Bug Hunting Session
Bug 112942 - SwUiWriterTest::testTdf112860 crashes when Liberation fonts are missing
Summary: SwUiWriterTest::testTdf112860 crashes when Liberation fonts are missing
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
unspecified
Hardware: All All
: medium normal
Assignee: Stephan Bergmann
URL:
Whiteboard: target:6.0.0
Keywords:
Depends on:
Blocks:
 
Reported: 2017-10-06 16:25 UTC by Stephan Bergmann
Modified: 2017-10-09 14:23 UTC (History)
1 user (show)

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Stephan Bergmann 2017-10-06 16:25:03 UTC
At least on recent master before <https://cgit.freedesktop.org/libreoffice/core/commit/?id=9dd0c0fcc141ae53cacb29cd0b144ac2b13e9f86> "Missing dependency", executing CppunitTest_sw_uiwriter (in an (implicitly) --with-fonts configuration) while ExternalPackage_fonts_liberation is not installed (which can be reproduced with 'make CppunitTest_sw_uiwriter && make ExternalPackage_fonts_liberation && cd sw && make CppunitTest_sw_uiwriter') causes various crashes:

First one is a signed integer overflow (as reported by UBSan), see the backtrace in the commit message of <https://cgit.freedesktop.org/libreoffice/core/commit/?id=63d845dc88690b9c5c8194e1512a8e4390c7ee24> "Fix -fsanitize=signed-integer-overflow" (which was obtained with an --enable-optimized build, so some "trivial" frames are missing from the backtrace due to inlining).

Second one is a null deref (that causes a SEGV also in non-UBSan builds):
> Thread 1 (Thread 0x7f81fca39740 (LWP 20251)):
> #0  0x00007f81d9b83cbc in SwFlowFrame::UnlockJoin() (this=0x0) at /data/lo/core/sw/source/core/inc/flowfrm.hxx:138
> #1  0x00007f81d9e8d6c5 in TableSplitRecalcUnlock(SwFlowFrame*) (pTab=0x0) at /data/lo/core/sw/source/core/layout/tabfrm.cxx:622
> #2  0x00007f81d9e7b106 in lcl_RecalcSplitLine(SwRowFrame&, SwRowFrame&, long, long) (rLastLine=..., rFollowLine=..., nRemainingSpaceForLastRow=11901, nAlreadyFree=0) at /data/lo/core/sw/source/core/layout/tabfrm.cxx:692
>         bRet = true
>         pRenderContext = 0x731ed90
>         rTab = @0x7f81c949aa20: {<SwLayoutFrame> = {<SwFrame> = {<SwClient> = {<sw::WriterListener> = {_vptr$WriterListener = 0x7f81db60f150 <vtable for SwTabFrame+16>, m_pLeft = 0x58ff730, m_pRight = 0x0}, m_pRegisteredIn = 0x7f81c9495000}, <SfxBroadcaster> = {_vptr$SfxBroadcaster = 0x7f81db60f260 <vtable for SwTabFrame+288>, mpImpl = std::unique_ptr<SfxBroadcaster::Impl> containing 0x63dd6f0}, static mpCache = 0x2580950, mbInDtor = false, static mnLastFrameId = 5563, mnFrameId = 5266, mpRoot = 0x6345c00, mpUpper = 0x7f81ce4be1d0, mpNext = 0x0, mpPrev = 0x7f81b6e6eec8, mpDrawObjs = 0x0, maFrame = SwRect = {point = Point = {x = 1724, y = 3590}, size = Size = {width = 9446, height = 20068}}, maPrt = SwRect = {point = Point = {x = 0, y = 0}, size = Size = {width = 9446, height = 20068}}, mnFrameType = SwFrameType::Tab, mbReverse = false, mbInvalidR2L = false, mbDerivedR2L = true, mbRightToLeft = false, mbInvalidVert = false, mbDerivedVert = true, mbVertical = false, mbVertLR = false, mbValidPos = false, mbValidPrtArea = false, mbValidSize = false, mbValidLineNum = false, mbFixSize = false, mbCompletePaint = false, mbRetouche = true, mbInfInvalid = false, mbInfBody = true, mbInfTab = true, mbInfFly = false, mbInfFootnote = false, mbInfSct = false, mbColLocked = false, m_isInDestroy = false, mbForbidDelete = false}, m_pLower = 0x7f81b4cfba58, m_VertPosOrientFramesFor = std::__debug::vector of length 0, capacity 0}, <SwFlowFrame> = {_vptr$SwFlowFrame = 0x7f81db60f280 <vtable for SwTabFrame+320>, m_rThis = @0x7f81c949aa20, static m_bMoveBwdJump = false, m_pFollow = 0x0, m_pPrecede = 0x0, m_bLockJoin = true, m_bUndersized = false, m_bFlyLock = false}, m_pTable = 0x58ff730, m_bComplete = true, m_bCalcLowers = false, m_bLowersFormatted = true, m_bLockBackMove = false, m_bResizeHTMLTable = false, m_bONECalcLowers = false, m_bHasFollowFlowLine = true, m_bIsRebuildLastLine = true, m_bRestrictTableGrowth = false, m_bRemoveFollowFlowLinePending = false, m_bConsiderObjsForMinCellHeight = true, m_bObjsDoesFit = true, m_bInRecalcLowerRow = false, static aPool = {m_pImpl = 0x7f81dfd97900, m_pTypeName = 0x7f81dabadffe "SwTabFrame"}}
>         aRectFnSet = {m_bVert = false, m_bRev = false, m_bVertL2R = false, m_fnRect = 0x7f81db6bef30 <aHorizontal>}
>         nCurLastLineHeight = 19621
>         bUnlockMaster = false
>         bUnlockFollow = true
>         pMaster = 0x0
>         bInSplit = false
>         nDistanceToUpperPrtBottom = 140195063765072
> #3  0x00007f81d9e7a3e5 in SwTabFrame::Split(long, bool, bool) (this=0x7f81c949aa20, nCutPos=15938, bTryToSplit=true, bTableRowKeep=false) at /data/lo/core/sw/source/core/layout/tabfrm.cxx:1268
>         bRet = true
>         aRectFnSet = {m_bVert = false, m_bRev = false, m_bVertL2R = false, m_fnRect = 0x7f81db6bef30 <aHorizontal>}
>         pRow = 0x0
>         nRepeat = 0
>         nRowCount = 1
>         nRemainingSpaceForLastRow = 11901
>         bSplitRowAllowed = true
>         bKeepNextRow = false
>         bNewFollow = false
>         pFoll = 0x7f81c949a900
>         pLastRow = 0x7f81b4cfbc68
>         pFollowRow = 0x7f81b4f99850
>         nShrink = 0
> #4  0x00007f81d9e7ff16 in SwTabFrame::MakeAll(OutputDevice*) (this=0x7f81c949aa20, pRenderContext=0x731ed90) at /data/lo/core/sw/source/core/layout/tabfrm.cxx:2387
>         bSplitError = 127
>         nDeadLine = 15938
>         nMinNumOfLines = 0
>         nBreakLine = 3590
>         bMoveable = true
>         n1StLineHeight = 0
>         bAllowSplitOfRow = false
>         aOldPos = Point = {x = 1724, y = 3590}
>         pIndPrev = 0x7f81b6e6eec8
>         pOldUpper = 0x7ffd5023fe40
>         nDistanceToUpperPrtBottom = -242
>         pSh = 0x6e83390
>         bBrowseMode = false
>         pFirstNonHeadlineRow = 0x7f81b4cfba58
>         bEmulateTableKeepFwdMoveAllowed = true
>         nStack = 0 '\000'
>         aEnter = {pImpl = 0x0}
>         aNotify = {<SwFrameNotify> = {mpFrame = 0x7f81c949aa20, maFrame = SwRect = {point = Point = {x = 1724, y = 3590}, size = Size = {width = 9446, height = 12590}}, maPrt = SwRect = {point = Point = {x = 0, y = 0}, size = Size = {width = 9446, height = 12590}}, mnFlyAnchorOfst = 0, mnFlyAnchorOfstNoWrap = 0, mbHadFollow = false, mbInvaKeep = false, mbValidSize = false}, m_bLowersComplete = false}
>         bOldValidPos = true
>         bMakePage = true
>         bMovedBwd = false
>         bMovedFwd = false
>         bSplit = true
>         bFootnotesInDoc = false
>         bFly = false
>         pAccess = std::unique_ptr<SwBorderAttrAccess> containing 0x63347b0
>         pAttrs = 0x7f81ce4bd738
>         bEmulateTableKeep = false
>         bKeep = false
>         bDontSplit = false
>         nRepeat = 0
>         bTryToSplit = true
>         bTableRowKeep = false
>         bLastRowHasToMoveToFollow = false
>         bLastRowMoveNoMoreTries = false
>         nUnSplitted = 5
>         nThrowAwayValidLayoutLimit = 4
>         aRectFnSet = {m_bVert = false, m_bRev = false, m_bVertL2R = false, m_fnRect = 0x7f81db6bef30 <aHorizontal>}
> #5  0x00007f81d9d65905 in SwFrame::PrepareMake(OutputDevice*) (this=0x7f81c949aa20, pRenderContext=0x731ed90) at /data/lo/core/sw/source/core/layout/calcmove.cxx:346
>         aHack = {static nCnt = 1 '\001', static bLocked = false}
> #6  0x00007f81d9e956af in SwFrame::Calc(OutputDevice*) const (this=0x7f81c949aa20, pRenderContext=0x731ed90) at /data/lo/core/sw/source/core/layout/trvlfrm.cxx:1769
> #7  0x00007f81d9dd82aa in SwLayAction::FormatLayoutTab(SwTabFrame*, bool) (this=0x7ffd50240e30, pTab=0x7f81c949aa20, bAddRect=true) at /data/lo/core/sw/source/core/layout/layact.cxx:1467
>         aOldRect = SwRect = {point = Point = {x = 1724, y = 3590}, size = Size = {width = 9446, height = 12590}}
>         aPaintFrame = SwRect = {point = Point = {x = 140195674551744, y = 8799554101824}, size = Size = {width = 8796093037567, height = 140724603455488}}
>         pRenderContext = 0x731ed90
>         rTimerAccess = @0x634cd00: {_vptr$IDocumentTimerAccess = 0x7f81db5fa080 <vtable for sw::DocumentTimerManager+16>}
>         bChanged = false
>         bPainted = false
>         pOldPage = 0x7f81ce4bc210
>         aRectFnSet = {m_bVert = false, m_bRev = false, m_bVertL2R = false, m_fnRect = 0x7f81db6bef30 <aHorizontal>}
> #8  0x00007f81d9dd6212 in SwLayAction::FormatLayout(OutputDevice*, SwLayoutFrame*, bool) (this=0x7ffd50240e30, pRenderContext=0x731ed90, pLay=0x7f81ce4be1d0, bAddRect=true) at /data/lo/core/sw/source/core/layout/layact.cxx:1360
>         bChanged = false
>         bAlreadyPainted = false
>         aFrameAtCompletePaint = SwRect = {point = Point = {x = 0, y = 0}, size = Size = {width = 0, height = 0}}
>         pLow = 0x7f81c949aa20
>         bTabChanged = false
>         aBoundRect = SwRect = {point = Point = {x = 135, y = 12330}, size = Size = {width = 17265, height = 135}}
> #9  0x00007f81d9dd6295 in SwLayAction::FormatLayout(OutputDevice*, SwLayoutFrame*, bool) (this=0x7ffd50240e30, pRenderContext=0x731ed90, pLay=0x7f81ce4bc210, bAddRect=true) at /data/lo/core/sw/source/core/layout/layact.cxx:1363
>         bChanged = false
>         bAlreadyPainted = false
>         aFrameAtCompletePaint = SwRect = {point = Point = {x = 0, y = 0}, size = Size = {width = 0, height = 0}}
>         pLow = 0x7f81ce4be1d0
>         bTabChanged = false
>         aBoundRect = SwRect = {point = Point = {x = 135, y = 135}, size = Size = {width = 12196, height = 17131}}
> #10 0x00007f81d9dd3506 in SwLayAction::InternalAction(OutputDevice*) (this=0x7ffd50240e30, pRenderContext=0x731ed90) at /data/lo/core/sw/source/core/layout/layact.cxx:550
>         nLoopControlRuns_1 = 2
>         nLoopControlMax = 20
>         pPage = 0x7f81ce4bc210
>         nFirstPageNum = 1
>         rLayoutAccess = @0x643f590: {_vptr$IDocumentLayoutAccess = 0x7f81db5fbc60 <vtable for sw::DocumentLayoutManager+16>}
>         bNoLoop = true
>         nPercentPageNum = 0
> #11 0x00007f81d9dd294a in SwLayAction::Action(OutputDevice*) (this=0x7ffd50240e30, pRenderContext=0x731ed90) at /data/lo/core/sw/source/core/layout/layact.cxx:341
> #12 0x00007f81da48bbc3 in SwViewShell::ImplEndAction(bool) (this=0x6e83390, bIdleEnd=false) at /data/lo/core/sw/source/core/view/viewsh.cxx:280
>         aAction = {m_pRoot = 0x6345c00, m_pImp = 0x56cf4b0, m_pOptTab = 0x7f81c949aa20, m_pWait = 0x0, m_nPreInvaPage = 65535, m_nStartTicks = 77770175, m_nInputType = VclInputFlags::KEYBOARD, m_nEndPage = 65535, m_nCheckPageNum = 65535, m_bPaint = false, m_bComplete = false, m_bCalcLayout = false, m_bAgain = true, m_bNextCycle = false, m_bInput = false, m_bIdle = false, m_bReschedule = false, m_bCheckPages = true, m_bUpdateExpFields = false, m_bBrowseActionStop = false, m_bWaitAllowed = true, m_bPaintExtraData = false, m_bActionInProgress = true, mbFormatContentOnInterrupt = false}
>         bIsShellForCheckViewLayout = true
>         aCurr = {pPrev = 0x6e83390, pRoot = 0x6345c00}
>         bExtraData = false
> #13 0x00007f81d9750f21 in SwViewShell::EndAction(bool) (this=0x6e83390, bIdleEnd=false) at /data/lo/core/sw/inc/viewsh.hxx:605
> #14 0x00007f81d973f73a in SwCursorShell::EndAction(bool, bool) (this=0x6e83390, bIdleEnd=false, DoSetPosX=false) at /data/lo/core/sw/source/core/crsr/crsrsh.cxx:258
>         g = {<comphelper::ScopeGuard> = {m_func = {<std::_Maybe_unary_or_binary_function<void>> = {<No data fields>}, <std::_Function_base> = {static _M_max_size = 16, static _M_max_align = 8, _M_functor = {_M_unused = {_M_object = 0x6e834a4, _M_const_object = 0x6e834a4, _M_function_pointer = 0x6e834a4, _M_member_pointer = (void (std::_Undefined_class::*)(std::_Undefined_class * const)) 0x6e834a4, this adjustment 140725947993600}, _M_pod_data = "\244\064\350\006\000\000\000\000\000\016$P\375\177\000"}, _M_manager = 0x7f81d9753dc0 <std::_Function_base::_Base_manager<comphelper::FlagRestorationGuard::RestoreFlag>::_M_manager(std::_Any_data&, std::_Any_data const&, std::_Manager_operation)>}, _M_invoker = 0x7f81d9753d90 <std::_Function_handler<void (), comphelper::FlagRestorationGuard::RestoreFlag>::_M_invoke(std::_Any_data const&)>}}, <No data fields>}
>         bVis = true
>         eFlags = 5
>         bSavSVCursorVis = true
> #15 0x00007f81daa3e88f in SwView::OuterResizePixel(Point const&, Size const&) (this=0x73b42f0, rOfst=Point = {...}, rSize=Size = {...}) at /data/lo/core/sw/source/uibase/uiview/viewport.cxx:1116
>         bScroll1 = true
>         bScroll2 = true
>         aBorder = {nTop = 25, nRight = 16, nBottom = 16, nLeft = 0}
>         aEditSz = Size = {width = 784, height = 559}
>         bShowH = true
>         bShowV = true
>         bAuto = true
>         bHAuto = true
>         pVOpt = 0x6e4a500
>         pDocSh = 0x6de37b0
>         bIsPreview = false
>         aCurr = {pPrev = 0x6e83390, pRoot = 0x6345c00}
>         bRepeat = false
>         nCnt = 1
>         bUnLockView = true
> #16 0x00007f81de0ca414 in SfxViewFrame::DoAdjustPosSizePixel(SfxViewShell*, Point const&, Size const&, bool) (this=0x5c44420, pSh=0x73b42f0, rPos=Point = {...}, rSize=Size = {...}, inplaceEditModeChange=false) at /data/lo/core/sfx2/source/view/viewfrm.cxx:1490
> #17 0x00007f81de0cfe2a in SfxViewFrame::Resize(bool) (this=0x5c44420, bForce=false) at /data/lo/core/sfx2/source/view/viewfrm.cxx:2275
>         pShell = 0x73b42f0
>         aSize = Size = {width = 800, height = 600}
> #18 0x00007f81de0d8d28 in SfxFrameViewWindow_Impl::Resize() (this=0x6402b30) at /data/lo/core/sfx2/source/view/viewfrm2.cxx:73
> #19 0x00007f81ec559255 in vcl::Window::ImplCallResize() (this=0x6402b30) at /data/lo/core/vcl/source/window/event.cxx:522
> #20 0x00007f81ec6b9572 in vcl::Window::Show(bool, ShowFlags) (this=0x6402b30, bVisible=true, nFlags=ShowFlags::NONE) at /data/lo/core/vcl/source/window/window.cxx:2274
>         pTestParent = 0x6402b30
>         xWindow = {_vptr$VclPtr = 0x7f81ed6e7350 <vtable for VclPtr<vcl::Window>+16>, m_rInnerRef = rtl::Reference to 0x6402b30}
>         bRealVisibilityChanged = false
> #21 0x00007f81de0af0d6 in SfxBaseController::ConnectSfxFrame_Impl(SfxBaseController::ConnectSfxFrame) (this=0x7f81b6473ab8, i_eConnect=SfxBaseController::E_CONNECT) at /data/lo/core/sfx2/source/view/sfxbasecontroller.cxx:1250
>         pEditWin = 0x731ed90
>         pFrameWin = 0x6402b30
>         pViewFrame = 0x5c44420
>         bConnect = true
>         nViewNo = 36838
> #22 0x00007f81de0ae60f in SfxBaseController::attachFrame(com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) (this=0x7f81b6473ab8, xFrame=uno::Reference to ((anonymous namespace)::Frame *) 0x7f81c75085e8) at /data/lo/core/sfx2/source/view/sfxbasecontroller.cxx:550
>         aHint = {<SfxEventHint> = {<SfxHint> = {_vptr$SfxHint = 0x7f81b6278310, mnId = 1344543696}, pObjShell = 0x7f81b6473ae0, aEventName = "媵\xde09羁\000ᰀ値翽\000\xdde2羁\000㡨۞\000\000⏸\xdb71羁\000㫠뙇羁\000뵸ɖ\000Ā㫠뙇羁\000㫠뙇羁\000牰큂羁\000藨읐羁\000㫠뙇羁\000堠\xdaaa羁\000樨똧羁\000樨똧羁\000ᱰ値翽Ā樨똧羁\000ೀ\xde0b羁\000㫠뙇羁\000㫠뙇羁\000ὠ値翽\000Ӱ\xddf5羁\000樨똧羁\000ᴈ値翽\000\x1f58値翽\000\x1f58値翽\000⋘콓羁\000᳐値翽\000挶\xdda0羁\000ὠ値翽\000‐値翽\000⍀値翽\000⁈値翽\000\000\000\000\000㫠뙇羁\000荰똧羁\000㫠뙇羁\000樨똧羁\000쒥羁\000㫠뙇羁\000떞혏迦₰値翽\000㗕\xde09羁\000ᵐ値翽\000璐등羁\000\000\000\000\000\000\000\003\000㪠\xde6e\002\000ɘ\000\000⏰\xdb71羁\000"..., nEventId = 1344545600}, xViewController = uno::Reference to (com::sun::star::uno::XInterface *) 0x7ffd50242340}
>         xCloseable = uno::Reference to ((anonymous namespace)::Frame *) 0x7f81c7508618
>         xTemp = empty uno::Reference
>         aGuard = {<osl::Guard<comphelper::SolarMutex>> = {pT = 0x19c5550}, <No data fields>}
> #23 0x00007f81de095ab5 in (anonymous namespace)::SfxFrameLoader_Impl::impl_createDocumentView(com::sun::star::uno::Reference<com::sun::star::frame::XModel2> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&, comphelper::NamedValueCollection const&, rtl::OUString const&) (i_rModel=uno::Reference to (SwXTextDocument *) 0x7f81b6276a28, i_rFrame=uno::Reference to ((anonymous namespace)::Frame *) 0x7f81c75085e8, i_rViewFactoryArgs=..., i_rViewName="Default") at /data/lo/core/sfx2/source/view/frmload.cxx:599
>         xController = uno::Reference to (SwXTextView *) 0x7f81b6473ae0
> #24 0x00007f81de0935d5 in (anonymous namespace)::SfxFrameLoader_Impl::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) (this=0x7f81b4f3ab20, rArgs=uno::Sequence of length 11 = {...}, _rTargetFrame=uno::Reference to ((anonymous namespace)::Frame *) 0x7f81c75085e8) at /data/lo/core/sfx2/source/view/frmload.cxx:716
>         xDoc = {pObj = 0x6de37b0}
>         sViewName = "Default"
>         aViewCreationArgs = {m_pImpl = std::unique_ptr<comphelper::NamedValueCollection_Impl> containing 0x62f81b0}
>         nViewId = {m_value = 2}
>         nViewNo = 0
>         xController = uno::Reference to (SwXTextView *) 0x7f81b6473ae0
>         xInit = uno::Reference to (com::sun::star::uno::XInterface *) 0x7ffd50241fa0
>         aGuard = {<osl::Guard<comphelper::SolarMutex>> = {pT = 0x19c5550}, <No data fields>}
>         aDescriptor = {m_pImpl = std::unique_ptr<comphelper::NamedValueCollection_Impl> containing 0x2a32400}
>         xModel = uno::Reference to (SwXTextDocument *) 0x7f81b6276a28
>         bExternalModel = false
>         sURL = "file:///data/lo/core//sw/qa/extras/uiwriter/data/tdf112860.fodt"
>         bIsFactoryURL = false
>         bInitNewModel = false
>         bLoadSuccess = false
> #25 0x00007f81d03be4ba in framework::LoadEnv::impl_loadContent() (this=0x7ffd50242758) at /data/lo/core/framework/source/loadenv/loadenv.cxx:1087
>         bResult = false
>         aWriteLock = {pT = 0x7ffd50242758}
>         sTarget = "_default"
>         xTargetFrame = uno::Reference to ((anonymous namespace)::Frame *) 0x7f81c75085e8
>         xTargetLock = uno::Reference to ((anonymous namespace)::Frame *) 0x7f81c7508610
>         bHidden = false
>         bMinimized = false
>         bPreview = false
>         xProgress = uno::Reference to (framework::StatusIndicator *) 0x7f81b4ebbd08
>         lDescriptor = uno::Sequence of length 11 = {{Name = "StatusIndicator", Handle = 0, Value = uno::Any("com.sun.star.task.XStatusIndicator": {<com::sun::star::uno::XInterface> = {_vptr$XInterface = 0x7f81b4ebbd08}, <No data fields>}), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "UCBContent", Handle = 0, Value = uno::Any("com.sun.star.ucb.XContent": {<com::sun::star::uno::XInterface> = {_vptr$XInterface = 0x7f81b6466cb0}, <No data fields>}), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "InputStream", Handle = 0, Value = uno::Any("com.sun.star.io.XInputStream": {<com::sun::star::uno::XInterface> = {_vptr$XInterface = 0x7f81b4f7ccf0}, <No data fields>}), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "URL", Handle = 0, Value = uno::Any("string": "file:///data/lo/core//sw/qa/extras/uiwriter/data/tdf112860.fodt"), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "AuthenticationHandler", Handle = 0, Value = uno::Any("com.sun.star.task.XInteractionHandler": {<com::sun::star::uno::XInterface> = {_vptr$XInterface = 0x7f81b4f3cab0}, <No data fields>}), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "FilterName", Handle = 0, Value = uno::Any("string": "OpenDocument Text Flat XML"), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "DocumentService", Handle = 0, Value = uno::Any("string": "com.sun.star.text.TextDocument"), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "MacroExecutionMode", Handle = 0, Value = uno::Any("short": 4), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "UpdateDocMode", Handle = 0, Value = uno::Any("short": 0), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "InteractionHandler", Handle = 0, Value = uno::Any("com.sun.star.task.XInteractionHandler": {<com::sun::star::uno::XInterface> = {_vptr$XInterface = 0x7f81b4f3cab0}, <No data fields>}), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "TypeName", Handle = 0, Value = uno::Any("string": "writer_ODT_FlatXML"), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}}
>         sURL = "file:///data/lo/core//sw/qa/extras/uiwriter/data/tdf112860.fodt"
>         xLoader = uno::Reference to ((anonymous namespace)::SfxFrameLoader_Impl *) 0x7f81b4f3ab20
>         xAsyncLoader = empty uno::Reference
>         xSyncLoader = uno::Reference to ((anonymous namespace)::SfxFrameLoader_Impl *) 0x7f81b4f3ab48
> #26 0x00007f81d03b959b in framework::LoadEnv::startLoading() (this=0x7ffd50242758) at /data/lo/core/framework/source/loadenv/loadenv.cxx:372
>         aReadLock = {pT = 0x0}
>         bStarted = false
> #27 0x00007f81d03b7fd0 in framework::LoadEnv::loadComponentFromURL(com::sun::star::uno::Reference<com::sun::star::frame::XComponentLoader> const&, com::sun::star::uno::Reference<com::sun::star::uno::XComponentContext> const&, rtl::OUString const&, rtl::OUString const&, int, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (xLoader=uno::Reference to (framework::Desktop *) 0x7f81dfdb7328, xContext=uno::Reference to (cppu::ComponentContext *) 0x7f81fca14e58, sURL="file:///data/lo/core//sw/qa/extras/uiwriter/data/tdf112860.fodt", sTarget="_default", nFlags=0, lArgs=uno::Sequence of length 2 = {...}) at /data/lo/core/framework/source/loadenv/loadenv.cxx:158
>         aEnv = {m_mutex = {mutex = 0x5c88a60}, m_xContext = uno::Reference to (cppu::ComponentContext *) 0x7f81fca14e58, m_xBaseFrame = uno::Reference to (framework::Desktop *) 0x7f81dfdb7318, m_xTargetFrame = uno::Reference to ((anonymous namespace)::Frame *) 0x7f81c75085e8, m_sTarget = "_default", m_nSearchFlags = 0, m_lMediaDescriptor = {<comphelper::SequenceAsHashMap> = {m_aMap = std::__debug::unordered_map with 11 elements = {["StatusIndicator"] = uno::Any("com.sun.star.task.XStatusIndicator": {<com::sun::star::uno::XInterface> = {_vptr$XInterface = 0x7f81b4ebbd08}, <No data fields>}), ["UCBContent"] = uno::Any("com.sun.star.ucb.XContent": {<com::sun::star::uno::XInterface> = {_vptr$XInterface = 0x7f81b6466cb0}, <No data fields>}), ["InputStream"] = uno::Any("com.sun.star.io.XInputStream": {<com::sun::star::uno::XInterface> = {_vptr$XInterface = 0x7f81b4f7ccf0}, <No data fields>}), ["URL"] = uno::Any("string": "file:///data/lo/core//sw/qa/extras/uiwriter/data/tdf112860.fodt"), ["AuthenticationHandler"] = uno::Any("com.sun.star.task.XInteractionHandler": {<com::sun::star::uno::XInterface> = {_vptr$XInterface = 0x7f81b4f3cab0}, <No data fields>}), ["FilterName"] = uno::Any("string": "OpenDocument Text Flat XML"), ["DocumentService"] = uno::Any("string": "com.sun.star.text.TextDocument"), ["MacroExecutionMode"] = uno::Any("short": 4), ["UpdateDocMode"] = uno::Any("short": 0), ["InteractionHandler"] = uno::Any("com.sun.star.task.XInteractionHandler": {<com::sun::star::uno::XInterface> = {_vptr$XInterface = 0x7f81b4f3cab0}, <No data fields>}), ["TypeName"] = uno::Any("string": "writer_ODT_FlatXML")}}, <No data fields>}, m_aURL = {Complete = "file:///data/lo/core//sw/qa/extras/uiwriter/data/tdf112860.fodt", Main = "file:///data/lo/core//sw/qa/extras/uiwriter/data/tdf112860.fodt", Protocol = "file://", User = "", Password = "", Server = "", Port = 0, Path = "/data/lo/core//sw/qa/extras/uiwriter/data/", Name = "tdf112860.fodt", Arguments = "", Mark = ""}, m_eFeature = LoadEnvFeatures::NONE, m_eContentType = framework::LoadEnv::E_CAN_BE_LOADED, m_bCloseFrameOnError = true, m_bReactivateControllerOnError = false, m_xAsynchronousJob = empty uno::Reference, m_bLoaded = false, m_aTargetLock = {m_mutex = {mutex = 0x6fa2e60}, m_xActionLock = uno::Reference to ((anonymous namespace)::Frame *) 0x7f81c7508610, m_bActionLocked = true}, m_pQuietInteraction = rtl::Reference to 0x7f81b4f3ca88}
>         aZone = {m_sProfileId = 0x7f81d05ddb3c "loadComponentFromURL", m_aCreateTime = 0}
>         ex = Python Exception <class 'AssertionError'> : 
> @0x7f81dfdb72b0: {m_nID = -795364128, m_sMessage = <error reading variable: Cannot access memory at address 0xa6>, m_exOriginal = }
>         xComponent = empty uno::Reference
> #28 0x00007f81d040f0d0 in framework::Desktop::loadComponentFromURL(rtl::OUString const&, rtl::OUString const&, int, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (this=0x7f81dfdb72b0, sURL="file:///data/lo/core//sw/qa/extras/uiwriter/data/tdf112860.fodt", sTargetFrameName="_default", nSearchFlags=0, lArguments=uno::Sequence of length 2 = {...}) at /data/lo/core/framework/source/services/desktop.cxx:618
>         aTransaction = {m_pManager = 0x7f81dfdb7358}
>         xThis = uno::Reference to (framework::Desktop *) 0x7f81dfdb7328
> #29 0x00007f81d040f18b in non-virtual thunk to framework::Desktop::loadComponentFromURL(rtl::OUString const&, rtl::OUString const&, int, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) () at /data/lo/core/include/rtl/stringutils.hxx:170
> #30 0x00007f81d8c7ac8d in unotest::MacrosTest::loadFromDesktop(rtl::OUString const&, rtl::OUString const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (this=0x241abf8, rURL="file:///data/lo/core//sw/qa/extras/uiwriter/data/tdf112860.fodt", rDocService="com.sun.star.text.TextDocument", rExtraArgs=empty uno::Sequence) at /data/lo/core/unotest/source/cpp/macros_test.cxx:50
>         xLoader = uno::Reference to (framework::Desktop *) 0x7f81dfdb7328
>         args = std::__debug::vector of length 2, capacity 2 = {{Name = "MacroExecutionMode", Handle = -1, Value = uno::Any("short": 4), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "DocumentService", Handle = -1, Value = uno::Any("string": "com.sun.star.text.TextDocument"), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}}
>         aMacroValue = {Name = "MacroExecutionMode", Handle = -1, Value = uno::Any("short": 4), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}
>         sMessage = uninitialized rtl::OUString
>         xComponent = empty uno::Reference
> #31 0x00007f81df82cd5f in SwModelTestBase::loadURL(rtl::OUString const&, char const*, char const*) (this=0x241abb0, rURL="file:///data/lo/core//sw/qa/extras/uiwriter/data/tdf112860.fodt", pName=0x7f81df88694b "tdf112860.fodt", pPassword=0x0) at /data/lo/core/sw/qa/extras/inc/swmodeltestbase.hxx:668
>         aFilterOptions = std::__debug::vector of length 0, capacity 0
> #32 0x00007f81df82d31a in SwModelTestBase::load(rtl::OUString const&, char const*, char const*) (this=0x241abb0, pDir="/sw/qa/extras/uiwriter/data/", pName=0x7f81df88694b "tdf112860.fodt", pPassword=0x0) at /data/lo/core/sw/qa/extras/inc/swmodeltestbase.hxx:639
> #33 0x00007f81df79550b in SwUiWriterTest::createDoc(char const*) (this=0x241abb0, pName=0x7f81df88694b "tdf112860.fodt") at /data/lo/core/sw/qa/extras/uiwriter/uiwriter.cxx:448
>         pTextDoc = 0x7f81dfdb72b0
> #34 0x00007f81df82aeac in SwUiWriterTest::testTdf112860() (this=0x241abb0) at /data/lo/core/sw/qa/extras/uiwriter/uiwriter.cxx:5200
> #35 0x00007f81df8830d1 in std::__invoke_impl<void, void (SwUiWriterTest::*&)(), SwUiWriterTest*&>(std::__invoke_memfun_deref, void (SwUiWriterTest::*&)(), SwUiWriterTest*&) (__f=@0x241aca0: (void (SwUiWriterTest::*)(SwUiWriterTest * const)) 0x7f81df82ae90 <SwUiWriterTest::testTdf112860()>, __t=@0x241acb0: 0x241abb0) at /usr/lib/gcc/x86_64-redhat-linux/7/../../../../include/c++/7/bits/invoke.h:73
> #36 0x00007f81df883002 in std::__invoke<void (SwUiWriterTest::*&)(), SwUiWriterTest*&>(void (SwUiWriterTest::*&)(), SwUiWriterTest*&) (__fn=@0x241aca0: (void (SwUiWriterTest::*)(SwUiWriterTest * const)) 0x7f81df82ae90 <SwUiWriterTest::testTdf112860()>, __args=@0x241acb0: 0x241abb0) at /usr/lib/gcc/x86_64-redhat-linux/7/../../../../include/c++/7/bits/invoke.h:95
> #37 0x00007f81df882f90 in std::_Bind<void (SwUiWriterTest::*(SwUiWriterTest*))()>::__call<void, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) (this=0x241aca0, __args=...) at /usr/lib/gcc/x86_64-redhat-linux/7/../../../../include/c++/7/functional:467
> #38 0x00007f81df882ed3 in std::_Bind<void (SwUiWriterTest::*(SwUiWriterTest*))()>::operator()<, void>() (this=0x241aca0) at /usr/lib/gcc/x86_64-redhat-linux/7/../../../../include/c++/7/functional:549
> #39 0x00007f81df882afd in std::_Function_handler<void (), std::_Bind<void (SwUiWriterTest::*(SwUiWriterTest*))()> >::_M_invoke(std::_Any_data const&) (__functor=...) at /usr/lib/gcc/x86_64-redhat-linux/7/../../../../include/c++/7/bits/std_function.h:316
> #40 0x00007f81df88325e in std::function<void ()>::operator()() const (this=0x241ab80) at /usr/lib/gcc/x86_64-redhat-linux/7/../../../../include/c++/7/bits/std_function.h:706
> #41 0x00007f81df882839 in CppUnit::TestCaller<SwUiWriterTest>::runTest() (this=0x241ab40) at /data/lo/core/workdir/UnpackedTarball/cppunit/include/cppunit/TestCaller.h:175
> #42 0x00007f81fc5d9de6 in CppUnit::TestCaseMethodFunctor::operator()() const (this=0x7ffd50244098) at TestCase.cpp:32
> #43 0x00007f81ee1f9d81 in (anonymous namespace)::Protector::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) (this=0x18116c0, functor=...) at /data/lo/core/test/source/vclbootstrapprotector.cxx:39
> #44 0x00007f81fc5d1b48 in CppUnit::ProtectorChain::ProtectFunctor::operator()() const (this=0x62cd140) at ProtectorChain.cpp:20
> #45 0x00007f81f2527be1 in (anonymous namespace)::Prot::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) (this=0x170eec0, functor=...) at /data/lo/core/unotest/source/cpp/unobootstrapprotector/unobootstrapprotector.cxx:89
> #46 0x00007f81fc5d1b48 in CppUnit::ProtectorChain::ProtectFunctor::operator()() const (this=0x26394a0) at ProtectorChain.cpp:20
> #47 0x00007f81f39fcdbe in (anonymous namespace)::Prot::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) (this=0x170a820, functor=..., context=...) at /data/lo/core/unotest/source/cpp/unoexceptionprotector/unoexceptionprotector.cxx:63
>         e = @0x7f81fb659177: {Message = <error reading variable: Cannot access memory at address 0x401f0fffffff34ed>, Context = uno::Reference to (com::sun::star::uno::XInterface *) 0x890033dfaa058b00}
> #48 0x00007f81fc5d1b48 in CppUnit::ProtectorChain::ProtectFunctor::operator()() const (this=0x2ae0e00) at ProtectorChain.cpp:20
> #49 0x00007f81fc5bc440 in CppUnit::DefaultProtector::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) (this=0x170a170, functor=..., context=...) at DefaultProtector.cpp:15
>         failure = <error reading variable>
>         e = @0x7ffd50243c90: {_vptr.exception = 0x7ffd50243cc0}
> #50 0x00007f81fc5d1b48 in CppUnit::ProtectorChain::ProtectFunctor::operator()() const (this=0x25caf70) at ProtectorChain.cpp:20
> #51 0x00007f81fc5d01a6 in CppUnit::ProtectorChain::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) (this=0x1709e90, functor=..., context=...) at ProtectorChain.cpp:86
>         functors = std::__debug::deque with 4 elements = {0x62cd140, 0x26394a0, 0x2ae0e00, 0x25caf70}
>         outermostFunctor = @0x25caf70: {_vptr$Functor = 0x7f81fc83d420 <vtable for CppUnit::ProtectorChain::ProtectFunctor+16>}
>         succeed = false
> #52 0x00007f81fc5eb9ee in CppUnit::TestResult::protect(CppUnit::Functor const&, CppUnit::Test*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) (this=0x7ffd50244988, functor=..., test=0x241ab40, shortDescription="") at TestResult.cpp:182
>         context = {m_test = 0x241ab40, m_result = 0x7ffd50244988, m_shortDescription = ""}
> #53 0x00007f81fc5d97c1 in CppUnit::TestCase::run(CppUnit::TestResult*) (this=0x241ab40, result=0x7ffd50244988) at TestCase.cpp:91
> #54 0x00007f81fc5da33d in CppUnit::TestComposite::doRunChildTests(CppUnit::TestResult*) (this=0x1840520, controller=0x7ffd50244988) at TestComposite.cpp:64
>         index = 145
>         childCount = 148
> #55 0x00007f81fc5da1ba in CppUnit::TestComposite::run(CppUnit::TestResult*) (this=0x1840520, result=0x7ffd50244988) at TestComposite.cpp:23
> #56 0x00007f81fc5da33d in CppUnit::TestComposite::doRunChildTests(CppUnit::TestResult*) (this=0x18404b0, controller=0x7ffd50244988) at TestComposite.cpp:64
>         index = 0
>         childCount = 1
> #57 0x00007f81fc5da1ba in CppUnit::TestComposite::run(CppUnit::TestResult*) (this=0x18404b0, result=0x7ffd50244988) at TestComposite.cpp:23
> #58 0x00007f81fc5f38fe in CppUnit::TestRunner::WrappingSuite::run(CppUnit::TestResult*) (this=0x1840440, result=0x7ffd50244988) at TestRunner.cpp:47
> #59 0x00007f81fc5eb6c2 in CppUnit::TestResult::runTest(CppUnit::Test*) (this=0x7ffd50244988, test=0x1840440) at TestResult.cpp:149
> #60 0x00007f81fc5f3b79 in CppUnit::TestRunner::run(CppUnit::TestResult&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) (this=0x7ffd50244518, controller=..., testPath="") at TestRunner.cpp:96
>         path = {_vptr$TestPath = 0x7f81fc83e128 <vtable for CppUnit::TestPath+16>, m_tests = std::__debug::deque with 1 element = {0x1840440}}
>         testToRun = 0x1840440
> #61 0x0000000000407200 in (anonymous namespace)::ProtectedFixtureFunctor::run() const (this=0x7ffd502448e8) at /data/lo/core/sal/cppunittester/cppunittester.cxx:319
>         collector = {<CppUnit::TestSuccessListener> = {<CppUnit::TestListener> = {_vptr$TestListener = 0x7f81fc83e700 <vtable for CppUnit::TestResultCollector+16>}, <CppUnit::SynchronizedObject> = {_vptr$SynchronizedObject = 0x7f81fc83e798 <vtable for CppUnit::TestResultCollector+168>, m_syncObject = 0x1822cb0}, m_success = false}, m_tests = std::__debug::deque with 146 elements = {0x1840590, 0x1840770, 0x1840900, 0x1840ac0, 0x1840c50, 0x1840e30, 0x1840f90, 0x1841120, 0x18412b0, 0x18414d0, 0x1841630, 0x1841800, 0x1841960, 0x1841b30, 0x1841c90, 0x1841e20, 0x1841fb0, 0x1841440, 0x240d8e0, 0x240da70, 0x240dc00, 0x240ddb0, 0x240df40, 0x240e0d0, 0x240e2c0, 0x240e460, 0x240e5c0, 0x240e770, 0x240e940, 0x240eae0, 0x240eca0, 0x240ee50, 0x240efb0, 0x240d6b0, 0x240f410, 0x240f590, 0x240f720, 0x240f8b0, 0x240fa40, 0x240fc30, 0x240fd90, 0x240ff20, 0x24100b0, 0x2410240, 0x24103d0, 0x24105c0, 0x2410760, 0x24108c0, 0x2410a50, 0x2410c00, 0x2410d90, 0x2410f20, 0x24110b0, 0x2411240, 0x24113f0, 0x2411580, 0x2411730, 0x24118c0, 0x2411a50, 0x2411c40, 0x2411da0, 0x2411f90, 0x24120f0, 0x2412280, 0x2412410, 0x240f140, 0x240f2d0, 0x2412ad0, 0x2412c60, 0x2412df0, 0x2412f80, 0x2413110, 0x24132a0, 0x2413450, 0x2413620, 0x2413780, 0x2413910, 0x2413b00, 0x2413c60, 0x2413df0, 0x2413f80, 0x2414170, 0x24142d0, 0x2414460, 0x2414630, 0x2414790, 0x2414920, 0x2414ab0, 0x2414c60, 0x2414df0, 0x2414f80, 0x2415110, 0x24152a0, 0x2415430, 0x24155c0, 0x2415750, 0x24158e0, 0x2415ad0, 0x2415c30, 0x2415dc0, 0x2415f50, 0x24160e0, 0x2416270, 0x2416400, 0x24165b0, 0x2416780, 0x24168e0, 0x2416a70, 0x2416c00, 0x2416d90, 0x2416f40, 0x24170d0, 0x2417260, 0x24173f0, 0x2417580, 0x2417710, 0x24178c0, 0x2417a50, 0x2417be0, 0x2417d70, 0x2417f00, 0x2418090, 0x2418220, 0x24183b0, 0x2418540, 0x2418730, 0x24188d0, 0x2418a30, 0x2418bc0, 0x24125a0, 0x2412730, 0x24128c0, 0x2419620, 0x24197b0, 0x24199a0, 0x2419b40, 0x2419ca0, 0x2419e30, 0x2419fe0, 0x241a1b0, 0x241a350, 0x241a4f0, 0x241a690, 0x241a7f0, 0x241a9e0, 0x241ab40}, m_failures = std::__debug::deque with 1 element = {0x6fa2a90}, m_testErrors = 0}
>         logger = {<CppUnit::TestListener> = {_vptr$TestListener = 0x623628 <vtable for (anonymous namespace)::LogFailuresAsTheyHappen+16>}, <No data fields>}
>         timer = {<CppUnit::TestListener> = {_vptr$TestListener = 0x623698 <vtable for (anonymous namespace)::TimingListener+16>}, m_nStartTime = 79112}
>         eye = {<CppUnit::TestListener> = {_vptr$TestListener = 0x623708 <vtable for (anonymous namespace)::EyecatcherListener+16>}, <No data fields>}
>         lib = "libtest_sw_uiwriter.so"
>         runner = {_vptr$TestRunner = 0x7f81fc83e998 <vtable for CppUnit::TestRunner+16>, m_suite = 0x1840440}
>         pVal = 0x0
>         outputter = {<CppUnit::Outputter> = {_vptr$Outputter = 0x7ffd50244750}, m_result = 0x7ffd50244710, m_stream = @0x7f81fc2a5949, m_locationFormat = " \000\000\000\000\000\000\017\341\004\000\000\000\000\000\000\000\220\037\356\201\177\000\000@D~\001\000\000\000\000\070\255?\356\201\177\000\000\200n~\001\000\000\000\000\200\271", m_wrapColumn = 1344554848}
>         manager = {_vptr$PlugInManager = 0x7f81fc83d148 <vtable for CppUnit::PlugInManager+16>, m_plugIns = std::__debug::deque with 1 element = {{m_fileName = "/data/lo/core/workdir/LinkTarget/CppunitTest/libtest_sw_uiwriter.so", m_manager = 0x18423e0, m_interface = 0x7f81dfad3070 <cppunitTestPlugIn::plugIn>}}}
>         e = Python Exception <class 'OverflowError'> int too big to convert: 
> @0x7f81fc277d5e: {<std::runtime_error> = {<std::exception> = {_vptr.exception = 0xe9fffffe78858948}, _M_msg = <error reading variable: Cannot access memory at address 0x89df3d830000002f>}, m_message = , m_cause = (unknown: 2240497664)}
>         success = false
> #62 0x000000000040654a in sal_main() () at /data/lo/core/sal/cppunittester/cppunittester.cxx:469
>         testlib = "/data/lo/core/workdir/LinkTarget/CppunitTest/libtest_sw_uiwriter.so"
>         tests = {<CppUnit::Functor> = {_vptr$Functor = 0x6235e0 <vtable for (anonymous namespace)::ProtectedFixtureFunctor+16>}, testlib = "/data/lo/core/workdir/LinkTarget/CppunitTest/libtest_sw_uiwriter.so", args = "/data/lo/core/workdir/LinkTarget/CppunitTest/libtest_sw_uiwriter.so --headless", protectors = std::__debug::vector of length 3, capacity 4 = {0x170a820, 0x170eec0, 0x18116c0}, result = @0x7ffd50244988}
>         protectors = std::__debug::vector of length 3, capacity 4 = {0x170a820, 0x170eec0, 0x18116c0}
>         result = {<CppUnit::SynchronizedObject> = {_vptr$SynchronizedObject = 0x7f81fc83e460 <vtable for CppUnit::TestResult+16>, m_syncObject = 0x1709c10}, m_listeners = std::__debug::deque with 4 elements = {0x7ffd502445c0, 0x7ffd50244538, 0x7ffd502445b0, 0x7ffd50244530}, m_protectorChain = 0x1709e90, m_stop = false}
>         args = "/data/lo/core/workdir/LinkTarget/CppunitTest/libtest_sw_uiwriter.so --headless"
>         index = 22
>         ok = false
>         path = "/data/lo/core/workdir/CppunitTest/sw_uiwriter.test"
>         e = @0x7f81fc29e723: {_vptr.exception = 0x5850f01a8}
> #63 0x0000000000405e27 in main(int, char**) (argc=23, argv=0x7ffd50244d28) at /data/lo/core/sal/cppunittester/cppunittester.cxx:376
>         ret = 0
Comment 1 Stephan Bergmann 2017-10-06 16:31:41 UTC
(In reply to Stephan Bergmann from comment #0)
> First one is a signed integer overflow (as reported by UBSan), see the
> backtrace in the commit message of
> <https://cgit.freedesktop.org/libreoffice/core/commit/
> ?id=63d845dc88690b9c5c8194e1512a8e4390c7ee24> "Fix
> -fsanitize=signed-integer-overflow" (which was obtained with an
> --enable-optimized build, so some "trivial" frames are missing from the
> backtrace due to inlining).

The commit mentioned above has now been reverted with <https://cgit.freedesktop.org/libreoffice/core/commit/?id=ce057e662b2e10e111353e9461c3c01434ddbb0f> "Revert 'Fix -fsanitize=signed-integer-overflow'".
Comment 2 Stephan Bergmann 2017-10-09 10:44:31 UTC
Another way to reproduce this with a normal build is to first do 'make -O -j12 ExternalPackage_fonts_liberation.clean' to remove the relevant instdir/share/fonts/truetype/ files and then 'instdir/program/soffice sw/qa/extras/uiwriter/data/tdf112860.fodt' to see it crash.
Comment 3 Commit Notification 2017-10-09 10:46:36 UTC
Stephan Bergmann committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=8b490c17243248e2824633d0438b0fc290d94f9b

tdf#112942: Apparently, rTab.GetFollow() can change in between

It will be available in 6.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 4 Stephan Bergmann 2017-10-09 14:23:20 UTC
(In reply to Stephan Bergmann from comment #1)
> (In reply to Stephan Bergmann from comment #0)
> > First one is a signed integer overflow (as reported by UBSan), see the
> > backtrace in the commit message of
> > <https://cgit.freedesktop.org/libreoffice/core/commit/
> > ?id=63d845dc88690b9c5c8194e1512a8e4390c7ee24> "Fix
> > -fsanitize=signed-integer-overflow" (which was obtained with an
> > --enable-optimized build, so some "trivial" frames are missing from the
> > backtrace due to inlining).
> 
> The commit mentioned above has now been reverted with
> <https://cgit.freedesktop.org/libreoffice/core/commit/
> ?id=ce057e662b2e10e111353e9461c3c01434ddbb0f> "Revert 'Fix
> -fsanitize=signed-integer-overflow'".

...and re-applied as <https://cgit.freedesktop.org/libreoffice/core/commit/?id=a636d2ee19fcb319b028e04395c2eee0f624263c> "Revert 'Revert 'Fix -fsanitize=signed-integer-overflow''", seeing that it probably is generally useful after all.