Crash verified on Mac OS X Intel ( 10.4) by me, and on Linux by JB Faure

Steps to reproduce :

1) Open a new Writer document
2) Insert whatever autoshape, e.g. a smiley 
3) Select the autoshape
4) Right click -> Anchor -> as Character  


* Expected:  shape anchored as character

* Current result : crash


Note: same for other cases (at page, .. )


After investigations, it seems that some properties of the new anchor are NULL or missing (probably 
page number, or index.

Code concerned :

(gdb) info b
Num Type           Disp Enb Address    What
1   breakpoint     keep y   0x3323104d in SwDoc::ChgAnchor(SdrMarkList const&, RndStdIds, unsigned 
char, unsigned char) at /Users/ericb/Desktop/DEV300_m54/sw/source/core/doc/docfly.cxx:600

The crash occurs around line 774 :

aNewAnch.SetAnchor( &aPos );       // Comment:  aPos contains : 

SetAttr( aNewAnch, *pContact->GetFmt() );    


The trace gives :

774                         aNewAnch.SetAnchor( &aPos );
(gdb) 
775                         SetAttr( aNewAnch, *pContact->GetFmt() );
(gdb) 
terminate called after throwing an instance of 'com::sun::star::uno::RuntimeException'

Program received signal SIGABRT, Aborted.
0x9003d66c in kill ()
(gdb) x 0x9003d66c
0x9003d66c <kill+12>:   0x00e80e73


And the stack :

(gdb) bt
#0  0x9003d66c in kill ()
#1  0x9010e8cf in raise ()
#2  0x9010d422 in abort ()
#3  0x90b4539c in __gnu_cxx::__verbose_terminate_handler ()
#4  0x90b43602 in __gxx_personality_v0 ()
#5  0x90b43640 in std::terminate ()
#6  0x90b43754 in __cxa_throw ()
#7  0x2bb431b3 in SdrObject::getShapePropertyChangeNotifier ()
#8  0x32ecd949 in SwDrawContact::Modify (this=0x279e9710, pOld=0xbfffa914, pNew=0xbfffa8fc) at 
/Users/ericb/Desktop/DEV300_m54/sw/source/core/draw/dcontact.cxx:1656
#9  0x32e425a4 in SwModify::Modify (this=0x25125000, pOldValue=0xbfffa914, 
pNewValue=0xbfffa8fc) at /Users/ericb/Desktop/DEV300_m54/sw/source/core/attr/calbck.cxx:244
#10 0x32e45223 in SwFmt::Modify (this=0x25125000, pOldValue=0xbfffa914, pNewValue=0xbfffa8fc) 
at /Users/ericb/Desktop/DEV300_m54/sw/source/core/attr/format.cxx:389
#11 0x32ee8663 in SwFrmFmt::Modify (this=0x25125000, pOld=0xbfffa914, pNew=0xbfffa8fc) at 
/Users/ericb/Desktop/DEV300_m54/sw/source/core/layout/atrfrm.cxx:2480
#12 0x32e4587d in SwFmt::SetFmtAttr (this=0x25125000, rSet=@0xbfffa9b8) at 
/Users/ericb/Desktop/DEV300_m54/sw/source/core/attr/format.cxx:530
#13 0x3303a0d8 in SwDoc::SetAttr (this=0x12917a00, rSet=@0xbfffa9b8, rFmt=@0x25125000) at 
/Users/ericb/Desktop/DEV300_m54/sw/source/core/doc/docfmt.cxx:1182
#14 0x3303a1df in SwDoc::SetAttr (this=0x12917a00, rAttr=@0xbfffab10, rFmt=@0x25125000) at 
/Users/ericb/Desktop/DEV300_m54/sw/source/core/doc/docfmt.cxx:1170
#15 0x330ae8b5 in SwDoc::ChgAnchor (this=0x12917a00, _rMrkList=@0x31e464c0, 
_eAnchorType=FLY_IN_CNTNT, _bSameOnly=0 '\0', _bPosCorr=1 '\001') at 
/Users/ericb/Desktop/DEV300_m54/sw/source/core/doc/docfly.cxx:775



BTW: the indentation in the code is awfull :/