggling with crash in conversion from 
Traditional to Simplified Chinese in Writer. After some debugging, I 
tracked the problem to access to released memory, but I don't know ho to 
proceed to solve the issue since it involves a deeper knowledge than I 
have about Writer internal structure.
I really would appreciate if anybody could give me any hint on this.
Here are the details:
The conversion is handled by editeng::HangulHanjaConversion class, which 
is used as a base class for SwHHCWrapper (and is also derived in a 
parallel manner also in editeng itself). Without digging into details 
(the flow is quite convoluted), the problem arises in SwTxtNode::Convert 
(sw/source/core/txtnode/txtedt.cxx) as follow:
* line 1074: instantiate a SwLanguageIterator object, which builds a 
list of pointers to non-copiable SwTxtAttr;
* line 1111: call SetLanguageAndFont, which destroys the original 
SwTxtAttr items which the iterator still points to;
* line 1117: access the now deleted iterator items.

 From my limited understanding, the issue is triggered by the presence 
of non-chinese text intermixed with chinese one (but I could be wrong), 
in this case the text was a numbered title like:

    1. <some chinese characters>

where the "1. " should activate the call to SetLanguageAndFont.

I'm also asking permission to share the document which trigger the crash 
(or a minimal one with the same characteristics) in case anybody would 
like to give it a try.

Thanks in advance for any advice!

Cheers
Matteo