Created attachment 46597 [details]
Sample document

With the sample document the bug is 100% reproducible for me:

1. Open Sample by double click from WIN Explorer
2. Select with pushed left mouse button A1:J14
3. <ctrl+c> for copy
4. Menu 'File > New > Text document
   new document appears
5. Click into new document
6. Click down-arrow of Paste-Icon, so that selection appears
7. Click "As GDI Metafile"
   Expected: Table dontents pasted
   actual: LibO crashes and disappears

It seems that the problem is related to the heading of the selected Spreadsheet range, and there with the rotated text.

In my "newsample.ods" you will find 3 rows. Crash will be reproducible with A1:K1 and A5:K5, but not with A6:K3

Crash is not limited to WRITER, I also see it when I 'paste special' to DRAW

Created attachment 46601 [details]
Sample Document, see Comment 2

Due to results with DRAW: Component LibO

tor, could you see if you can provide a stack trace

2 additional strange details:
The crash also is reproducible for me when I paste as bitmap
No crash when I copy from OOo-dev3.4 spreadsheet to LibO WRITER document as GDI or bitmap

Stack trace:

>	scmi.dll!ScOutputData::DrawRotatedFrame(const Color * pForceColor=0x00000000)  Line 1531 + 0xc5 bytes	C++
 	scmi.dll!ScOutputData::DrawFrame()  Line 1159	C++
 	scmi.dll!ScPrintFunc::DrawToDev(ScDocument * pDoc=0x12b09050, OutputDevice * pDev=0x00e9eb84, double __formal=1.0000000000000000, const Rectangle & rBound={...}, ScViewData * pViewData=0x00e9bfc0, unsigned char bMetaFile='')  Line 635	C++
 	scmi.dll!ScDocShell::Draw(OutputDevice * pDev=0x00e9eb84, const JobSetup & __formal={...}, unsigned short nAspect=1)  Line 1921 + 0x2b bytes	C++
 	sfxmi.dll!0166b0d4() 	
 	[Frames below may be incorrect and/or missing, no symbols loaded for sfxmi.dll]	
 	sfxmi.dll!0166b2b0() 	
 	scmi.dll!ScTransferObj::GetData(const com::sun::star::datatransfer::DataFlavor & rFlavor={...})  Line 374 + 0x5e bytes	C++

It is irritating to debug this, because after compiling sc with debug=t, when loading the newsample.ods, I get lots and lots of Assertion Failed! dialogs that I have to click "No" to (to ignore the assertion failure)...

The problem seems to be when ScOutputData::DrawRotatedFrame(const Color * pForceColor=0x00000000) calls  ScOutputData::CreateProcessor2D()  which then calls pDoc->GetDrawLayer(), which returns NULL. ScOutputData::CreateProcessor2D()  then returns NULL, too, which is assigned to pProcessor in ScOutputData::DrawRotatedFrame(). Later at line 1523 pProcessor is dereferenced anyway.

And here is the stack trace from when the ScOutputData is constructed where the pDoc->pDrawLayer is NULL. This happens when choosing the "GDI metafile" from the Paste drop-down menu.

>	scmi.dll!ScOutputData::ScOutputData(OutputDevice * pNewDev=0x00e9eb84, ScOutputType eNewType=OUTTYPE_PRINTER, ScTableInfo & rTabInfo={...}, ScDocument * pNewDoc=0x12b0f780, short nNewTab=0, long nNewScrX=1, long nNewScrY=1, short nNewX1=0, long nNewY1=0, short nNewX2=9, long nNewY2=13, double nPixelPerTwipsX=1.7546231546231545, double nPixelPerTwipsY=1.7528178243774575, const Fraction * pZoomX=0x00000000, const Fraction * pZoomY=0x00000000)  Line 213	C++
 	scmi.dll!ScPrintFunc::DrawToDev(ScDocument * pDoc=0x12b0f780, OutputDevice * pDev=0x00e9eb84, double __formal=1.0000000000000000, const Rectangle & rBound={...}, ScViewData * pViewData=0x00e9bfc0, unsigned char bMetaFile='')  Line 581 + 0x63 bytes	C++
 	scmi.dll!ScDocShell::Draw(OutputDevice * pDev=0x00e9eb84, const JobSetup & __formal={...}, unsigned short nAspect=1)  Line 1921 + 0x2b bytes	C++
 	sfxmi.dll!0166b0d4() 	
 	[Frames below may be incorrect and/or missing, no symbols loaded for sfxmi.dll]	
 	sfxmi.dll!0166b2b0() 	
 	scmi.dll!ScTransferObj::GetData(const com::sun::star::datatransfer::DataFlavor & rFlavor={...})  Line 374 + 0x5e bytes	C++

Created attachment 49095 [details]
Sample with rotated text that does not crash

I can't tell whether that's useful additional information:
Copy / Paste as GDI does not crash for 'Sheet2.A5:K5' from "latestsample.ods"
With 3.4.1 WIN7

Worked before 3.4 (Today checked again with 3.3.3 portable

This doesn't crash for me on master and 3-4. Reading Tor's comments and checking ScOutputData::CreateProcessor2D this was fixed by ensuring a drawlayer exists with http://cgit.freedesktop.org/libreoffice/calc/commit/?h=libreoffice-3-4&id=923514a2dc7a0de237eba70f131f361efd33865a

*** This bug has been marked as a duplicate of bug 36688 ***