Bug Hunting Session
Bug 59134 - SIGSEGV upon concurrent SwXTextDocument::close and SwXTextCursor::release
Summary: SIGSEGV upon concurrent SwXTextDocument::close and SwXTextCursor::release
Status: RESOLVED WONTFIX
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
4.1.0.0.alpha0+ Master
Hardware: Other All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-01-08 14:05 UTC by Stephan Bergmann
Modified: 2015-06-04 09:19 UTC (History)
1 user (show)

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Stephan Bergmann 2013-01-08 14:05:22 UTC
With a current Linux master build, sw_unoapi at least once crashed for me with

> Thread 1 (Thread 0x2b7620401700 (LWP 14419)):
> #0  x86_64_fallback_frame_state (fs=0x2b76203fc540, context=<optimized out>) at ./md-unwind-support.h:53
> #1  uw_frame_state_for (context=context@entry=0x2b76203fc450, fs=fs@entry=0x2b76203fc540) at ../../../libgcc/unwind-dw2.c:1187
> #2  0x0000003d8de0ff1c in _Unwind_Backtrace (trace=0x3d8bb05900 <backtrace_helper>, trace_argument=0x2b76203fc700) at ../../../libgcc/unwind.inc:290
> #3  0x0000003d8bb05a96 in __GI___backtrace (array=<optimized out>, size=256) at ../sysdeps/ia64/backtrace.c:110
> #4  0x00002b75f7a51a7d in PrintStack (sig=6) at lo/core/sal/osl/unx/signal.c:829
> #5  0x00002b75f7a51cb7 in CallSystemHandler (Signal=6) at lo/core/sal/osl/unx/signal.c:895
> #6  0x00002b75f7a51f0c in SignalHandlerFunction (Signal=6) at lo/core/sal/osl/unx/signal.c:992
> #7  <signal handler called>
> #8  0x0000003d8ba35935 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
> #9  0x0000003d8ba370e8 in __GI_abort () at abort.c:91
> #10 0x00002b75fc341ff3 in SalAbort (rErrorText="", bDumpCore=true) at lo/core/vcl/unx/generic/plugadapt/salplug.cxx:282
> #11 0x00002b75fbd01c3d in Application::Abort (rErrorText="") at lo/core/vcl/source/app/svapp.cxx:378
> #12 0x00002b75f7cf6410 in desktop::Desktop::Exception (this=0x7fff6da119d0, nError=768) at lo/core/desktop/source/app/app.cxx:1272
> #13 0x00002b75fbd0d0ec in VCLExceptionSignal_impl (pInfo=0x2b76203fdaa0) at lo/core/vcl/source/app/svmain.cxx:132
> #14 0x00002b75f7a51b32 in CallSignalHandler (pInfo=0x2b76203fdaa0) at lo/core/sal/osl/unx/signal.c:854
> #15 0x00002b75f7a51ef1 in SignalHandlerFunction (Signal=6) at lo/core/sal/osl/unx/signal.c:989
> #16 <signal handler called>
> #17 0x0000003d8ba35935 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
> #18 0x0000003d8ba370e8 in __GI_abort () at abort.c:91
> #19 0x00002b7638700bd9 in ?? () from /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.9.x86_64/jre/lib/amd64/server/libjvm.so
> #20 0x00002b763885c1b2 in ?? () from /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.9.x86_64/jre/lib/amd64/server/libjvm.so
> #21 0x00002b763885cbf0 in ?? () from /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.9.x86_64/jre/lib/amd64/server/libjvm.so
> #22 <signal handler called>
> #23 0x00002b763333f305 in ?? ()
> #24 0x00002b7638700bb0 in ?? () from /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.9.x86_64/jre/lib/amd64/server/libjvm.so
> #25 0x00002b763885c51f in ?? () from /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.9.x86_64/jre/lib/amd64/server/libjvm.so
> #26 0x00002b7638707f4f in JVM_handle_linux_signal () from /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.9.x86_64/jre/lib/amd64/server/libjvm.so
> #27 <signal handler called>
> #28 0x00002b762fb22479 in SvxShape::HasSdrObjectOwnership (this=0x2aaab138cab8) at lo/core/svx/source/unodraw/unoshape.cxx:270
> #29 0x00002b762f9761d0 in SdrObject::Free (_rpObject=@0x2b76203ff128: 0x0) at lo/core/svx/source/svdraw/svdobj.cxx:509
> #30 0x00002b762cca1d82 in SwDrawContact::~SwDrawContact (this=0x2b762869e0d0, __in_chrg=<optimized out>) at lo/core/sw/source/core/draw/dcontact.cxx:678
> #31 0x00002b762cca1e38 in SwDrawContact::~SwDrawContact (this=0x2b762869e0d0, __in_chrg=<optimized out>) at lo/core/sw/source/core/draw/dcontact.cxx:680
> #32 0x00002b762cd988f5 in SwDrawFrmFmt::~SwDrawFrmFmt (this=0x2aaab1823160, __in_chrg=<optimized out>) at lo/core/sw/source/core/layout/atrfrm.cxx:3156
> #33 0x00002b762cd98982 in SwDrawFrmFmt::~SwDrawFrmFmt (this=0x2aaab1823160, __in_chrg=<optimized out>) at lo/core/sw/source/core/layout/atrfrm.cxx:3157
> #34 0x00002b762cafda06 in SwDoc::DelFrmFmt (this=0x2b76281374a0, pFmt=0x2aaab1823160, bBroadcast=false) at lo/core/sw/source/core/doc/docfmt.cxx:1341
> #35 0x00002b762cb211ea in SwDoc::DelLayoutFmt (this=0x2b76281374a0, pFmt=0x2aaab1823160) at lo/core/sw/source/core/doc/doclay.cxx:336
> #36 0x00002b762d008007 in SwTxtNode::DestroyAttr (this=0x2aaab0a581e0, pAttr=0x2b76286a8e00) at lo/core/sw/source/core/txtnode/thints.cxx:1101
> #37 0x00002b762cfe8867 in SwTxtNode::~SwTxtNode (this=0x2aaab0a581e0, __in_chrg=<optimized out>) at lo/core/sw/source/core/txtnode/ndtxt.cxx:248
> #38 0x00002b762cfe8a30 in SwTxtNode::~SwTxtNode (this=0x2aaab0a581e0, __in_chrg=<optimized out>) at lo/core/sw/source/core/txtnode/ndtxt.cxx:262
> #39 0x00002b762cc7e31d in SwNodes::RemoveNode (this=0x2b762858a050, nDelPos=9, nSz=1, bDel=1 '\001') at lo/core/sw/source/core/docnode/nodes.cxx:2399
> #40 0x00002b762cc7b3c9 in SwNodes::DelNodes (this=0x2b762858a050, rStart=SwNodeIndex (node 0), nCnt=11) at lo/core/sw/source/core/docnode/nodes.cxx:1504
> #41 0x00002b762cb307cd in SwDoc::~SwDoc (this=0x2b76281374a0, __in_chrg=<optimized out>) at lo/core/sw/source/core/doc/docnew.cxx:602
> #42 0x00002b762cb31bf4 in SwDoc::~SwDoc (this=0x2b76281374a0, __in_chrg=<optimized out>) at lo/core/sw/source/core/doc/docnew.cxx:697
> #43 0x00002b762d3ae760 in SwDocShell::RemoveLink (this=0x2b7628063320) at lo/core/sw/source/ui/app/docshini.cxx:503
> #44 0x00002b762d3adf0d in SwDocShell::~SwDocShell (this=0x2b7628063320, __in_chrg=<optimized out>, __vtt_parm=<optimized out>) at lo/core/sw/source/ui/app/docshini.cxx:411
> #45 0x00002b762d3ae132 in SwDocShell::~SwDocShell (this=0x2b7628063320, __in_chrg=<optimized out>, __vtt_parm=<optimized out>) at lo/core/sw/source/ui/app/docshini.cxx:419
> #46 0x00002b75fb12c6e0 in SvRefBase::QueryDelete (this=0x2b7628063490) at lo/core/tools/source/ref/ref.cxx:29
> #47 0x00002b75f928d0ff in SvRefBase::ReleaseReference (this=0x2b7628063490) at lo/core/solver/unxlngx6/inc/tools/ref.hxx:188
> #48 0x00002b75f928d20d in SfxObjectShellRef::~SfxObjectShellRef (this=0x2b76281cc178, __in_chrg=<optimized out>) at lo/core/sfx2/inc/sfx2/objsh.hxx:764
> #49 0x00002b75f95a9297 in IMPL_SfxBaseModel_DataContainer::~IMPL_SfxBaseModel_DataContainer (this=0x2b76281cc170, __in_chrg=<optimized out>) at lo/core/sfx2/source/doc/sfxbasemodel.cxx:243
> #50 0x00002b75f95a949a in IMPL_SfxBaseModel_DataContainer::~IMPL_SfxBaseModel_DataContainer (this=0x2b76281cc170, __in_chrg=<optimized out>) at lo/core/sfx2/source/doc/sfxbasemodel.cxx:244
> #51 0x00002b75f958ff3b in SfxBaseModel::dispose (this=0x2aab29b25a58) at lo/core/sfx2/source/doc/sfxbasemodel.cxx:829
> #52 0x00002b762d59ad36 in SwXTextDocument::dispose (this=0x2aab29b25928) at lo/core/sw/source/ui/uno/unotxdoc.cxx:564
> #53 0x00002b75f95933b0 in SfxBaseModel::close (this=0x2aab29b25a58, bDeliverOwnership=1 '\001') at lo/core/sfx2/source/doc/sfxbasemodel.cxx:1452
> #54 0x00002b762d59adf2 in SwXTextDocument::close (this=0x2aab29b25928, bDeliverOwnership=1 '\001') at lo/core/sw/source/ui/uno/unotxdoc.cxx:572
> #55 0x00002b7608e2bda6 in gcc3::callVirtualMethod (pThis=0x2aab29b25b28, nVtableIndex=5, pRegisterReturn=0x0, pReturnTypeRef=0x16d63c0, bSimpleReturn=true, pStack=0x2b7620400210, nStack=0, pGPR=0x2b7620400280, nGPR=2, pFPR=0x2b76204002b0, nFPR=0) at lo/core/bridges/source/cpp_uno/gcc3_linux_x86-64/callvirtualmethod.cxx:119
> #56 0x00002b7608e33788 in cpp_call (pThis=0x2b76286c4cc0, aVtableSlot=..., pReturnTypeRef=0x16d63c0, nParams=1, pParams=0x2b7624004740, pUnoReturn=0x0, pUnoArgs=0x2b76280d3ab0, ppUnoExc=0x2b7620400668) at lo/core/bridges/source/cpp_uno/gcc3_linux_x86-64/uno2cpp.cxx:237
> #57 0x00002b7608e342ec in bridges::cpp_uno::shared::unoInterfaceProxyDispatch (pUnoI=0x2b76286c4cc0, pMemberDescr=0x2b7624004810, pReturn=0x0, pArgs=0x2b76280d3ab0, ppException=0x2b7620400668) at lo/core/bridges/source/cpp_uno/gcc3_linux_x86-64/uno2cpp.cxx:431
> #58 0x00002b761446b157 in binaryurp::IncomingRequest::execute_throw (this=0x2b7624002220, returnValue=0x2b7620400ad0, outArguments=0x2b7620400a40) at lo/core/binaryurp/source/incomingrequest.cxx:245
> #59 0x00002b761446a027 in binaryurp::IncomingRequest::execute (this=0x2b7624002220) at lo/core/binaryurp/source/incomingrequest.cxx:74
> #60 0x00002b761448535d in binaryurp::(anonymous namespace)::request (pThreadSpecificData=0x2b7624002220) at lo/core/binaryurp/source/reader.cxx:87
> #61 0x00002b75f84a81da in cppu_threadpool::JobQueue::enter (this=0x2b762400f4a0, nDisposeId=47786410177056, bReturnWhenNoJob=1 '\001') at lo/core/cppu/source/threadpool/jobqueue.cxx:115
> #62 0x00002b75f84abac5 in cppu_threadpool::ORequestThread::run (this=0x2b762400f220) at lo/core/cppu/source/threadpool/thread.cxx:173
> #63 0x00002b75f84ac2ab in osl::threadFunc (param=0x2b762400f230) at lo/core/solver/unxlngx6/inc/osl/thread.hxx:187
> #64 0x00002b75f7a4ec43 in osl_thread_start_Impl (pData=0x2b76240119e0) at lo/core/sal/osl/unx/thread.c:252
> #65 0x0000003d8be07d14 in start_thread (arg=0x2b7620401700) at pthread_create.c:309
> #66 0x0000003d8baf168d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115

> Thread 23 (Thread 0x2aab28854700 (LWP 14425)):
> #0  __lll_lock_wait () at ../nptl/sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:136
> #1  0x0000003d8be09c71 in _L_lock_889 () from /lib64/libpthread.so.0
> #2  0x0000003d8be09b8a in __pthread_mutex_lock (mutex=0x16d4150) at pthread_mutex_lock.c:86
> #3  0x00002b75f7a4413e in osl_acquireMutex (Mutex=0x16d4150) at lo/core/sal/osl/unx/mutex.c:114
> #4  0x00002b75fbd00bc6 in vcl::SolarMutexObject::acquire (this=0x16d4120) at lo/core/vcl/source/app/solarmutex.cxx:35
> #5  0x00002b75fc28c4e0 in SalYieldMutex::acquire (this=0x16d4120) at lo/core/vcl/generic/app/geninst.cxx:49
> #6  0x00002b762c926ec6 in SolarMutexGuard::SolarMutexGuard (this=0x2aab28852eb0) at lo/core/solver/unxlngx6/inc/vcl/svapp.hxx:434
> #7  0x00002b762d141d9f in sw::UnoImplPtr<SwXTextCursor::Impl>::~UnoImplPtr (this=0x2b76163a9bf0, __in_chrg=<optimized out>) at lo/core/sw/inc/unobaseclass.hxx:111
> #8  0x00002b762d1361e5 in SwXTextCursor::~SwXTextCursor (this=0x2b76163a9b58, __in_chrg=<optimized out>) at lo/core/sw/source/core/unocore/unoobj.cxx:824
> #9  0x00002b762d136268 in SwXTextCursor::~SwXTextCursor (this=0x2b76163a9b58, __in_chrg=<optimized out>) at lo/core/sw/source/core/unocore/unoobj.cxx:826
> #10 0x00002b75f87fd17b in cppu::OWeakObject::release (this=0x2b76163a9b58) at lo/core/cppuhelper/source/weak.cxx:204
> #11 0x00002b762d1426f6 in cppu::WeakImplHelper12<com::sun::star::lang::XServiceInfo, com::sun::star::beans::XPropertySet, com::sun::star::beans::XPropertyState, com::sun::star::beans::XMultiPropertyStates, com::sun::star::container::XEnumerationAccess, com::sun::star::container::XContentEnumerationAccess, com::sun::star::util::XSortable, com::sun::star::document::XDocumentInsertable, com::sun::star::text::XSentenceCursor, com::sun::star::text::XWordCursor, com::sun::star::text::XParagraphCursor, com::sun::star::text::XRedline>::release (this=0x2b76163a9b58) at lo/core/solver/unxlngx6/inc/cppuhelper/implbase12.hxx:117
> #12 0x00002b762d14042a in SwXTextCursor::release (this=0x2b76163a9b58) at lo/core/sw/source/core/unocore/unoobj.cxx:2937
> #13 0x00002b7608e35f58 in bridges::cpp_uno::shared::freeUnoInterfaceProxy (pEnv=0x2b76180009e0, pProxy=0x2b76284c7950) at lo/core/bridges/source/cpp_uno/shared/unointerfaceproxy.cxx:43
> #14 0x00002b75f84dde10 in (anonymous namespace)::s_stub_defenv_revokeInterface (pParam=0x2aab288531b8) at lo/core/cppu/source/uno/lbenv.cxx:391
> #15 0x00002b75f84d9896 in s_environment_invoke_v (pCurrEnv=0x0, pTargetEnv=0x2b76180009e0, pCallee=0x2b75f84ddabc <(anonymous namespace)::s_stub_defenv_revokeInterface(va_list*)>, pParam=0x2aab288531b8) at lo/core/cppu/source/uno/EnvStack.cxx:287
> #16 0x00002b75f84d993f in uno_Environment_invoke_v (pTargetEnv=0x2b76180009e0, pCallee=0x2b75f84ddabc <(anonymous namespace)::s_stub_defenv_revokeInterface(va_list*)>, pParam=0x2aab288531b8) at lo/core/cppu/source/uno/EnvStack.cxx:306
> #17 0x00002b75f84d99ff in uno_Environment_invoke (pEnv=0x2b76180009e0, pCallee=0x2b75f84ddabc <(anonymous namespace)::s_stub_defenv_revokeInterface(va_list*)>) at lo/core/cppu/source/uno/EnvStack.cxx:315
> #18 0x00002b75f84de1b8 in (anonymous namespace)::defenv_revokeInterface (pEnv=0x2b76180009e0, pInterface=0x2aab30001850) at lo/core/cppu/source/uno/lbenv.cxx:447
> #19 0x00002b7608e3607e in bridges::cpp_uno::shared::releaseProxy (pUnoI=0x2aab30001850) at lo/core/bridges/source/cpp_uno/shared/unointerfaceproxy.cxx:85
> #20 0x00002b7614453be1 in com::sun::star::uno::UnoInterfaceReference::~UnoInterfaceReference (this=0x2aab288533a0, __in_chrg=<optimized out>) at lo/core/solver/unxlngx6/inc/uno/dispatcher.hxx:88
> #21 0x00002b761444e34b in binaryurp::Bridge::releaseStub (this=0x2b760a231670, oid="2b76163a9b58;gcc3[0];f0a89e755a4744f384aad9519f25ba26", type=...) at lo/core/binaryurp/source/bridge.cxx:525
> #22 0x00002b761446a8a7 in binaryurp::IncomingRequest::execute_throw (this=0x2b7624017c10, returnValue=0x2aab28853ad0, outArguments=0x2aab28853a40) at lo/core/binaryurp/source/incomingrequest.cxx:139
> #23 0x00002b761446a027 in binaryurp::IncomingRequest::execute (this=0x2b7624017c10) at lo/core/binaryurp/source/incomingrequest.cxx:74
> #24 0x00002b761448535d in binaryurp::(anonymous namespace)::request (pThreadSpecificData=0x2b7624017c10) at lo/core/binaryurp/source/reader.cxx:87
> #25 0x00002b75f84a81da in cppu_threadpool::JobQueue::enter (this=0x2b7624011a60, nDisposeId=47786410186816, bReturnWhenNoJob=1 '\001') at lo/core/cppu/source/threadpool/jobqueue.cxx:115
> #26 0x00002b75f84abac5 in cppu_threadpool::ORequestThread::run (this=0x2b7624011840) at lo/core/cppu/source/threadpool/thread.cxx:173
> #27 0x00002b75f84ac2ab in osl::threadFunc (param=0x2b7624011850) at lo/core/solver/unxlngx6/inc/osl/thread.hxx:187
> #28 0x00002b75f7a4ec43 in osl_thread_start_Impl (pData=0x2b762400c9f0) at lo/core/sal/osl/unx/thread.c:252
> #29 0x0000003d8be07d14 in start_thread (arg=0x2aab28854700) at pthread_create.c:309
> #30 0x0000003d8baf168d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115
Comment 1 Stephan Bergmann 2013-01-28 12:15:40 UTC
A similar SIGSEGV crash now happened to me in sw_unoapi on current Linux master with the below (relevant subset of) threads:

> Thread 14 (Thread 0x2aaab2299700 (LWP 4625)):
> #0  __lll_lock_wait () at ../nptl/sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:135
> #1  0x0000003c80a09cc1 in _L_lock_885 () from /lib64/libpthread.so.0
> #2  0x0000003c80a09bda in __GI___pthread_mutex_lock (mutex=0x15e51f0) at pthread_mutex_lock.c:85
> #3  0x00002aac2d62818e in osl_acquireMutex (Mutex=0x15e51f0) at lo/core/sal/osl/unx/mutex.c:114
> #4  0x00002aac3195ae2e in vcl::SolarMutexObject::acquire (this=0x15e51c0) at lo/core/vcl/source/app/solarmutex.cxx:35
> #5  0x00002aac31ef8390 in SalYieldMutex::acquire (this=0x15e51c0) at lo/core/vcl/generic/app/geninst.cxx:49
> #6  0x00002aac6492b866 in SolarMutexGuard::SolarMutexGuard (this=0x2aaab2297ef0) at lo/core/solver/unxlngx6/inc/vcl/svapp.hxx:435
> #7  0x00002aac651536f1 in sw::UnoImplPtr<SwXTextCursor::Impl>::~UnoImplPtr (this=0x2aac4e3e42e0, __in_chrg=<optimized out>) at lo/core/sw/inc/unobaseclass.hxx:111
> #8  0x00002aac65147727 in SwXTextCursor::~SwXTextCursor (this=0x2aac4e3e4248, __in_chrg=<optimized out>) at lo/core/sw/source/core/unocore/unoobj.cxx:828
> #9  0x00002aac651477aa in SwXTextCursor::~SwXTextCursor (this=0x2aac4e3e4248, __in_chrg=<optimized out>) at lo/core/sw/source/core/unocore/unoobj.cxx:830
> #10 0x00002aac2e40578b in cppu::OWeakObject::release (this=0x2aac4e3e4248) at lo/core/cppuhelper/source/weak.cxx:204
> #11 0x00002aac6515456a in cppu::WeakImplHelper12<com::sun::star::lang::XServiceInfo, com::sun::star::beans::XPropertySet, com::sun::star::beans::XPropertyState, com::sun::star::beans::XMultiPropertyStates, com::sun::star::container::XEnumerationAccess, com::sun::star::container::XContentEnumerationAccess, com::sun::star::util::XSortable, com::sun::star::document::XDocumentInsertable, com::sun::star::text::XSentenceCursor, com::sun::star::text::XWordCursor, com::sun::star::text::XParagraphCursor, com::sun::star::text::XRedline>::release (this=0x2aac4e3e4248) at lo/core/solver/unxlngx6/inc/cppuhelper/implbase12.hxx:117
> #12 0x00002aac65151d3a in SwXTextCursor::release (this=0x2aac4e3e4248) at lo/core/sw/source/core/unocore/unoobj.cxx:2988
> #13 0x00002aac3eaa3fa8 in bridges::cpp_uno::shared::freeUnoInterfaceProxy (pEnv=0x2aac500009e0, pProxy=0x2aac60740af0) at lo/core/bridges/source/cpp_uno/shared/unointerfaceproxy.cxx:43
> #14 0x00002aac2e0ca05c in (anonymous namespace)::s_stub_defenv_revokeInterface (pParam=0x2aaab22981f8) at lo/core/cppu/source/uno/lbenv.cxx:391
> #15 0x00002aac2e0c5ae2 in s_environment_invoke_v (pCurrEnv=0x0, pTargetEnv=0x2aac500009e0, pCallee=0x2aac2e0c9d08 <(anonymous namespace)::s_stub_defenv_revokeInterface(va_list*)>, pParam=0x2aaab22981f8) at lo/core/cppu/source/uno/EnvStack.cxx:287
> #16 0x00002aac2e0c5b8b in uno_Environment_invoke_v (pTargetEnv=0x2aac500009e0, pCallee=0x2aac2e0c9d08 <(anonymous namespace)::s_stub_defenv_revokeInterface(va_list*)>, pParam=0x2aaab22981f8) at lo/core/cppu/source/uno/EnvStack.cxx:306
> #17 0x00002aac2e0c5c4b in uno_Environment_invoke (pEnv=0x2aac500009e0, pCallee=0x2aac2e0c9d08 <(anonymous namespace)::s_stub_defenv_revokeInterface(va_list*)>) at lo/core/cppu/source/uno/EnvStack.cxx:315
> #18 0x00002aac2e0ca404 in (anonymous namespace)::defenv_revokeInterface (pEnv=0x2aac500009e0, pInterface=0x2aab30093690) at lo/core/cppu/source/uno/lbenv.cxx:447
> #19 0x00002aac3eaa40ce in bridges::cpp_uno::shared::releaseProxy (pUnoI=0x2aab30093690) at lo/core/bridges/source/cpp_uno/shared/unointerfaceproxy.cxx:85
> #20 0x00002aac4c456c31 in com::sun::star::uno::UnoInterfaceReference::~UnoInterfaceReference (this=0x2aaab22983e0, __in_chrg=<optimized out>) at lo/core/solver/unxlngx6/inc/uno/dispatcher.hxx:88
> #21 0x00002aac4c45139b in binaryurp::Bridge::releaseStub (this=0x2aac3feb5670, oid="2aac4e3e4248;gcc3[0];7252421390fa443eaf9b864a0ffba99", type=...) at lo/core/binaryurp/source/bridge.cxx:525
> #22 0x00002aac4c46d8a3 in binaryurp::IncomingRequest::execute_throw (this=0x2aac5c01e650, returnValue=0x2aaab2298b10, outArguments=0x2aaab2298a80) at lo/core/binaryurp/source/incomingrequest.cxx:139
> #23 0x00002aac4c46d023 in binaryurp::IncomingRequest::execute (this=0x2aac5c01e650) at lo/core/binaryurp/source/incomingrequest.cxx:74
> #24 0x00002aac4c488359 in binaryurp::(anonymous namespace)::request (pThreadSpecificData=0x2aac5c01e650) at lo/core/binaryurp/source/reader.cxx:87
> #25 0x00002aac2e09422a in cppu_threadpool::JobQueue::enter (this=0x2aac5c0112b0, nDisposeId=46919766307904, bReturnWhenNoJob=1 '\001') at lo/core/cppu/source/threadpool/jobqueue.cxx:115
> #26 0x00002aac2e097b15 in cppu_threadpool::ORequestThread::run (this=0x2aac5c00f440) at lo/core/cppu/source/threadpool/thread.cxx:173
> #27 0x00002aac2e0982fb in osl::threadFunc (param=0x2aac5c00f450) at lo/core/solver/unxlngx6/inc/osl/thread.hxx:187
> #28 0x00002aac2d632c2b in osl_thread_start_Impl (pData=0x2aac5c00fc70) at lo/core/sal/osl/unx/thread.c:252
> #29 0x0000003c80a07d15 in start_thread (arg=0x2aaab2299700) at pthread_create.c:308
> #30 0x0000003c806f246d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:114

> Thread 6 (Thread 0x2aac37e33f40 (LWP 32488)):
> #0  __lll_lock_wait () at ../nptl/sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:135
> #1  0x0000003c80a09cc1 in _L_lock_885 () from /lib64/libpthread.so.0
> #2  0x0000003c80a09bda in __GI___pthread_mutex_lock (mutex=0x15e51f0) at pthread_mutex_lock.c:85
> #3  0x00002aac2d62818e in osl_acquireMutex (Mutex=0x15e51f0) at lo/core/sal/osl/unx/mutex.c:114
> #4  0x00002aac3195ae2e in vcl::SolarMutexObject::acquire (this=0x15e51c0) at lo/core/vcl/source/app/solarmutex.cxx:35
> #5  0x00002aac31ef8390 in SalYieldMutex::acquire (this=0x15e51c0) at lo/core/vcl/generic/app/geninst.cxx:49
> #6  0x00002aac31ef8577 in SalGenericInstance::AcquireYieldMutex (this=0x15e5220, nCount=1) at lo/core/vcl/generic/app/geninst.cxx:108
> #7  0x00002aac3e47a366 in SvpSalInstance::DoReleaseYield (this=0x15e5220, nTimeoutMS=16) at lo/core/vcl/headless/svpinst.cxx:318
> #8  0x00002aac3e47a240 in SvpSalInstance::Yield (this=0x15e5220, bWait=true, bHandleAllCurrentEvents=false) at lo/core/vcl/headless/svpinst.cxx:300
> #9  0x00002aac3195fc8e in ImplYield (i_bWait=true, i_bAllEvents=false) at lo/core/vcl/source/app/svapp.cxx:429
> #10 0x00002aac3195c04d in Application::Yield (i_bAllEvents=false) at lo/core/vcl/source/app/svapp.cxx:463
> #11 0x00002aac3195bfee in Application::Execute () at lo/core/vcl/source/app/svapp.cxx:408
> #12 0x00002aac2d8db85e in desktop::Desktop::Main (this=0x7fff81482930) at lo/core/desktop/source/app/app.cxx:1656
> #13 0x00002aac319673e7 in ImplSVMain () at lo/core/vcl/source/app/svmain.cxx:163
> #14 0x00002aac31967514 in SVMain () at lo/core/vcl/source/app/svmain.cxx:200
> #15 0x00002aac2d91de86 in soffice_main () at lo/core/desktop/source/app/sofficemain.cxx:73
> #16 0x0000000000400998 in sal_main () at lo/core/desktop/source/app/main.c:48
> #17 0x0000000000400979 in main (argc=9, argv=0x7fff81482b18) at lo/core/desktop/source/app/main.c:47

> Thread 1 (Thread 0x2aab29fc8700 (LWP 4622)):
> #0  x86_64_fallback_frame_state (context=0x2aab29fc14d0, context=0x2aab29fc14d0, fs=0x2aab29fc15c0) at ./md-unwind-support.h:53
> #1  uw_frame_state_for (context=context@entry=0x2aab29fc14d0, fs=fs@entry=0x2aab29fc15c0) at ../../../libgcc/unwind-dw2.c:1187
> #2  0x0000003c81e0ff6c in _Unwind_Backtrace (trace=0x3c80706a80 <backtrace_helper>, trace_argument=0x2aab29fc1780) at ../../../libgcc/unwind.inc:290
> #3  0x0000003c80706c16 in __GI___backtrace (array=<optimized out>, size=256) at ../sysdeps/x86_64/backtrace.c:109
> #4  0x00002aac2d635778 in PrintStack (sig=6) at lo/core/sal/osl/unx/signal.c:829
> #5  0x00002aac2d6359b2 in CallSystemHandler (Signal=6) at lo/core/sal/osl/unx/signal.c:895
> #6  0x00002aac2d635adb in SignalHandlerFunction (Signal=6) at lo/core/sal/osl/unx/signal.c:992
> #7  <signal handler called>
> #8  0x0000003c80635ba5 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:63
> #9  0x0000003c80637358 in __GI_abort () at abort.c:90
> #10 0x00002aac31fadf37 in SalAbort (rErrorText="", bDumpCore=true) at lo/core/vcl/unx/generic/plugadapt/salplug.cxx:282
> #11 0x00002aac3195bf2b in Application::Abort (rErrorText="") at lo/core/vcl/source/app/svapp.cxx:382
> #12 0x00002aac2d8da6fa in desktop::Desktop::Exception (this=0x7fff81482930, nError=768) at lo/core/desktop/source/app/app.cxx:1275
> #13 0x00002aac31967314 in VCLExceptionSignal_impl (pInfo=0x2aab29fc2aa0) at lo/core/vcl/source/app/svmain.cxx:132
> #14 0x00002aac2d63582d in CallSignalHandler (pInfo=0x2aab29fc2aa0) at lo/core/sal/osl/unx/signal.c:854
> #15 0x00002aac2d635ac0 in SignalHandlerFunction (Signal=6) at lo/core/sal/osl/unx/signal.c:989
> #16 <signal handler called>
> #17 0x0000003c80635ba5 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:63
> #18 0x0000003c80637358 in __GI_abort () at abort.c:90
> #19 0x00002aac70703149 in os::die () at /usr/src/debug/java-1.7.0-openjdk/openjdk/hotspot/src/os/linux/vm/os_linux.cpp:1597
> #20 0x00002aac7085f822 in VMError::report_and_die (this=0x2aab29fc3230) at /usr/src/debug/java-1.7.0-openjdk/openjdk/hotspot/src/share/vm/utilities/vmError.cpp:1022
> #21 0x00002aac70860260 in crash_handler (sig=11, info=0x2aab29fc3470, ucVoid=0x2aab29fc3340) at /usr/src/debug/java-1.7.0-openjdk/openjdk/hotspot/src/os/linux/vm/vmError_linux.cpp:106
> #22 <signal handler called>
> #23 0x00002aac6b370123 in ?? ()
> #24 0x00002aac70703120 in os::abort (dump_core=true) at /usr/src/debug/java-1.7.0-openjdk/openjdk/hotspot/src/os/linux/vm/os_linux.cpp:1578
> #25 0x00002aac7085fb8f in VMError::report_and_die (this=0x2aab29fc39e0) at /usr/src/debug/java-1.7.0-openjdk/openjdk/hotspot/src/share/vm/utilities/vmError.cpp:1018
> #26 0x00002aac7070a4af in JVM_handle_linux_signal (sig=11, info=0x2aab29fc3c30, ucVoid=0x2aab29fc3b00, abort_if_unrecognized=1) at /usr/src/debug/java-1.7.0-openjdk/openjdk/hotspot/src/os_cpu/linux_x86/vm/os_linux_x86.cpp:528
> #27 <signal handler called>
> #28 0x00002aac67b06c52 in std::auto_ptr<svx::PropertyChangeNotifier_Data>::operator-> (this=0x48) at /usr/lib/gcc/x86_64-redhat-linux/4.7.2/../../../../include/c++/4.7.2/backward/auto_ptr.h:196
> #29 0x00002aac67b04bcb in svx::PropertyChangeNotifier::notifyPropertyChange (this=0x48, _eProperty=svx::eShapePosition) at lo/core/svx/source/unodraw/shapepropertynotifier.cxx:143
> #30 0x00002aac679b2a1c in SdrObject::notifyShapePropertyChange (this=0x2aab30316ac0, _eProperty=svx::eShapePosition) at lo/core/svx/source/svdraw/svdobj.cxx:3032
> #31 0x00002aac679b220b in SdrObject::SendUserCall (this=0x2aab30316ac0, eUserCall=SDRUSERCALL_MOVEONLY, rBoundRect=Rectangle = {...}) at lo/core/svx/source/svdraw/svdobj.cxx:2910
> #32 0x00002aac679acdcf in SdrObject::SetAnchorPos (this=0x2aab30316ac0, rPnt=Point = {...}) at lo/core/svx/source/svdraw/svdobj.cxx:1641
> #33 0x00002aac64e9e68a in objectpositioning::SwAsCharAnchoredObjectPosition::CalcPosition (this=0x2aab29fc47c0) at lo/core/sw/source/core/objectpositioning/ascharanchoredobjectposition.cxx:248
> #34 0x00002aac64f58a7d in SwFlyCntPortion::SetBase (this=0x2aab3010ad10, rFrm=..., rBase=Point = {...}, nLnAscent=0, nLnDescent=0, nFlyAsc=0, nFlyDesc=0, nFlags=6 '\006') at lo/core/sw/source/core/text/porfly.cxx:381
> #35 0x00002aac64f588b5 in SwFlyCntPortion::SwFlyCntPortion (this=0x2aab3010ad10, rFrm=..., pDrawContact=0x2aab303185e0, rBase=Point = {...}, nLnAscent=0, nLnDescent=0, nFlyAsc=0, nFlyDesc=0, nFlags=6 '\006') at lo/core/sw/source/core/text/porfly.cxx:322
> #36 0x00002aac64f49bd1 in SwTxtFormatter::NewFlyCntPortion (this=0x2aab29fc5b50, rInf=..., pHint=0x2aab30318760) at lo/core/sw/source/core/text/itrform2.cxx:2564
> #37 0x00002aac64f8a9c4 in SwTxtFormatter::NewExtraPortion (this=0x2aab29fc5b50, rInf=...) at lo/core/sw/source/core/text/txtfld.cxx:360
> #38 0x00002aac64f44aa9 in SwTxtFormatter::NewPortion (this=0x2aab29fc5b50, rInf=...) at lo/core/sw/source/core/text/itrform2.cxx:1320
> #39 0x00002aac64f42946 in SwTxtFormatter::BuildPortions (this=0x2aab29fc5b50, rInf=...) at lo/core/sw/source/core/text/itrform2.cxx:709
> #40 0x00002aac64f45840 in SwTxtFormatter::FormatLine (this=0x2aab29fc5b50, nStartPos=1) at lo/core/sw/source/core/text/itrform2.cxx:1538
> #41 0x00002aac64f1af0b in SwTxtFrm::FormatLine (this=0x2aac69b68138, rLine=..., bPrev=0 '\000') at lo/core/sw/source/core/text/frmform.cxx:1117
> #42 0x00002aac64f1c341 in SwTxtFrm::_Format (this=0x2aac69b68138, rLine=..., rInf=..., bAdjust=0 '\000') at lo/core/sw/source/core/text/frmform.cxx:1479
> #43 0x00002aac64f1cb9f in SwTxtFrm::_Format (this=0x2aac69b68138, pPara=0x2aab2a3ea380) at lo/core/sw/source/core/text/frmform.cxx:1653
> #44 0x00002aac64f1da56 in SwTxtFrm::Format (this=0x2aac69b68138) at lo/core/sw/source/core/text/frmform.cxx:1803
> #45 0x00002aac64da7580 in SwCntntFrm::MakeAll (this=0x2aac69b68138) at lo/core/sw/source/core/layout/calcmove.cxx:1392
> #46 0x00002aac64da2339 in SwFrm::OptPrepareMake (this=0x2aac69b68138) at lo/core/sw/source/core/layout/calcmove.cxx:394
> #47 0x00002aac64df934a in SwFrm::OptCalc (this=0x2aac69b68138) at lo/core/sw/source/core/inc/frame.hxx:1028
> #48 0x00002aac64df730d in SwLayAction::_FormatCntnt (this=0x2aab29fc6c70, pCntnt=0x2aac69b68138, pPage=0x2aac69bf5210) at lo/core/sw/source/core/layout/layact.cxx:1959
> #49 0x00002aac64df67c4 in SwLayAction::FormatCntnt (this=0x2aab29fc6c70, pPage=0x2aac69bf5210) at lo/core/sw/source/core/layout/layact.cxx:1783
> #50 0x00002aac64df2318 in SwLayAction::InternalAction (this=0x2aab29fc6c70) at lo/core/sw/source/core/layout/layact.cxx:694
> #51 0x00002aac64df16a7 in SwLayAction::Action (this=0x2aab29fc6c70) at lo/core/sw/source/core/layout/layact.cxx:454
> #52 0x00002aac6522116b in ViewShell::ImplEndAction (this=0x2aab301542b0, bIdleEnd=0 '\000') at lo/core/sw/source/core/view/viewsh.cxx:235
> #53 0x00002aac649f57c0 in ViewShell::EndAction (this=0x2aab301542b0, bIdleEnd=0 '\000') at lo/core/sw/inc/viewsh.hxx:594
> #54 0x00002aac649e5a95 in SwCrsrShell::EndAction (this=0x2aab301542b0, bIdleEnd=0 '\000') at lo/core/sw/source/core/crsr/crsrsh.cxx:257
> #55 0x00002aac64cfb5c7 in SwEditShell::EndAllAction (this=0x2aab301542b0) at lo/core/sw/source/core/edit/edws.cxx:119
> #56 0x00002aac653b5be5 in SwDocShell::Notify (this=0x2aab300c7460, rHint=...) at lo/core/sw/source/ui/app/docsh2.cxx:304
> #57 0x00002aac2f89be93 in SfxBroadcaster::Broadcast (this=0x2aab300c7460, rHint=...) at lo/core/svl/source/notify/brdcst.cxx:49
> #58 0x00002aac2f167d31 in SfxObjectShell::ModifyChanged (this=0x2aab300c7460) at lo/core/sfx2/source/doc/objmisc.cxx:365
> #59 0x00002aac2f167c51 in SfxObjectShell::SetModified (this=0x2aab300c7460, bModifiedP=0 '\000') at lo/core/sfx2/source/doc/objmisc.cxx:345
> #60 0x00002aac653bc65c in SwDocShell::SetModified (this=0x2aab300c7460, bSet=0 '\000') at lo/core/sw/source/ui/app/docsh2.cxx:1523
> #61 0x00002aac2f1beee5 in SfxBaseModel::setModified (this=0x2aaab1328458, bModified=0 '\000') at lo/core/sfx2/source/doc/sfxbasemodel.cxx:1365
> #62 0x00002aac3ea99df6 in gcc3::callVirtualMethod (pThis=0x2aaab13284f0, nVtableIndex=6, pRegisterReturn=0x0, pReturnTypeRef=0x15ec250, bSimpleReturn=true, pStack=0x2aab29fc7250, nStack=0, pGPR=0x2aab29fc72c0, nGPR=2, pFPR=0x2aab29fc72f0, nFPR=0) at lo/core/bridges/source/cpp_uno/gcc3_linux_x86-64/callvirtualmethod.cxx:119
> #63 0x00002aac3eaa17d8 in cpp_call (pThis=0x2aab3010ca80, aVtableSlot=..., pReturnTypeRef=0x15ec250, nParams=1, pParams=0x2aac5c004260, pUnoReturn=0x0, pUnoArgs=0x2aab30093ac0, ppUnoExc=0x2aab29fc76a8) at lo/core/bridges/source/cpp_uno/gcc3_linux_x86-64/uno2cpp.cxx:237
> #64 0x00002aac3eaa233c in bridges::cpp_uno::shared::unoInterfaceProxyDispatch (pUnoI=0x2aab3010ca80, pMemberDescr=0x2aac5c0046b0, pReturn=0x0, pArgs=0x2aab30093ac0, ppException=0x2aab29fc76a8) at lo/core/bridges/source/cpp_uno/gcc3_linux_x86-64/uno2cpp.cxx:431
> #65 0x00002aac4c46e153 in binaryurp::IncomingRequest::execute_throw (this=0x2aac5c015d60, returnValue=0x2aab29fc7b10, outArguments=0x2aab29fc7a80) at lo/core/binaryurp/source/incomingrequest.cxx:245
> #66 0x00002aac4c46d023 in binaryurp::IncomingRequest::execute (this=0x2aac5c015d60) at lo/core/binaryurp/source/incomingrequest.cxx:74
> #67 0x00002aac4c488359 in binaryurp::(anonymous namespace)::request (pThreadSpecificData=0x2aac5c015d60) at lo/core/binaryurp/source/reader.cxx:87
> #68 0x00002aac2e09422a in cppu_threadpool::JobQueue::enter (this=0x2aac5c034e50, nDisposeId=46919766305312, bReturnWhenNoJob=1 '\001') at lo/core/cppu/source/threadpool/jobqueue.cxx:115
> #69 0x00002aac2e097b15 in cppu_threadpool::ORequestThread::run (this=0x2aac5c00ea20) at lo/core/cppu/source/threadpool/thread.cxx:173
> #70 0x00002aac2e0982fb in osl::threadFunc (param=0x2aac5c00ea30) at lo/core/solver/unxlngx6/inc/osl/thread.hxx:187
> #71 0x00002aac2d632c2b in osl_thread_start_Impl (pData=0x2aac5c00f5d0) at lo/core/sal/osl/unx/thread.c:252
> #72 0x0000003c80a07d15 in start_thread (arg=0x2aab29fc8700) at pthread_create.c:308
> #73 0x0000003c806f246d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:114
Comment 2 QA Administrators 2015-02-19 15:47:49 UTC
** Please read this message in its entirety before responding **

To make sure we're focusing on the bugs that affect our users today, LibreOffice QA is asking bug reporters and confirmers to retest open, confirmed bugs which have not been touched for over a year.

There have been thousands of bug fixes and commits since anyone checked on this bug report. During that time, it's possible that the bug has been fixed, or the details of the problem have changed. We'd really appreciate your help in getting confirmation that the bug is still present.

If you have time, please do the following:

Test to see if the bug is still present on a currently supported version of LibreOffice (4.4.0.3 or later): https://www.libreoffice.org/download/

If the bug is present, please leave a comment that includes the version of LibreOffice and your operating system, and any changes you see in the bug behavior

If the bug is NOT present, please set the bug's Status field to RESOLVED-WORKSFORME and leave a short comment that includes your version of LibreOffice and Operating System

Please DO NOT

Update the version field
Reply via email (please reply directly on the bug tracker)
Set the bug's Status field to RESOLVED - FIXED (this status has a particular meaning that is not appropriate in this case)

Thank you for your help!

-- The LibreOffice QA Team
This NEW Message was generated on: 2015-02-19
Comment 3 Stephan Bergmann 2015-06-04 09:19:10 UTC
For practical purposes, it probably doesn't make a difference whether this bug is open or closed.  Probably nobody will invest time looking into a fix for these sporadic crashes (and with sporadic crashes, it's also hard to know whether they can even still occur, without analysing why they occurred), and somebody running across a similar crash will probably just as unlikely find this bug when its open as when its closed.

So close this for now (as WONTFIX, somewhat arbitrarily) to keep overall bugzilla status clean.