At least on recent master before <https://cgit.freedesktop.org/libreoffice/core/commit/?id=9dd0c0fcc141ae53cacb29cd0b144ac2b13e9f86> "Missing dependency", executing CppunitTest_sw_uiwriter (in an (implicitly) --with-fonts configuration) while ExternalPackage_fonts_liberation is not installed (which can be reproduced with 'make CppunitTest_sw_uiwriter && make ExternalPackage_fonts_liberation && cd sw && make CppunitTest_sw_uiwriter') causes various crashes: First one is a signed integer overflow (as reported by UBSan), see the backtrace in the commit message of <https://cgit.freedesktop.org/libreoffice/core/commit/?id=63d845dc88690b9c5c8194e1512a8e4390c7ee24> "Fix -fsanitize=signed-integer-overflow" (which was obtained with an --enable-optimized build, so some "trivial" frames are missing from the backtrace due to inlining). Second one is a null deref (that causes a SEGV also in non-UBSan builds): > Thread 1 (Thread 0x7f81fca39740 (LWP 20251)): > #0 0x00007f81d9b83cbc in SwFlowFrame::UnlockJoin() (this=0x0) at /data/lo/core/sw/source/core/inc/flowfrm.hxx:138 > #1 0x00007f81d9e8d6c5 in TableSplitRecalcUnlock(SwFlowFrame*) (pTab=0x0) at /data/lo/core/sw/source/core/layout/tabfrm.cxx:622 > #2 0x00007f81d9e7b106 in lcl_RecalcSplitLine(SwRowFrame&, SwRowFrame&, long, long) (rLastLine=..., rFollowLine=..., nRemainingSpaceForLastRow=11901, nAlreadyFree=0) at /data/lo/core/sw/source/core/layout/tabfrm.cxx:692 > bRet = true > pRenderContext = 0x731ed90 > rTab = @0x7f81c949aa20: {<SwLayoutFrame> = {<SwFrame> = {<SwClient> = {<sw::WriterListener> = {_vptr$WriterListener = 0x7f81db60f150 <vtable for SwTabFrame+16>, m_pLeft = 0x58ff730, m_pRight = 0x0}, m_pRegisteredIn = 0x7f81c9495000}, <SfxBroadcaster> = {_vptr$SfxBroadcaster = 0x7f81db60f260 <vtable for SwTabFrame+288>, mpImpl = std::unique_ptr<SfxBroadcaster::Impl> containing 0x63dd6f0}, static mpCache = 0x2580950, mbInDtor = false, static mnLastFrameId = 5563, mnFrameId = 5266, mpRoot = 0x6345c00, mpUpper = 0x7f81ce4be1d0, mpNext = 0x0, mpPrev = 0x7f81b6e6eec8, mpDrawObjs = 0x0, maFrame = SwRect = {point = Point = {x = 1724, y = 3590}, size = Size = {width = 9446, height = 20068}}, maPrt = SwRect = {point = Point = {x = 0, y = 0}, size = Size = {width = 9446, height = 20068}}, mnFrameType = SwFrameType::Tab, mbReverse = false, mbInvalidR2L = false, mbDerivedR2L = true, mbRightToLeft = false, mbInvalidVert = false, mbDerivedVert = true, mbVertical = false, mbVertLR = false, mbValidPos = false, mbValidPrtArea = false, mbValidSize = false, mbValidLineNum = false, mbFixSize = false, mbCompletePaint = false, mbRetouche = true, mbInfInvalid = false, mbInfBody = true, mbInfTab = true, mbInfFly = false, mbInfFootnote = false, mbInfSct = false, mbColLocked = false, m_isInDestroy = false, mbForbidDelete = false}, m_pLower = 0x7f81b4cfba58, m_VertPosOrientFramesFor = std::__debug::vector of length 0, capacity 0}, <SwFlowFrame> = {_vptr$SwFlowFrame = 0x7f81db60f280 <vtable for SwTabFrame+320>, m_rThis = @0x7f81c949aa20, static m_bMoveBwdJump = false, m_pFollow = 0x0, m_pPrecede = 0x0, m_bLockJoin = true, m_bUndersized = false, m_bFlyLock = false}, m_pTable = 0x58ff730, m_bComplete = true, m_bCalcLowers = false, m_bLowersFormatted = true, m_bLockBackMove = false, m_bResizeHTMLTable = false, m_bONECalcLowers = false, m_bHasFollowFlowLine = true, m_bIsRebuildLastLine = true, m_bRestrictTableGrowth = false, m_bRemoveFollowFlowLinePending = false, m_bConsiderObjsForMinCellHeight = true, m_bObjsDoesFit = true, m_bInRecalcLowerRow = false, static aPool = {m_pImpl = 0x7f81dfd97900, m_pTypeName = 0x7f81dabadffe "SwTabFrame"}} > aRectFnSet = {m_bVert = false, m_bRev = false, m_bVertL2R = false, m_fnRect = 0x7f81db6bef30 <aHorizontal>} > nCurLastLineHeight = 19621 > bUnlockMaster = false > bUnlockFollow = true > pMaster = 0x0 > bInSplit = false > nDistanceToUpperPrtBottom = 140195063765072 > #3 0x00007f81d9e7a3e5 in SwTabFrame::Split(long, bool, bool) (this=0x7f81c949aa20, nCutPos=15938, bTryToSplit=true, bTableRowKeep=false) at /data/lo/core/sw/source/core/layout/tabfrm.cxx:1268 > bRet = true > aRectFnSet = {m_bVert = false, m_bRev = false, m_bVertL2R = false, m_fnRect = 0x7f81db6bef30 <aHorizontal>} > pRow = 0x0 > nRepeat = 0 > nRowCount = 1 > nRemainingSpaceForLastRow = 11901 > bSplitRowAllowed = true > bKeepNextRow = false > bNewFollow = false > pFoll = 0x7f81c949a900 > pLastRow = 0x7f81b4cfbc68 > pFollowRow = 0x7f81b4f99850 > nShrink = 0 > #4 0x00007f81d9e7ff16 in SwTabFrame::MakeAll(OutputDevice*) (this=0x7f81c949aa20, pRenderContext=0x731ed90) at /data/lo/core/sw/source/core/layout/tabfrm.cxx:2387 > bSplitError = 127 > nDeadLine = 15938 > nMinNumOfLines = 0 > nBreakLine = 3590 > bMoveable = true > n1StLineHeight = 0 > bAllowSplitOfRow = false > aOldPos = Point = {x = 1724, y = 3590} > pIndPrev = 0x7f81b6e6eec8 > pOldUpper = 0x7ffd5023fe40 > nDistanceToUpperPrtBottom = -242 > pSh = 0x6e83390 > bBrowseMode = false > pFirstNonHeadlineRow = 0x7f81b4cfba58 > bEmulateTableKeepFwdMoveAllowed = true > nStack = 0 '\000' > aEnter = {pImpl = 0x0} > aNotify = {<SwFrameNotify> = {mpFrame = 0x7f81c949aa20, maFrame = SwRect = {point = Point = {x = 1724, y = 3590}, size = Size = {width = 9446, height = 12590}}, maPrt = SwRect = {point = Point = {x = 0, y = 0}, size = Size = {width = 9446, height = 12590}}, mnFlyAnchorOfst = 0, mnFlyAnchorOfstNoWrap = 0, mbHadFollow = false, mbInvaKeep = false, mbValidSize = false}, m_bLowersComplete = false} > bOldValidPos = true > bMakePage = true > bMovedBwd = false > bMovedFwd = false > bSplit = true > bFootnotesInDoc = false > bFly = false > pAccess = std::unique_ptr<SwBorderAttrAccess> containing 0x63347b0 > pAttrs = 0x7f81ce4bd738 > bEmulateTableKeep = false > bKeep = false > bDontSplit = false > nRepeat = 0 > bTryToSplit = true > bTableRowKeep = false > bLastRowHasToMoveToFollow = false > bLastRowMoveNoMoreTries = false > nUnSplitted = 5 > nThrowAwayValidLayoutLimit = 4 > aRectFnSet = {m_bVert = false, m_bRev = false, m_bVertL2R = false, m_fnRect = 0x7f81db6bef30 <aHorizontal>} > #5 0x00007f81d9d65905 in SwFrame::PrepareMake(OutputDevice*) (this=0x7f81c949aa20, pRenderContext=0x731ed90) at /data/lo/core/sw/source/core/layout/calcmove.cxx:346 > aHack = {static nCnt = 1 '\001', static bLocked = false} > #6 0x00007f81d9e956af in SwFrame::Calc(OutputDevice*) const (this=0x7f81c949aa20, pRenderContext=0x731ed90) at /data/lo/core/sw/source/core/layout/trvlfrm.cxx:1769 > #7 0x00007f81d9dd82aa in SwLayAction::FormatLayoutTab(SwTabFrame*, bool) (this=0x7ffd50240e30, pTab=0x7f81c949aa20, bAddRect=true) at /data/lo/core/sw/source/core/layout/layact.cxx:1467 > aOldRect = SwRect = {point = Point = {x = 1724, y = 3590}, size = Size = {width = 9446, height = 12590}} > aPaintFrame = SwRect = {point = Point = {x = 140195674551744, y = 8799554101824}, size = Size = {width = 8796093037567, height = 140724603455488}} > pRenderContext = 0x731ed90 > rTimerAccess = @0x634cd00: {_vptr$IDocumentTimerAccess = 0x7f81db5fa080 <vtable for sw::DocumentTimerManager+16>} > bChanged = false > bPainted = false > pOldPage = 0x7f81ce4bc210 > aRectFnSet = {m_bVert = false, m_bRev = false, m_bVertL2R = false, m_fnRect = 0x7f81db6bef30 <aHorizontal>} > #8 0x00007f81d9dd6212 in SwLayAction::FormatLayout(OutputDevice*, SwLayoutFrame*, bool) (this=0x7ffd50240e30, pRenderContext=0x731ed90, pLay=0x7f81ce4be1d0, bAddRect=true) at /data/lo/core/sw/source/core/layout/layact.cxx:1360 > bChanged = false > bAlreadyPainted = false > aFrameAtCompletePaint = SwRect = {point = Point = {x = 0, y = 0}, size = Size = {width = 0, height = 0}} > pLow = 0x7f81c949aa20 > bTabChanged = false > aBoundRect = SwRect = {point = Point = {x = 135, y = 12330}, size = Size = {width = 17265, height = 135}} > #9 0x00007f81d9dd6295 in SwLayAction::FormatLayout(OutputDevice*, SwLayoutFrame*, bool) (this=0x7ffd50240e30, pRenderContext=0x731ed90, pLay=0x7f81ce4bc210, bAddRect=true) at /data/lo/core/sw/source/core/layout/layact.cxx:1363 > bChanged = false > bAlreadyPainted = false > aFrameAtCompletePaint = SwRect = {point = Point = {x = 0, y = 0}, size = Size = {width = 0, height = 0}} > pLow = 0x7f81ce4be1d0 > bTabChanged = false > aBoundRect = SwRect = {point = Point = {x = 135, y = 135}, size = Size = {width = 12196, height = 17131}} > #10 0x00007f81d9dd3506 in SwLayAction::InternalAction(OutputDevice*) (this=0x7ffd50240e30, pRenderContext=0x731ed90) at /data/lo/core/sw/source/core/layout/layact.cxx:550 > nLoopControlRuns_1 = 2 > nLoopControlMax = 20 > pPage = 0x7f81ce4bc210 > nFirstPageNum = 1 > rLayoutAccess = @0x643f590: {_vptr$IDocumentLayoutAccess = 0x7f81db5fbc60 <vtable for sw::DocumentLayoutManager+16>} > bNoLoop = true > nPercentPageNum = 0 > #11 0x00007f81d9dd294a in SwLayAction::Action(OutputDevice*) (this=0x7ffd50240e30, pRenderContext=0x731ed90) at /data/lo/core/sw/source/core/layout/layact.cxx:341 > #12 0x00007f81da48bbc3 in SwViewShell::ImplEndAction(bool) (this=0x6e83390, bIdleEnd=false) at /data/lo/core/sw/source/core/view/viewsh.cxx:280 > aAction = {m_pRoot = 0x6345c00, m_pImp = 0x56cf4b0, m_pOptTab = 0x7f81c949aa20, m_pWait = 0x0, m_nPreInvaPage = 65535, m_nStartTicks = 77770175, m_nInputType = VclInputFlags::KEYBOARD, m_nEndPage = 65535, m_nCheckPageNum = 65535, m_bPaint = false, m_bComplete = false, m_bCalcLayout = false, m_bAgain = true, m_bNextCycle = false, m_bInput = false, m_bIdle = false, m_bReschedule = false, m_bCheckPages = true, m_bUpdateExpFields = false, m_bBrowseActionStop = false, m_bWaitAllowed = true, m_bPaintExtraData = false, m_bActionInProgress = true, mbFormatContentOnInterrupt = false} > bIsShellForCheckViewLayout = true > aCurr = {pPrev = 0x6e83390, pRoot = 0x6345c00} > bExtraData = false > #13 0x00007f81d9750f21 in SwViewShell::EndAction(bool) (this=0x6e83390, bIdleEnd=false) at /data/lo/core/sw/inc/viewsh.hxx:605 > #14 0x00007f81d973f73a in SwCursorShell::EndAction(bool, bool) (this=0x6e83390, bIdleEnd=false, DoSetPosX=false) at /data/lo/core/sw/source/core/crsr/crsrsh.cxx:258 > g = {<comphelper::ScopeGuard> = {m_func = {<std::_Maybe_unary_or_binary_function<void>> = {<No data fields>}, <std::_Function_base> = {static _M_max_size = 16, static _M_max_align = 8, _M_functor = {_M_unused = {_M_object = 0x6e834a4, _M_const_object = 0x6e834a4, _M_function_pointer = 0x6e834a4, _M_member_pointer = (void (std::_Undefined_class::*)(std::_Undefined_class * const)) 0x6e834a4, this adjustment 140725947993600}, _M_pod_data = "\244\064\350\006\000\000\000\000\000\016$P\375\177\000"}, _M_manager = 0x7f81d9753dc0 <std::_Function_base::_Base_manager<comphelper::FlagRestorationGuard::RestoreFlag>::_M_manager(std::_Any_data&, std::_Any_data const&, std::_Manager_operation)>}, _M_invoker = 0x7f81d9753d90 <std::_Function_handler<void (), comphelper::FlagRestorationGuard::RestoreFlag>::_M_invoke(std::_Any_data const&)>}}, <No data fields>} > bVis = true > eFlags = 5 > bSavSVCursorVis = true > #15 0x00007f81daa3e88f in SwView::OuterResizePixel(Point const&, Size const&) (this=0x73b42f0, rOfst=Point = {...}, rSize=Size = {...}) at /data/lo/core/sw/source/uibase/uiview/viewport.cxx:1116 > bScroll1 = true > bScroll2 = true > aBorder = {nTop = 25, nRight = 16, nBottom = 16, nLeft = 0} > aEditSz = Size = {width = 784, height = 559} > bShowH = true > bShowV = true > bAuto = true > bHAuto = true > pVOpt = 0x6e4a500 > pDocSh = 0x6de37b0 > bIsPreview = false > aCurr = {pPrev = 0x6e83390, pRoot = 0x6345c00} > bRepeat = false > nCnt = 1 > bUnLockView = true > #16 0x00007f81de0ca414 in SfxViewFrame::DoAdjustPosSizePixel(SfxViewShell*, Point const&, Size const&, bool) (this=0x5c44420, pSh=0x73b42f0, rPos=Point = {...}, rSize=Size = {...}, inplaceEditModeChange=false) at /data/lo/core/sfx2/source/view/viewfrm.cxx:1490 > #17 0x00007f81de0cfe2a in SfxViewFrame::Resize(bool) (this=0x5c44420, bForce=false) at /data/lo/core/sfx2/source/view/viewfrm.cxx:2275 > pShell = 0x73b42f0 > aSize = Size = {width = 800, height = 600} > #18 0x00007f81de0d8d28 in SfxFrameViewWindow_Impl::Resize() (this=0x6402b30) at /data/lo/core/sfx2/source/view/viewfrm2.cxx:73 > #19 0x00007f81ec559255 in vcl::Window::ImplCallResize() (this=0x6402b30) at /data/lo/core/vcl/source/window/event.cxx:522 > #20 0x00007f81ec6b9572 in vcl::Window::Show(bool, ShowFlags) (this=0x6402b30, bVisible=true, nFlags=ShowFlags::NONE) at /data/lo/core/vcl/source/window/window.cxx:2274 > pTestParent = 0x6402b30 > xWindow = {_vptr$VclPtr = 0x7f81ed6e7350 <vtable for VclPtr<vcl::Window>+16>, m_rInnerRef = rtl::Reference to 0x6402b30} > bRealVisibilityChanged = false > #21 0x00007f81de0af0d6 in SfxBaseController::ConnectSfxFrame_Impl(SfxBaseController::ConnectSfxFrame) (this=0x7f81b6473ab8, i_eConnect=SfxBaseController::E_CONNECT) at /data/lo/core/sfx2/source/view/sfxbasecontroller.cxx:1250 > pEditWin = 0x731ed90 > pFrameWin = 0x6402b30 > pViewFrame = 0x5c44420 > bConnect = true > nViewNo = 36838 > #22 0x00007f81de0ae60f in SfxBaseController::attachFrame(com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) (this=0x7f81b6473ab8, xFrame=uno::Reference to ((anonymous namespace)::Frame *) 0x7f81c75085e8) at /data/lo/core/sfx2/source/view/sfxbasecontroller.cxx:550 > aHint = {<SfxEventHint> = {<SfxHint> = {_vptr$SfxHint = 0x7f81b6278310, mnId = 1344543696}, pObjShell = 0x7f81b6473ae0, aEventName = "媵\xde09羁\000ᰀ値翽\000\xdde2羁\000㡨۞\000\000⏸\xdb71羁\000㫠뙇羁\000뵸ɖ\000Ā㫠뙇羁\000㫠뙇羁\000牰큂羁\000藨읐羁\000㫠뙇羁\000堠\xdaaa羁\000樨똧羁\000樨똧羁\000ᱰ値翽Ā樨똧羁\000ೀ\xde0b羁\000㫠뙇羁\000㫠뙇羁\000ὠ値翽\000Ӱ\xddf5羁\000樨똧羁\000ᴈ値翽\000\x1f58値翽\000\x1f58値翽\000⋘콓羁\000᳐値翽\000挶\xdda0羁\000ὠ値翽\000‐値翽\000⍀値翽\000⁈値翽\000\000\000\000\000㫠뙇羁\000荰똧羁\000㫠뙇羁\000樨똧羁\000쒥羁\000㫠뙇羁\000떞혏迦₰値翽\000㗕\xde09羁\000ᵐ値翽\000璐등羁\000\000\000\000\000\000\000\003\000㪠\xde6e\002\000ɘ\000\000⏰\xdb71羁\000"..., nEventId = 1344545600}, xViewController = uno::Reference to (com::sun::star::uno::XInterface *) 0x7ffd50242340} > xCloseable = uno::Reference to ((anonymous namespace)::Frame *) 0x7f81c7508618 > xTemp = empty uno::Reference > aGuard = {<osl::Guard<comphelper::SolarMutex>> = {pT = 0x19c5550}, <No data fields>} > #23 0x00007f81de095ab5 in (anonymous namespace)::SfxFrameLoader_Impl::impl_createDocumentView(com::sun::star::uno::Reference<com::sun::star::frame::XModel2> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&, comphelper::NamedValueCollection const&, rtl::OUString const&) (i_rModel=uno::Reference to (SwXTextDocument *) 0x7f81b6276a28, i_rFrame=uno::Reference to ((anonymous namespace)::Frame *) 0x7f81c75085e8, i_rViewFactoryArgs=..., i_rViewName="Default") at /data/lo/core/sfx2/source/view/frmload.cxx:599 > xController = uno::Reference to (SwXTextView *) 0x7f81b6473ae0 > #24 0x00007f81de0935d5 in (anonymous namespace)::SfxFrameLoader_Impl::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) (this=0x7f81b4f3ab20, rArgs=uno::Sequence of length 11 = {...}, _rTargetFrame=uno::Reference to ((anonymous namespace)::Frame *) 0x7f81c75085e8) at /data/lo/core/sfx2/source/view/frmload.cxx:716 > xDoc = {pObj = 0x6de37b0} > sViewName = "Default" > aViewCreationArgs = {m_pImpl = std::unique_ptr<comphelper::NamedValueCollection_Impl> containing 0x62f81b0} > nViewId = {m_value = 2} > nViewNo = 0 > xController = uno::Reference to (SwXTextView *) 0x7f81b6473ae0 > xInit = uno::Reference to (com::sun::star::uno::XInterface *) 0x7ffd50241fa0 > aGuard = {<osl::Guard<comphelper::SolarMutex>> = {pT = 0x19c5550}, <No data fields>} > aDescriptor = {m_pImpl = std::unique_ptr<comphelper::NamedValueCollection_Impl> containing 0x2a32400} > xModel = uno::Reference to (SwXTextDocument *) 0x7f81b6276a28 > bExternalModel = false > sURL = "file:///data/lo/core//sw/qa/extras/uiwriter/data/tdf112860.fodt" > bIsFactoryURL = false > bInitNewModel = false > bLoadSuccess = false > #25 0x00007f81d03be4ba in framework::LoadEnv::impl_loadContent() (this=0x7ffd50242758) at /data/lo/core/framework/source/loadenv/loadenv.cxx:1087 > bResult = false > aWriteLock = {pT = 0x7ffd50242758} > sTarget = "_default" > xTargetFrame = uno::Reference to ((anonymous namespace)::Frame *) 0x7f81c75085e8 > xTargetLock = uno::Reference to ((anonymous namespace)::Frame *) 0x7f81c7508610 > bHidden = false > bMinimized = false > bPreview = false > xProgress = uno::Reference to (framework::StatusIndicator *) 0x7f81b4ebbd08 > lDescriptor = uno::Sequence of length 11 = {{Name = "StatusIndicator", Handle = 0, Value = uno::Any("com.sun.star.task.XStatusIndicator": {<com::sun::star::uno::XInterface> = {_vptr$XInterface = 0x7f81b4ebbd08}, <No data fields>}), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "UCBContent", Handle = 0, Value = uno::Any("com.sun.star.ucb.XContent": {<com::sun::star::uno::XInterface> = {_vptr$XInterface = 0x7f81b6466cb0}, <No data fields>}), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "InputStream", Handle = 0, Value = uno::Any("com.sun.star.io.XInputStream": {<com::sun::star::uno::XInterface> = {_vptr$XInterface = 0x7f81b4f7ccf0}, <No data fields>}), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "URL", Handle = 0, Value = uno::Any("string": "file:///data/lo/core//sw/qa/extras/uiwriter/data/tdf112860.fodt"), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "AuthenticationHandler", Handle = 0, Value = uno::Any("com.sun.star.task.XInteractionHandler": {<com::sun::star::uno::XInterface> = {_vptr$XInterface = 0x7f81b4f3cab0}, <No data fields>}), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "FilterName", Handle = 0, Value = uno::Any("string": "OpenDocument Text Flat XML"), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "DocumentService", Handle = 0, Value = uno::Any("string": "com.sun.star.text.TextDocument"), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "MacroExecutionMode", Handle = 0, Value = uno::Any("short": 4), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "UpdateDocMode", Handle = 0, Value = uno::Any("short": 0), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "InteractionHandler", Handle = 0, Value = uno::Any("com.sun.star.task.XInteractionHandler": {<com::sun::star::uno::XInterface> = {_vptr$XInterface = 0x7f81b4f3cab0}, <No data fields>}), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "TypeName", Handle = 0, Value = uno::Any("string": "writer_ODT_FlatXML"), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}} > sURL = "file:///data/lo/core//sw/qa/extras/uiwriter/data/tdf112860.fodt" > xLoader = uno::Reference to ((anonymous namespace)::SfxFrameLoader_Impl *) 0x7f81b4f3ab20 > xAsyncLoader = empty uno::Reference > xSyncLoader = uno::Reference to ((anonymous namespace)::SfxFrameLoader_Impl *) 0x7f81b4f3ab48 > #26 0x00007f81d03b959b in framework::LoadEnv::startLoading() (this=0x7ffd50242758) at /data/lo/core/framework/source/loadenv/loadenv.cxx:372 > aReadLock = {pT = 0x0} > bStarted = false > #27 0x00007f81d03b7fd0 in framework::LoadEnv::loadComponentFromURL(com::sun::star::uno::Reference<com::sun::star::frame::XComponentLoader> const&, com::sun::star::uno::Reference<com::sun::star::uno::XComponentContext> const&, rtl::OUString const&, rtl::OUString const&, int, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (xLoader=uno::Reference to (framework::Desktop *) 0x7f81dfdb7328, xContext=uno::Reference to (cppu::ComponentContext *) 0x7f81fca14e58, sURL="file:///data/lo/core//sw/qa/extras/uiwriter/data/tdf112860.fodt", sTarget="_default", nFlags=0, lArgs=uno::Sequence of length 2 = {...}) at /data/lo/core/framework/source/loadenv/loadenv.cxx:158 > aEnv = {m_mutex = {mutex = 0x5c88a60}, m_xContext = uno::Reference to (cppu::ComponentContext *) 0x7f81fca14e58, m_xBaseFrame = uno::Reference to (framework::Desktop *) 0x7f81dfdb7318, m_xTargetFrame = uno::Reference to ((anonymous namespace)::Frame *) 0x7f81c75085e8, m_sTarget = "_default", m_nSearchFlags = 0, m_lMediaDescriptor = {<comphelper::SequenceAsHashMap> = {m_aMap = std::__debug::unordered_map with 11 elements = {["StatusIndicator"] = uno::Any("com.sun.star.task.XStatusIndicator": {<com::sun::star::uno::XInterface> = {_vptr$XInterface = 0x7f81b4ebbd08}, <No data fields>}), ["UCBContent"] = uno::Any("com.sun.star.ucb.XContent": {<com::sun::star::uno::XInterface> = {_vptr$XInterface = 0x7f81b6466cb0}, <No data fields>}), ["InputStream"] = uno::Any("com.sun.star.io.XInputStream": {<com::sun::star::uno::XInterface> = {_vptr$XInterface = 0x7f81b4f7ccf0}, <No data fields>}), ["URL"] = uno::Any("string": "file:///data/lo/core//sw/qa/extras/uiwriter/data/tdf112860.fodt"), ["AuthenticationHandler"] = uno::Any("com.sun.star.task.XInteractionHandler": {<com::sun::star::uno::XInterface> = {_vptr$XInterface = 0x7f81b4f3cab0}, <No data fields>}), ["FilterName"] = uno::Any("string": "OpenDocument Text Flat XML"), ["DocumentService"] = uno::Any("string": "com.sun.star.text.TextDocument"), ["MacroExecutionMode"] = uno::Any("short": 4), ["UpdateDocMode"] = uno::Any("short": 0), ["InteractionHandler"] = uno::Any("com.sun.star.task.XInteractionHandler": {<com::sun::star::uno::XInterface> = {_vptr$XInterface = 0x7f81b4f3cab0}, <No data fields>}), ["TypeName"] = uno::Any("string": "writer_ODT_FlatXML")}}, <No data fields>}, m_aURL = {Complete = "file:///data/lo/core//sw/qa/extras/uiwriter/data/tdf112860.fodt", Main = "file:///data/lo/core//sw/qa/extras/uiwriter/data/tdf112860.fodt", Protocol = "file://", User = "", Password = "", Server = "", Port = 0, Path = "/data/lo/core//sw/qa/extras/uiwriter/data/", Name = "tdf112860.fodt", Arguments = "", Mark = ""}, m_eFeature = LoadEnvFeatures::NONE, m_eContentType = framework::LoadEnv::E_CAN_BE_LOADED, m_bCloseFrameOnError = true, m_bReactivateControllerOnError = false, m_xAsynchronousJob = empty uno::Reference, m_bLoaded = false, m_aTargetLock = {m_mutex = {mutex = 0x6fa2e60}, m_xActionLock = uno::Reference to ((anonymous namespace)::Frame *) 0x7f81c7508610, m_bActionLocked = true}, m_pQuietInteraction = rtl::Reference to 0x7f81b4f3ca88} > aZone = {m_sProfileId = 0x7f81d05ddb3c "loadComponentFromURL", m_aCreateTime = 0} > ex = Python Exception <class 'AssertionError'> : > @0x7f81dfdb72b0: {m_nID = -795364128, m_sMessage = <error reading variable: Cannot access memory at address 0xa6>, m_exOriginal = } > xComponent = empty uno::Reference > #28 0x00007f81d040f0d0 in framework::Desktop::loadComponentFromURL(rtl::OUString const&, rtl::OUString const&, int, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (this=0x7f81dfdb72b0, sURL="file:///data/lo/core//sw/qa/extras/uiwriter/data/tdf112860.fodt", sTargetFrameName="_default", nSearchFlags=0, lArguments=uno::Sequence of length 2 = {...}) at /data/lo/core/framework/source/services/desktop.cxx:618 > aTransaction = {m_pManager = 0x7f81dfdb7358} > xThis = uno::Reference to (framework::Desktop *) 0x7f81dfdb7328 > #29 0x00007f81d040f18b in non-virtual thunk to framework::Desktop::loadComponentFromURL(rtl::OUString const&, rtl::OUString const&, int, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) () at /data/lo/core/include/rtl/stringutils.hxx:170 > #30 0x00007f81d8c7ac8d in unotest::MacrosTest::loadFromDesktop(rtl::OUString const&, rtl::OUString const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (this=0x241abf8, rURL="file:///data/lo/core//sw/qa/extras/uiwriter/data/tdf112860.fodt", rDocService="com.sun.star.text.TextDocument", rExtraArgs=empty uno::Sequence) at /data/lo/core/unotest/source/cpp/macros_test.cxx:50 > xLoader = uno::Reference to (framework::Desktop *) 0x7f81dfdb7328 > args = std::__debug::vector of length 2, capacity 2 = {{Name = "MacroExecutionMode", Handle = -1, Value = uno::Any("short": 4), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "DocumentService", Handle = -1, Value = uno::Any("string": "com.sun.star.text.TextDocument"), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}} > aMacroValue = {Name = "MacroExecutionMode", Handle = -1, Value = uno::Any("short": 4), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE} > sMessage = uninitialized rtl::OUString > xComponent = empty uno::Reference > #31 0x00007f81df82cd5f in SwModelTestBase::loadURL(rtl::OUString const&, char const*, char const*) (this=0x241abb0, rURL="file:///data/lo/core//sw/qa/extras/uiwriter/data/tdf112860.fodt", pName=0x7f81df88694b "tdf112860.fodt", pPassword=0x0) at /data/lo/core/sw/qa/extras/inc/swmodeltestbase.hxx:668 > aFilterOptions = std::__debug::vector of length 0, capacity 0 > #32 0x00007f81df82d31a in SwModelTestBase::load(rtl::OUString const&, char const*, char const*) (this=0x241abb0, pDir="/sw/qa/extras/uiwriter/data/", pName=0x7f81df88694b "tdf112860.fodt", pPassword=0x0) at /data/lo/core/sw/qa/extras/inc/swmodeltestbase.hxx:639 > #33 0x00007f81df79550b in SwUiWriterTest::createDoc(char const*) (this=0x241abb0, pName=0x7f81df88694b "tdf112860.fodt") at /data/lo/core/sw/qa/extras/uiwriter/uiwriter.cxx:448 > pTextDoc = 0x7f81dfdb72b0 > #34 0x00007f81df82aeac in SwUiWriterTest::testTdf112860() (this=0x241abb0) at /data/lo/core/sw/qa/extras/uiwriter/uiwriter.cxx:5200 > #35 0x00007f81df8830d1 in std::__invoke_impl<void, void (SwUiWriterTest::*&)(), SwUiWriterTest*&>(std::__invoke_memfun_deref, void (SwUiWriterTest::*&)(), SwUiWriterTest*&) (__f=@0x241aca0: (void (SwUiWriterTest::*)(SwUiWriterTest * const)) 0x7f81df82ae90 <SwUiWriterTest::testTdf112860()>, __t=@0x241acb0: 0x241abb0) at /usr/lib/gcc/x86_64-redhat-linux/7/../../../../include/c++/7/bits/invoke.h:73 > #36 0x00007f81df883002 in std::__invoke<void (SwUiWriterTest::*&)(), SwUiWriterTest*&>(void (SwUiWriterTest::*&)(), SwUiWriterTest*&) (__fn=@0x241aca0: (void (SwUiWriterTest::*)(SwUiWriterTest * const)) 0x7f81df82ae90 <SwUiWriterTest::testTdf112860()>, __args=@0x241acb0: 0x241abb0) at /usr/lib/gcc/x86_64-redhat-linux/7/../../../../include/c++/7/bits/invoke.h:95 > #37 0x00007f81df882f90 in std::_Bind<void (SwUiWriterTest::*(SwUiWriterTest*))()>::__call<void, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) (this=0x241aca0, __args=...) at /usr/lib/gcc/x86_64-redhat-linux/7/../../../../include/c++/7/functional:467 > #38 0x00007f81df882ed3 in std::_Bind<void (SwUiWriterTest::*(SwUiWriterTest*))()>::operator()<, void>() (this=0x241aca0) at /usr/lib/gcc/x86_64-redhat-linux/7/../../../../include/c++/7/functional:549 > #39 0x00007f81df882afd in std::_Function_handler<void (), std::_Bind<void (SwUiWriterTest::*(SwUiWriterTest*))()> >::_M_invoke(std::_Any_data const&) (__functor=...) at /usr/lib/gcc/x86_64-redhat-linux/7/../../../../include/c++/7/bits/std_function.h:316 > #40 0x00007f81df88325e in std::function<void ()>::operator()() const (this=0x241ab80) at /usr/lib/gcc/x86_64-redhat-linux/7/../../../../include/c++/7/bits/std_function.h:706 > #41 0x00007f81df882839 in CppUnit::TestCaller<SwUiWriterTest>::runTest() (this=0x241ab40) at /data/lo/core/workdir/UnpackedTarball/cppunit/include/cppunit/TestCaller.h:175 > #42 0x00007f81fc5d9de6 in CppUnit::TestCaseMethodFunctor::operator()() const (this=0x7ffd50244098) at TestCase.cpp:32 > #43 0x00007f81ee1f9d81 in (anonymous namespace)::Protector::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) (this=0x18116c0, functor=...) at /data/lo/core/test/source/vclbootstrapprotector.cxx:39 > #44 0x00007f81fc5d1b48 in CppUnit::ProtectorChain::ProtectFunctor::operator()() const (this=0x62cd140) at ProtectorChain.cpp:20 > #45 0x00007f81f2527be1 in (anonymous namespace)::Prot::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) (this=0x170eec0, functor=...) at /data/lo/core/unotest/source/cpp/unobootstrapprotector/unobootstrapprotector.cxx:89 > #46 0x00007f81fc5d1b48 in CppUnit::ProtectorChain::ProtectFunctor::operator()() const (this=0x26394a0) at ProtectorChain.cpp:20 > #47 0x00007f81f39fcdbe in (anonymous namespace)::Prot::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) (this=0x170a820, functor=..., context=...) at /data/lo/core/unotest/source/cpp/unoexceptionprotector/unoexceptionprotector.cxx:63 > e = @0x7f81fb659177: {Message = <error reading variable: Cannot access memory at address 0x401f0fffffff34ed>, Context = uno::Reference to (com::sun::star::uno::XInterface *) 0x890033dfaa058b00} > #48 0x00007f81fc5d1b48 in CppUnit::ProtectorChain::ProtectFunctor::operator()() const (this=0x2ae0e00) at ProtectorChain.cpp:20 > #49 0x00007f81fc5bc440 in CppUnit::DefaultProtector::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) (this=0x170a170, functor=..., context=...) at DefaultProtector.cpp:15 > failure = <error reading variable> > e = @0x7ffd50243c90: {_vptr.exception = 0x7ffd50243cc0} > #50 0x00007f81fc5d1b48 in CppUnit::ProtectorChain::ProtectFunctor::operator()() const (this=0x25caf70) at ProtectorChain.cpp:20 > #51 0x00007f81fc5d01a6 in CppUnit::ProtectorChain::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) (this=0x1709e90, functor=..., context=...) at ProtectorChain.cpp:86 > functors = std::__debug::deque with 4 elements = {0x62cd140, 0x26394a0, 0x2ae0e00, 0x25caf70} > outermostFunctor = @0x25caf70: {_vptr$Functor = 0x7f81fc83d420 <vtable for CppUnit::ProtectorChain::ProtectFunctor+16>} > succeed = false > #52 0x00007f81fc5eb9ee in CppUnit::TestResult::protect(CppUnit::Functor const&, CppUnit::Test*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) (this=0x7ffd50244988, functor=..., test=0x241ab40, shortDescription="") at TestResult.cpp:182 > context = {m_test = 0x241ab40, m_result = 0x7ffd50244988, m_shortDescription = ""} > #53 0x00007f81fc5d97c1 in CppUnit::TestCase::run(CppUnit::TestResult*) (this=0x241ab40, result=0x7ffd50244988) at TestCase.cpp:91 > #54 0x00007f81fc5da33d in CppUnit::TestComposite::doRunChildTests(CppUnit::TestResult*) (this=0x1840520, controller=0x7ffd50244988) at TestComposite.cpp:64 > index = 145 > childCount = 148 > #55 0x00007f81fc5da1ba in CppUnit::TestComposite::run(CppUnit::TestResult*) (this=0x1840520, result=0x7ffd50244988) at TestComposite.cpp:23 > #56 0x00007f81fc5da33d in CppUnit::TestComposite::doRunChildTests(CppUnit::TestResult*) (this=0x18404b0, controller=0x7ffd50244988) at TestComposite.cpp:64 > index = 0 > childCount = 1 > #57 0x00007f81fc5da1ba in CppUnit::TestComposite::run(CppUnit::TestResult*) (this=0x18404b0, result=0x7ffd50244988) at TestComposite.cpp:23 > #58 0x00007f81fc5f38fe in CppUnit::TestRunner::WrappingSuite::run(CppUnit::TestResult*) (this=0x1840440, result=0x7ffd50244988) at TestRunner.cpp:47 > #59 0x00007f81fc5eb6c2 in CppUnit::TestResult::runTest(CppUnit::Test*) (this=0x7ffd50244988, test=0x1840440) at TestResult.cpp:149 > #60 0x00007f81fc5f3b79 in CppUnit::TestRunner::run(CppUnit::TestResult&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) (this=0x7ffd50244518, controller=..., testPath="") at TestRunner.cpp:96 > path = {_vptr$TestPath = 0x7f81fc83e128 <vtable for CppUnit::TestPath+16>, m_tests = std::__debug::deque with 1 element = {0x1840440}} > testToRun = 0x1840440 > #61 0x0000000000407200 in (anonymous namespace)::ProtectedFixtureFunctor::run() const (this=0x7ffd502448e8) at /data/lo/core/sal/cppunittester/cppunittester.cxx:319 > collector = {<CppUnit::TestSuccessListener> = {<CppUnit::TestListener> = {_vptr$TestListener = 0x7f81fc83e700 <vtable for CppUnit::TestResultCollector+16>}, <CppUnit::SynchronizedObject> = {_vptr$SynchronizedObject = 0x7f81fc83e798 <vtable for CppUnit::TestResultCollector+168>, m_syncObject = 0x1822cb0}, m_success = false}, m_tests = std::__debug::deque with 146 elements = {0x1840590, 0x1840770, 0x1840900, 0x1840ac0, 0x1840c50, 0x1840e30, 0x1840f90, 0x1841120, 0x18412b0, 0x18414d0, 0x1841630, 0x1841800, 0x1841960, 0x1841b30, 0x1841c90, 0x1841e20, 0x1841fb0, 0x1841440, 0x240d8e0, 0x240da70, 0x240dc00, 0x240ddb0, 0x240df40, 0x240e0d0, 0x240e2c0, 0x240e460, 0x240e5c0, 0x240e770, 0x240e940, 0x240eae0, 0x240eca0, 0x240ee50, 0x240efb0, 0x240d6b0, 0x240f410, 0x240f590, 0x240f720, 0x240f8b0, 0x240fa40, 0x240fc30, 0x240fd90, 0x240ff20, 0x24100b0, 0x2410240, 0x24103d0, 0x24105c0, 0x2410760, 0x24108c0, 0x2410a50, 0x2410c00, 0x2410d90, 0x2410f20, 0x24110b0, 0x2411240, 0x24113f0, 0x2411580, 0x2411730, 0x24118c0, 0x2411a50, 0x2411c40, 0x2411da0, 0x2411f90, 0x24120f0, 0x2412280, 0x2412410, 0x240f140, 0x240f2d0, 0x2412ad0, 0x2412c60, 0x2412df0, 0x2412f80, 0x2413110, 0x24132a0, 0x2413450, 0x2413620, 0x2413780, 0x2413910, 0x2413b00, 0x2413c60, 0x2413df0, 0x2413f80, 0x2414170, 0x24142d0, 0x2414460, 0x2414630, 0x2414790, 0x2414920, 0x2414ab0, 0x2414c60, 0x2414df0, 0x2414f80, 0x2415110, 0x24152a0, 0x2415430, 0x24155c0, 0x2415750, 0x24158e0, 0x2415ad0, 0x2415c30, 0x2415dc0, 0x2415f50, 0x24160e0, 0x2416270, 0x2416400, 0x24165b0, 0x2416780, 0x24168e0, 0x2416a70, 0x2416c00, 0x2416d90, 0x2416f40, 0x24170d0, 0x2417260, 0x24173f0, 0x2417580, 0x2417710, 0x24178c0, 0x2417a50, 0x2417be0, 0x2417d70, 0x2417f00, 0x2418090, 0x2418220, 0x24183b0, 0x2418540, 0x2418730, 0x24188d0, 0x2418a30, 0x2418bc0, 0x24125a0, 0x2412730, 0x24128c0, 0x2419620, 0x24197b0, 0x24199a0, 0x2419b40, 0x2419ca0, 0x2419e30, 0x2419fe0, 0x241a1b0, 0x241a350, 0x241a4f0, 0x241a690, 0x241a7f0, 0x241a9e0, 0x241ab40}, m_failures = std::__debug::deque with 1 element = {0x6fa2a90}, m_testErrors = 0} > logger = {<CppUnit::TestListener> = {_vptr$TestListener = 0x623628 <vtable for (anonymous namespace)::LogFailuresAsTheyHappen+16>}, <No data fields>} > timer = {<CppUnit::TestListener> = {_vptr$TestListener = 0x623698 <vtable for (anonymous namespace)::TimingListener+16>}, m_nStartTime = 79112} > eye = {<CppUnit::TestListener> = {_vptr$TestListener = 0x623708 <vtable for (anonymous namespace)::EyecatcherListener+16>}, <No data fields>} > lib = "libtest_sw_uiwriter.so" > runner = {_vptr$TestRunner = 0x7f81fc83e998 <vtable for CppUnit::TestRunner+16>, m_suite = 0x1840440} > pVal = 0x0 > outputter = {<CppUnit::Outputter> = {_vptr$Outputter = 0x7ffd50244750}, m_result = 0x7ffd50244710, m_stream = @0x7f81fc2a5949, m_locationFormat = " \000\000\000\000\000\000\017\341\004\000\000\000\000\000\000\000\220\037\356\201\177\000\000@D~\001\000\000\000\000\070\255?\356\201\177\000\000\200n~\001\000\000\000\000\200\271", m_wrapColumn = 1344554848} > manager = {_vptr$PlugInManager = 0x7f81fc83d148 <vtable for CppUnit::PlugInManager+16>, m_plugIns = std::__debug::deque with 1 element = {{m_fileName = "/data/lo/core/workdir/LinkTarget/CppunitTest/libtest_sw_uiwriter.so", m_manager = 0x18423e0, m_interface = 0x7f81dfad3070 <cppunitTestPlugIn::plugIn>}}} > e = Python Exception <class 'OverflowError'> int too big to convert: > @0x7f81fc277d5e: {<std::runtime_error> = {<std::exception> = {_vptr.exception = 0xe9fffffe78858948}, _M_msg = <error reading variable: Cannot access memory at address 0x89df3d830000002f>}, m_message = , m_cause = (unknown: 2240497664)} > success = false > #62 0x000000000040654a in sal_main() () at /data/lo/core/sal/cppunittester/cppunittester.cxx:469 > testlib = "/data/lo/core/workdir/LinkTarget/CppunitTest/libtest_sw_uiwriter.so" > tests = {<CppUnit::Functor> = {_vptr$Functor = 0x6235e0 <vtable for (anonymous namespace)::ProtectedFixtureFunctor+16>}, testlib = "/data/lo/core/workdir/LinkTarget/CppunitTest/libtest_sw_uiwriter.so", args = "/data/lo/core/workdir/LinkTarget/CppunitTest/libtest_sw_uiwriter.so --headless", protectors = std::__debug::vector of length 3, capacity 4 = {0x170a820, 0x170eec0, 0x18116c0}, result = @0x7ffd50244988} > protectors = std::__debug::vector of length 3, capacity 4 = {0x170a820, 0x170eec0, 0x18116c0} > result = {<CppUnit::SynchronizedObject> = {_vptr$SynchronizedObject = 0x7f81fc83e460 <vtable for CppUnit::TestResult+16>, m_syncObject = 0x1709c10}, m_listeners = std::__debug::deque with 4 elements = {0x7ffd502445c0, 0x7ffd50244538, 0x7ffd502445b0, 0x7ffd50244530}, m_protectorChain = 0x1709e90, m_stop = false} > args = "/data/lo/core/workdir/LinkTarget/CppunitTest/libtest_sw_uiwriter.so --headless" > index = 22 > ok = false > path = "/data/lo/core/workdir/CppunitTest/sw_uiwriter.test" > e = @0x7f81fc29e723: {_vptr.exception = 0x5850f01a8} > #63 0x0000000000405e27 in main(int, char**) (argc=23, argv=0x7ffd50244d28) at /data/lo/core/sal/cppunittester/cppunittester.cxx:376 > ret = 0
(In reply to Stephan Bergmann from comment #0) > First one is a signed integer overflow (as reported by UBSan), see the > backtrace in the commit message of > <https://cgit.freedesktop.org/libreoffice/core/commit/ > ?id=63d845dc88690b9c5c8194e1512a8e4390c7ee24> "Fix > -fsanitize=signed-integer-overflow" (which was obtained with an > --enable-optimized build, so some "trivial" frames are missing from the > backtrace due to inlining). The commit mentioned above has now been reverted with <https://cgit.freedesktop.org/libreoffice/core/commit/?id=ce057e662b2e10e111353e9461c3c01434ddbb0f> "Revert 'Fix -fsanitize=signed-integer-overflow'".
Another way to reproduce this with a normal build is to first do 'make -O -j12 ExternalPackage_fonts_liberation.clean' to remove the relevant instdir/share/fonts/truetype/ files and then 'instdir/program/soffice sw/qa/extras/uiwriter/data/tdf112860.fodt' to see it crash.
Stephan Bergmann committed a patch related to this issue. It has been pushed to "master": http://cgit.freedesktop.org/libreoffice/core/commit/?id=8b490c17243248e2824633d0438b0fc290d94f9b tdf#112942: Apparently, rTab.GetFollow() can change in between It will be available in 6.0.0. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
(In reply to Stephan Bergmann from comment #1) > (In reply to Stephan Bergmann from comment #0) > > First one is a signed integer overflow (as reported by UBSan), see the > > backtrace in the commit message of > > <https://cgit.freedesktop.org/libreoffice/core/commit/ > > ?id=63d845dc88690b9c5c8194e1512a8e4390c7ee24> "Fix > > -fsanitize=signed-integer-overflow" (which was obtained with an > > --enable-optimized build, so some "trivial" frames are missing from the > > backtrace due to inlining). > > The commit mentioned above has now been reverted with > <https://cgit.freedesktop.org/libreoffice/core/commit/ > ?id=ce057e662b2e10e111353e9461c3c01434ddbb0f> "Revert 'Fix > -fsanitize=signed-integer-overflow'". ...and re-applied as <https://cgit.freedesktop.org/libreoffice/core/commit/?id=a636d2ee19fcb319b028e04395c2eee0f624263c> "Revert 'Revert 'Fix -fsanitize=signed-integer-overflow''", seeing that it probably is generally useful after all.