[New LWP 4074521] [New LWP 4075121] [New LWP 4107667] [New LWP 4074742] [New LWP 4074755] [New LWP 4075119] [New LWP 4084403] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `/home/buildslave/build/instdir/program/soffice.bin -env:UserInstallation=file:/'. Program terminated with signal SIGABRT, Aborted. #0 0x00007f48637c8ebc in ?? () from /lib/x86_64-linux-gnu/libc.so.6 [Current thread is 1 (Thread 0x7f485a41ee00 (LWP 4074521))] Thread 7 (Thread 0x7f482d5ff6c0 (LWP 4084403)): #0 0x00007f48637c3f16 in () at /lib/x86_64-linux-gnu/libc.so.6 #1 0x00007f48637c6baf in pthread_cond_clockwait () at /lib/x86_64-linux-gnu/libc.so.6 #2 0x00007f4862c0c200 in std::__condvar::wait_until(std::mutex&, int, timespec&) (__abs_time=..., __clock=1, __m=, this=0x7f4862c0f288 <(anonymous namespace)::getTimerManager()::aManager+72>) at /usr/include/c++/12/bits/std_mutex.h:169 __s = {__d = {__r = 39558003}} __ts = {tv_sec = 39558003, tv_nsec = 249843914} #3 std::condition_variable::__wait_until_impl > >(std::unique_lock&, std::chrono::time_point > > const&) (this=this@entry=0x7f4862c0f288 <(anonymous namespace)::getTimerManager()::aManager+72>, __lock=..., __atime=...) at /usr/include/c++/12/condition_variable:200 __s = {__d = {__r = 39558003}} __ts = {tv_sec = 39558003, tv_nsec = 249843914} #4 0x00007f4862c0bdc8 in std::condition_variable::wait_until > >(std::unique_lock&, std::chrono::time_point > > const&) (__atime=..., __lock=..., this=0x7f4862c0f288 <(anonymous namespace)::getTimerManager()::aManager+72>) at /usr/include/c++/12/condition_variable:108 #5 std::condition_variable::wait_until >, salhelper::TimerManager::run():: >(std::unique_lock &, const std::chrono::time_point > > &, struct {...}) (this=this@entry=0x7f4862c0f288 <(anonymous namespace)::getTimerManager()::aManager+72>, __lock=..., __atime=..., __p=...) at /usr/include/c++/12/condition_variable:151 #6 0x00007f4862c0be38 in std::condition_variable::wait_for, salhelper::TimerManager::run():: >(std::unique_lock &, const std::chrono::duration > &, struct {...}) (this=this@entry=0x7f4862c0f288 <(anonymous namespace)::getTimerManager()::aManager+72>, __lock=..., __rtime=..., __p=__p@entry=...) at /usr/include/c++/12/condition_variable:174 #7 0x00007f4862c0beba in salhelper::TimerManager::run() (this=0x7f4862c0f240 <(anonymous namespace)::getTimerManager()::aManager>) at /home/buildslave/source/libo-core/salhelper/source/timer.cxx:372 a_Guard = {_M_device = 0x7f4862c0f260 <(anonymous namespace)::getTimerManager()::aManager+32>, _M_owns = true} #8 0x00007f4862c0b3c7 in osl::threadFunc(void*) (param=0x7f4862c0f240 <(anonymous namespace)::getTimerManager()::aManager>) at /home/buildslave/source/libo-core/include/osl/thread.hxx:189 pObj = 0x7f4862c0f240 <(anonymous namespace)::getTimerManager()::aManager> #9 0x00007f4863b3d41d in osl_thread_start_Impl(void*) (pData=0x7f48373c9be0) at /home/buildslave/source/libo-core/sal/osl/unx/thread.cxx:237 terminate = false pImpl = 0x7f48373c9be0 __PRETTY_FUNCTION__ = "void* osl_thread_start_Impl(void*)" #10 0x00007f48637c71c4 in () at /lib/x86_64-linux-gnu/libc.so.6 #11 0x00007f486384785c in () at /lib/x86_64-linux-gnu/libc.so.6 Thread 6 (Thread 0x7f484eac06c0 (LWP 4075119)): #0 0x00007f48637c3f16 in () at /lib/x86_64-linux-gnu/libc.so.6 #1 0x00007f48637c65d8 in pthread_cond_wait () at /lib/x86_64-linux-gnu/libc.so.6 #2 0x00007f4863b1af25 in std::condition_variable::wait > (__p=..., __lock=..., this=0x7f4844008560) at /usr/include/c++/12/condition_variable:102 g = {_M_device = 0x7f4844008590, _M_owns = true} pCond = 0x7f4844008560 __PRETTY_FUNCTION__ = "oslConditionResult osl_waitCondition(oslCondition, const TimeValue*)" #3 osl_waitCondition(oslCondition, TimeValue const*) (Condition=, pTimeout=) at /home/buildslave/source/libo-core/sal/osl/unx/conditn.cxx:125 g = {_M_device = 0x7f4844008590, _M_owns = true} pCond = 0x7f4844008560 __PRETTY_FUNCTION__ = "oslConditionResult osl_waitCondition(oslCondition, const TimeValue*)" #4 0x00007f4854182c36 in osl::Condition::wait(TimeValue const*) (pTimeout=0x0, this=0x7f48440084b0) at /home/buildslave/source/libo-core/include/osl/conditn.hxx:123 item = {tid = {_pSequence = 0x7f4840001120}, oid = "7fdd18069cf0;uno[0];3cdcb5;1a969ba14eb8441b447e49fa95c362a", type = {_pTypeDescr = 0x0}, member = {_pTypeDescr = 0x7f48373425d0}, currentContext = {m_pUnoI = 0x0}, returnValue = {data_ = _uno_Any(void)}, arguments = std::__debug::vector of length 1, capacity 1 = {{data_ = }}, request = true, setter = false, exception = false, setCurrentContextMode = false} __PRETTY_FUNCTION__ = "virtual void binaryurp::Writer::execute()" #5 binaryurp::Writer::execute() (this=0x7f48440082d0) at /home/buildslave/source/libo-core/binaryurp/source/writer.cxx:151 item = {tid = {_pSequence = 0x7f4840001120}, oid = "7fdd18069cf0;uno[0];3cdcb5;1a969ba14eb8441b447e49fa95c362a", type = {_pTypeDescr = 0x0}, member = {_pTypeDescr = 0x7f48373425d0}, currentContext = {m_pUnoI = 0x0}, returnValue = {data_ = _uno_Any(void)}, arguments = std::__debug::vector of length 1, capacity 1 = {{data_ = }}, request = true, setter = false, exception = false, setCurrentContextMode = false} __PRETTY_FUNCTION__ = "virtual void binaryurp::Writer::execute()" #6 0x00007f4862c0b121 in salhelper::Thread::run() (this=0x7f48440082d0) at /home/buildslave/source/libo-core/salhelper/source/thread.cxx:39 g = {m_func = {__this = 0x7f48440082d0}, m_bDismissed = false} #7 0x00007f4862c0b3c7 in osl::threadFunc(void*) (param=0x7f48440082e0) at /home/buildslave/source/libo-core/include/osl/thread.hxx:189 pObj = 0x7f48440082e0 #8 0x00007f4863b3d41d in osl_thread_start_Impl(void*) (pData=0x7f4844008ce0) at /home/buildslave/source/libo-core/sal/osl/unx/thread.cxx:237 terminate = false pImpl = 0x7f4844008ce0 __PRETTY_FUNCTION__ = "void* osl_thread_start_Impl(void*)" #9 0x00007f48637c71c4 in () at /lib/x86_64-linux-gnu/libc.so.6 #10 0x00007f486384785c in () at /lib/x86_64-linux-gnu/libc.so.6 Thread 5 (Thread 0x7f484ffff6c0 (LWP 4074755)): #0 0x00007f486384869f in accept () at /lib/x86_64-linux-gnu/libc.so.6 #1 0x00007f4863b2c27a in osl_acceptPipe(oslPipe) (pPipe=0x7f4844001570) at /home/buildslave/source/libo-core/sal/osl/unx/pipe.cxx:388 s = pAcceptedPipe = socket = 12 __PRETTY_FUNCTION__ = "oslPipeImpl* osl_acceptPipe(oslPipe)" aGuard = {_M_device = 0x7f4844001570, _M_owns = false} flags = #2 0x00007f48541e4ad1 in osl::Pipe::accept(osl::StreamPipe&) (this=this@entry=0x7f484fffd4f8, Connection=...) at /home/buildslave/source/libo-core/include/osl/pipe.hxx:155 #3 0x00007f48541e45b2 in io_acceptor::PipeAcceptor::accept() (this=0x7f4844000d50) at /home/buildslave/source/libo-core/io/source/acceptor/acc_pipe.cxx:157 pipe = {m_handle = 0x7f4844001570} pConn = rtl::Reference to 0x7f4844009530 status = #4 0x00007f48541ea510 in (anonymous namespace)::OAcceptor::accept(rtl::OUString const&) (this=0x5605d724acc0, sConnectionDescription="pipe,name=pytestdfda76f5-c677-11ef-b3ae-98f2b32c495c") at /home/buildslave/source/libo-core/io/source/acceptor/acceptor.cxx:198 guard = {m_pFlag = 0x5605d724ad38} r = empty uno::Reference #5 0x00007f4855e12a2d in desktop::Acceptor::run() (this=this@entry=0x5605d724bb90) at /home/buildslave/source/libo-core/desktop/source/offacc/acceptor.cxx:110 g = {_M_device = 0x5605d724bbc8, _M_owns = true} rConnection = empty uno::Reference aDescription = "pipe,name=pytestdfda76f5-c677-11ef-b3ae-98f2b32c495c,uniqueValue=139948355229008" rInstanceProvider = uno::Reference to (desktop::AccInstanceProvider *) 0x7f4844000d38 #6 0x00007f4855e12ed9 in desktop::offacc_workerfunc(void*) (acc=0x5605d724bb90) at /home/buildslave/source/libo-core/desktop/source/offacc/acceptor.cxx:46 #7 0x00007f4863b3d41d in osl_thread_start_Impl(void*) (pData=0x5605d7251150) at /home/buildslave/source/libo-core/sal/osl/unx/thread.cxx:237 terminate = false pImpl = 0x5605d7251150 __PRETTY_FUNCTION__ = "void* osl_thread_start_Impl(void*)" #8 0x00007f48637c71c4 in () at /lib/x86_64-linux-gnu/libc.so.6 #9 0x00007f486384785c in () at /lib/x86_64-linux-gnu/libc.so.6 Thread 4 (Thread 0x7f4854a2f6c0 (LWP 4074742)): #0 0x00007f486384869f in accept () at /lib/x86_64-linux-gnu/libc.so.6 #1 0x00007f4863b2c27a in osl_acceptPipe(oslPipe) (pPipe=0x5605d719c2f0) at /home/buildslave/source/libo-core/sal/osl/unx/pipe.cxx:388 s = pAcceptedPipe = socket = 9 __PRETTY_FUNCTION__ = "oslPipeImpl* osl_acceptPipe(oslPipe)" aGuard = {_M_device = 0x5605d719c2f0, _M_owns = false} flags = #2 0x00007f48639a4b81 in osl::Pipe::accept(osl::StreamPipe&) (this=this@entry=0x5605d72402c0, Connection=...) at /home/buildslave/source/libo-core/include/osl/pipe.hxx:155 #3 0x00007f48639a4686 in desktop::PipeIpcThread::execute() (this=0x5605d7240290) at /home/buildslave/source/libo-core/desktop/source/app/officeipcthread.cxx:1127 aStreamPipe = { = {m_handle = 0x0}, } nError = __PRETTY_FUNCTION__ = "virtual void desktop::PipeIpcThread::execute()" #4 0x00007f4862c0b121 in salhelper::Thread::run() (this=0x5605d7240290) at /home/buildslave/source/libo-core/salhelper/source/thread.cxx:39 g = {m_func = {__this = 0x5605d7240290}, m_bDismissed = false} #5 0x00007f4862c0b3c7 in osl::threadFunc(void*) (param=0x5605d72402a0) at /home/buildslave/source/libo-core/include/osl/thread.hxx:189 pObj = 0x5605d72402a0 #6 0x00007f4863b3d41d in osl_thread_start_Impl(void*) (pData=0x5605d6b10990) at /home/buildslave/source/libo-core/sal/osl/unx/thread.cxx:237 terminate = false pImpl = 0x5605d6b10990 __PRETTY_FUNCTION__ = "void* osl_thread_start_Impl(void*)" #7 0x00007f48637c71c4 in () at /lib/x86_64-linux-gnu/libc.so.6 #8 0x00007f486384785c in () at /lib/x86_64-linux-gnu/libc.so.6 Thread 3 (Thread 0x7f484dabe6c0 (LWP 4107667)): #0 0x00007f48637c412b in () at /lib/x86_64-linux-gnu/libc.so.6 #1 0x00007f48637ca4aa in pthread_mutex_lock () at /lib/x86_64-linux-gnu/libc.so.6 #2 0x00007f4863b2ac53 in osl_acquireMutex(oslMutex) (pMutex=0x5605d6283210) at /home/buildslave/source/libo-core/sal/osl/unx/mutex.cxx:99 nRet = #3 0x00007f485de61e89 in osl::Mutex::acquire() (this=0x5605d6283518) at /home/buildslave/source/libo-core/include/osl/mutex.hxx:63 pInst = 0x5605d62833e0 __PRETTY_FUNCTION__ = "virtual void SvpSalYieldMutex::doAcquire(sal_uInt32)" #4 SvpSalYieldMutex::doAcquire(unsigned int) (this=0x5605d6283510, nLockCount=1) at /home/buildslave/source/libo-core/vcl/headless/svpinst.cxx:356 pInst = 0x5605d62833e0 __PRETTY_FUNCTION__ = "virtual void SvpSalYieldMutex::doAcquire(sal_uInt32)" #5 0x00007f486231f31a in comphelper::SolarMutex::acquire(unsigned int) (this=, nLockCount=nLockCount@entry=1) at /home/buildslave/source/libo-core/include/comphelper/solarmutex.hxx:86 __PRETTY_FUNCTION__ = "void comphelper::SolarMutex::acquire(sal_uInt32)" #6 0x00007f486231f357 in osl::Guard::Guard(comphelper::SolarMutex&) (t=, this=0x7f484dabb560) at /home/buildslave/source/libo-core/include/osl/mutex.hxx:144 #7 SolarMutexGuard::SolarMutexGuard() (this=) at /home/buildslave/source/libo-core/include/vcl/svapp.hxx:1340 #8 0x00007f48624230ca in (anonymous namespace)::XFrameImpl::getContainerWindow() (this=0x7f48305fb330) at /home/buildslave/source/libo-core/framework/source/services/frame.cxx:840 g = {> = {pT = 0x5605d6283510}, } #9 0x00007f486240650a in framework::LoadEnv::impl_reactForLoadingState() (this=this@entry=0x7f484dabb9e0) at /home/buildslave/source/libo-core/framework/source/loadenv/loadenv.cxx:1600 bMinimized = bStartPres = pFrameName = invalid iterator xWindow = uno::Reference to (com::sun::star::uno::XInterface *) 0x1d bHidden = pWindow = {m_rInnerRef = empty rtl::Reference} aReadLock = {pT = 0x7f484dabb9e0} aRequest = Python Exception : bThrow = #10 0x00007f4862406adb in framework::LoadEnv::impl_setResult(bool) (this=this@entry=0x7f484dabb9e0, bResult=) at /home/buildslave/source/libo-core/framework/source/loadenv/loadenv.cxx:535 g = {pT = 0x7f484dabb9e0} #11 0x00007f486240b716 in framework::LoadEnv::impl_loadContent() (this=this@entry=0x7f484dabb9e0) at /home/buildslave/source/libo-core/framework/source/loadenv/loadenv.cxx:1183 xTargetFrameProps = uno::Reference to ((anonymous namespace)::XFrameImpl *) 0x7f48305fb3f0 bResult = aWriteLock = {pT = 0x7f484dabb9e0} sTarget = "_blank" xTargetFrame = uno::Reference to ((anonymous namespace)::XFrameImpl *) 0x7f48305fb3a0 xTargetLock = uno::Reference to ((anonymous namespace)::XFrameImpl *) 0x7f48305fb3c8 bHidden = bMinimized = false bPreview = false bStartPres = lDescriptor = uno::Sequence of length 12 = {{Name = "URL", Handle = 0, Value = uno::Any("string": "file:///srv/crashtestdata/current/srv/crashtestdata/files/caolan/swfootnoteframe_unlockbackmove_heap_use_after_free.docx"), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "UCBContent", Handle = 0, Value = uno::Any("com.sun.star.ucb.XContent": { = {_vptr.XInterface = 0x7f4836e197e8}, }), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "UpdateDocMode", Handle = 0, Value = uno::Any("short": 0), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "InteractionHandler", Handle = 0, Value = uno::Any("com.sun.star.task.XInteractionHandler": { = {_vptr.XInterface = 0x7f484000f848}, }), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "Hidden", Handle = 0, Value = uno::Any("boolean": 1 '\001'), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "AuthenticationHandler", Handle = 0, Value = uno::Any("com.sun.star.task.XInteractionHandler": { = {_vptr.XInterface = 0x7f484000f848}, }), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "InputStream", Handle = 0, Value = uno::Any("com.sun.star.io.XInputStream": { = {_vptr.XInterface = 0x7f48372b6788}, }), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "TypeName", Handle = 0, Value = uno::Any("string": "writer_OOXML"), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "AbortOnLoadFailure", Handle = 0, Value = uno::Any("boolean": 1 '\001'), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "ReadOnly", Handle = 0, Value = uno::Any("boolean": 1 '\001'), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "MacroExecutionMode", Handle = 0, Value = uno::Any("short": 0), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "FilterName", Handle = 0, Value = uno::Any("string": "Office Open XML Text"), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}} sURL = "file:///srv/crashtestdata/current/srv/crashtestdata/files/caolan/swfootnoteframe_unlockbackmove_heap_use_after_free.docx" xLoader = uno::Reference to ((anonymous namespace)::SfxFrameLoader_Impl *) 0x7f483736ad00 xAsyncLoader = empty uno::Reference xSyncLoader = uno::Reference to ((anonymous namespace)::SfxFrameLoader_Impl *) 0x7f483736ad28 #12 0x00007f486240b9f2 in framework::LoadEnv::start() (this=this@entry=0x7f484dabb9e0) at /home/buildslave/source/libo-core/framework/source/loadenv/loadenv.cxx:415 bStarted = #13 0x00007f486240c0fb in framework::LoadEnv::startLoading(rtl::OUString const&, com::sun::star::uno::Sequence const&, com::sun::star::uno::Reference const&, rtl::OUString const&, int, LoadEnvFeatures) (this=this@entry=0x7f484dabb9e0, sURL="file:///srv/crashtestdata/current/srv/crashtestdata/files/caolan/swfootnoteframe_unlockbackmove_heap_use_after_free.docx", lMediaDescriptor=uno::Sequence of length 3 = {...}, xBaseFrame=uno::Reference to (framework::Desktop *) 0x5605d6543358, sTarget="_blank", nSearchFlags=nSearchFlags@entry=0, eFeature=LoadEnvFeatures::NONE) at /home/buildslave/source/libo-core/framework/source/loadenv/loadenv.cxx:311 g = {pT = 0x7f484dabb9e0} aRealURL = "file:///srv/crashtestdata/current/srv/crashtestdata/files/caolan/swfootnoteframe_unlockbackmove_heap_use_after_free.docx" xParser = uno::Reference to ((anonymous namespace)::URLTransformer *) 0x7f480d156348 pIt = {, true>> = {_M_cur = 0x0}, } bUIMode = false #14 0x00007f486240c345 in framework::LoadEnv::loadComponentFromURL(com::sun::star::uno::Reference const&, com::sun::star::uno::Reference const&, rtl::OUString const&, rtl::OUString const&, int, com::sun::star::uno::Sequence const&) (xLoader=uno::Reference to (framework::Desktop *) 0x5605d6543368, xContext=uno::Reference to (cppu::(anonymous namespace)::ComponentContext *) 0x5605d627ff48, sURL="file:///srv/crashtestdata/current/srv/crashtestdata/files/caolan/swfootnoteframe_unlockbackmove_heap_use_after_free.docx", sTarget="_blank", nSearchFlags=0, lArgs=uno::Sequence of length 3 = {...}) at /home/buildslave/source/libo-core/framework/source/loadenv/loadenv.cxx:167 aEnv = Python Exception : No type named std::__detail::_Hash_node, true>. {m_mutex = {mutex = 0x7f48373ea190}, m_xContext = uno::Reference to (class cppu::(anonymous namespace)::ComponentContext *) 0x5605d627ff48, m_xBaseFrame = uno::Reference to (class framework::Desktop *) 0x5605d6543358, m_xTargetFrame = uno::Reference to (class (anonymous namespace)::XFrameImpl *) 0x7f48305fb3a0, m_sTarget = "_blank", m_nSearchFlags = 0, m_lMediaDescriptor = { = {m_aMap = std::__debug::unordered_map with 12 elements}, static PROP_ABORTED = {pData = 0x7f486261c9f0