[New LWP 3177811] [New LWP 3178199] [New LWP 3179279] [New LWP 3178193] [New LWP 3200205] [New LWP 3179282] [New LWP 3192435] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `/home/buildslave/build/instdir/program/soffice.bin -env:UserInstallation=file:/'. Program terminated with signal SIGABRT, Aborted. #0 0x00007fba81656ebc in ?? () from /lib/x86_64-linux-gnu/libc.so.6 [Current thread is 1 (Thread 0x7fba7b094e00 (LWP 3177811))] Thread 7 (Thread 0x7fba63fff6c0 (LWP 3192435)): #0 0x00007fba81651f16 in () at /lib/x86_64-linux-gnu/libc.so.6 #1 0x00007fba81654baf in pthread_cond_clockwait () at /lib/x86_64-linux-gnu/libc.so.6 #2 0x00007fba8199937e in std::__condvar::wait_until(std::mutex&, int, timespec&) (__abs_time=..., __clock=1, __m=, this=0x7fba307a5a40) at /usr/include/c++/12/bits/std_mutex.h:169 __s = {__d = {__r = 39130131}} __ts = {tv_sec = 39130131, tv_nsec = 75372119} #3 std::condition_variable::__wait_until_impl > >(std::unique_lock&, std::chrono::time_point > > const&) (this=this@entry=0x7fba307a5a40, __lock=..., __atime=...) at /usr/include/c++/12/condition_variable:200 __s = {__d = {__r = 39130131}} __ts = {tv_sec = 39130131, tv_nsec = 75372119} #4 0x00007fba819984dd in std::condition_variable::wait_until > >(std::unique_lock&, std::chrono::time_point > > const&) (__atime=..., __lock=..., this=0x7fba307a5a40) at /usr/include/c++/12/condition_variable:108 #5 std::condition_variable::wait_until >, osl_waitCondition(oslCondition, const TimeValue*):: >(std::unique_lock &, const std::chrono::time_point > > &, struct {...}) (this=this@entry=0x7fba307a5a40, __lock=..., __atime=..., __p=...) at /usr/include/c++/12/condition_variable:151 #6 0x00007fba81998550 in std::condition_variable::wait_for, osl_waitCondition(oslCondition, const TimeValue*):: >(std::unique_lock &, const std::chrono::duration > &, struct {...}) (this=0x7fba307a5a40, __lock=..., __rtime=..., __p=__p@entry=...) at /usr/include/c++/12/condition_variable:174 #7 0x00007fba81998dbd in osl_waitCondition(oslCondition, TimeValue const*) (Condition=, pTimeout=0x7fba63ffd730) at /home/buildslave/source/libo-core/sal/osl/unx/conditn.cxx:119 duration = {__r = 2000000000} g = {_M_device = 0x7fba307a5a70, _M_owns = true} pCond = 0x7fba307a5a40 __PRETTY_FUNCTION__ = "oslConditionResult osl_waitCondition(oslCondition, const TimeValue*)" #8 0x00007fba80fb7aff in osl::Condition::wait(TimeValue const*) (pTimeout=0x7fba63ffd730, this=0x7fba63ffd6a0) at /home/buildslave/source/libo-core/include/osl/conditn.hxx:123 waitingThread = {condition = {condition = 0x7fba307a5a40}, thread = rtl::Reference to 0x7fba5c00a830} #9 osl::Condition::wait(TimeValue const&) (timeout=..., this=0x7fba63ffd6a0) at /home/buildslave/source/libo-core/include/osl/conditn.hxx:127 waitingThread = {condition = {condition = 0x7fba307a5a40}, thread = rtl::Reference to 0x7fba5c00a830} #10 cppu_threadpool::ThreadPool::waitInPool(rtl::Reference const&) (this=this@entry=0x7fba68001200, pThread=rtl::Reference to 0x7fba5c00a830) at /home/buildslave/source/libo-core/cppu/source/threadpool/threadpool.cxx:122 waitingThread = {condition = {condition = 0x7fba307a5a40}, thread = rtl::Reference to 0x7fba5c00a830} #11 0x00007fba80fb0a4f in cppu_threadpool::ORequestThread::run() (this=0x7fba5c00a830) at /home/buildslave/source/libo-core/cppu/source/threadpool/thread.cxx:185 #12 0x00007fba80fb0f03 in osl::threadFunc(void*) (param=0x7fba5c00a840) at /home/buildslave/source/libo-core/include/osl/thread.hxx:189 pObj = 0x7fba5c00a840 #13 0x00007fba819bc511 in osl_thread_start_Impl(void*) (pData=0x7fba5c003690) at /home/buildslave/source/libo-core/sal/osl/unx/thread.cxx:237 terminate = false pImpl = 0x7fba5c003690 __PRETTY_FUNCTION__ = "void* osl_thread_start_Impl(void*)" #14 0x00007fba816551c4 in () at /lib/x86_64-linux-gnu/libc.so.6 #15 0x00007fba816d585c in () at /lib/x86_64-linux-gnu/libc.so.6 Thread 6 (Thread 0x7fba70e256c0 (LWP 3179282)): #0 0x00007fba816d68e4 in recv () at /lib/x86_64-linux-gnu/libc.so.6 #1 0x00007fba819ab845 in osl_receivePipe(oslPipe, void*, sal_Int32) (pPipe=pPipe@entry=0x7fba68000f20, pBuffer=pBuffer@entry=0x7fba5012e9b8, BytesToRead=BytesToRead@entry=8) at /home/buildslave/source/libo-core/sal/osl/unx/pipe.cxx:444 nRet = 0 #2 0x00007fba819abafc in osl_readPipe(oslPipe, void*, sal_Int32) (pPipe=0x7fba68000f20, pBuffer=0x7fba5012e9b8, n=) at /home/buildslave/source/libo-core/sal/osl/unx/pipe.cxx:514 RetVal = BytesRead = 0 BytesToRead = 8 #3 0x00007fba7256f875 in osl::StreamPipe::read(void*, int) const (n=8, pBuffer=, this=0x7fba68001550) at /home/buildslave/source/libo-core/include/osl/pipe.hxx:200 n = #4 io_acceptor::(anonymous namespace)::PipeConnection::read(com::sun::star::uno::Sequence&, sal_Int32) (this=0x7fba68001520, aReadBytes=uno::Sequence of length 8 = {...}, nBytesToRead=8) at /home/buildslave/source/libo-core/io/source/acceptor/acc_pipe.cxx:83 n = #5 0x00007fba7250ad1f in binaryurp::(anonymous namespace)::read(com::sun::star::uno::Reference const&, sal_uInt32, bool) (connection=uno::Reference to (io_acceptor::(anonymous namespace)::PipeConnection *) 0x7fba68001548, size=size@entry=8, eofOk=eofOk@entry=true) at /home/buildslave/source/libo-core/binaryurp/source/reader.cxx:70 __PRETTY_FUNCTION__ = "com::sun::star::uno::Sequence binaryurp::{anonymous}::read(const com::sun::star::uno::Reference&, sal_uInt32, bool)" buf = uno::Sequence of length 8 = {0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000'} n = #6 0x00007fba7250cd42 in binaryurp::Reader::execute() (this=0x7fba68006b00) at /home/buildslave/source/libo-core/binaryurp/source/reader.cxx:105 s = uno::Sequence of length 8 = {0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000'} count = block = {bridge_ = rtl::Reference to 0x7fba68000fa0, state_ = @0x7fba68006b48, buffer_ = uno::Sequence of length 32701 = {-2 '\376', -94 '\242', 123 '{', 114 'r', 42 '*', 116 't', -56 '\310', -50 '\316', 98 'b', 97 'a', 53 '5', 48 '0', 49 '1', 55 '7', 53 '5', 99 'c', 51 '3', 48 '0', 59 ';', 103 'g', 99 'c', 99 'c', 51 '3', 91 '[', 48 '0', 93 ']', 59 ';', 53 '5', 50 '2', 52 '4', 54 '6', 52 '4', 54 '6', 101 'e', 102 'f', 52 '4', 97 'a', 98 'b', 48 '0', 52 '4', 50 '2', 56 '8', 53 '5', 56 '8', 56 '8', 52 '4', 56 '8', 54 '6', 99 'c', 49 '1', 99 'c', 101 'e', 99 'c', 55 '7', 49 '1', 101 'e', 57 '9', 53 '5', 102 'f', 0 '\000', -33 '\337', 0 '\000', 0 '\000', 0 '\000', 37 '%', 0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000', 2 '\002', -64 '\300', -91 '\245', -5 '\373', 7 '\a', 0 '\000', 0 '\000', 0 '\000', -2 '\376', -94 '\242', 123 '{', 114 'r', 42 '*', 116 't', -56 '\310', -50 '\316', 1 '\001', 0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000', -123 '\205', 0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000', 1 '\001', 0 '\000', 0 '\000', 0 '\000', 53 '5', 0 '\000', 0 '\000', 0 '\000', 53 '5', 0 '\000', 53 '5', 0 '\000', 98 'b', 0 '\000', 51 '3', 0 '\000', 49 '1', 0 '\000', 55 '7', 0 '\000', 50 '2', 0 '\000', 99 'c', 0 '\000', 49 '1', 0 '\000', 49 '1', 0 '\000', 49 '1', 0 '\000', 48 '0', 0 '\000', 59 ';', 0 '\000', 103 'g', 0 '\000', 99 'c', 0 '\000', 99 'c', 0 '\000', 51 '3', 0 '\000', 91 '[', 0 '\000', 48 '0', 0 '\000', 93 ']', 0 '\000', 59 ';', 0 '\000', 53 '5', 0 '\000', 50 '2', 0 '\000', 52 '4', 0 '\000', 54 '6', 0 '\000', 52 '4', 0 '\000', 54 '6', 0 '\000', 101 'e', 0 '\000', 102 'f', 0 '\000', 52 '4', 0 '\000', 97 'a', 0 '\000', 98 'b', 0 '\000', 48 '0', 0 '\000', 52 '4', 0 '\000', 50 '2', 0 '\000', 56 '8', 0 '\000', 53 '5', 0 '\000', 56 '8', 0 '\000', 56 '8', 0 '\000', 52 '4', 0 '\000', 56 '8', 0 '\000', 54 '6', 0 '\000', 99 'c', 0 '\000', 49 '1', 0 '\000'...}, data_ = 0x7fba5c002d35 "", end_ = 0x7fba5c002d35 ""} header = {bridge_ = rtl::Reference to 0x7fba68000fa0, state_ = @0x7fba68006b48, buffer_ = uno::Sequence of length 8 = {0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000'}, data_ = 0x7fba5012e9c0 "s", end_ = 0x7fba5012e9c0 "s"} size = con = uno::Reference to (io_acceptor::(anonymous namespace)::PipeConnection *) 0x7fba68001548 #7 0x00007fba80a850d1 in salhelper::Thread::run() (this=0x7fba68006b00) at /home/buildslave/source/libo-core/salhelper/source/thread.cxx:39 g = {m_func = {__this = 0x7fba68006b00}, m_bDismissed = false} #8 0x00007fba80a85379 in osl::threadFunc(void*) (param=0x7fba68006b10) at /home/buildslave/source/libo-core/include/osl/thread.hxx:189 pObj = 0x7fba68006b10 #9 0x00007fba819bc511 in osl_thread_start_Impl(void*) (pData=0x7fba68008d60) at /home/buildslave/source/libo-core/sal/osl/unx/thread.cxx:237 terminate = false pImpl = 0x7fba68008d60 __PRETTY_FUNCTION__ = "void* osl_thread_start_Impl(void*)" #10 0x00007fba816551c4 in () at /lib/x86_64-linux-gnu/libc.so.6 #11 0x00007fba816d585c in () at /lib/x86_64-linux-gnu/libc.so.6 Thread 5 (Thread 0x7fba579ff6c0 (LWP 3200205)): #0 0x00007fba8165212b in () at /lib/x86_64-linux-gnu/libc.so.6 #1 0x00007fba816584aa in pthread_mutex_lock () at /lib/x86_64-linux-gnu/libc.so.6 #2 0x00007fba819a9e97 in osl_acquireMutex(oslMutex) (pMutex=0x55b3172c4c80) at /home/buildslave/source/libo-core/sal/osl/unx/mutex.cxx:99 nRet = #3 0x00007fba7bd7deed in osl::Mutex::acquire() (this=0x55b3172c35a8) at /home/buildslave/source/libo-core/include/osl/mutex.hxx:63 pInst = 0x55b3172c3470 __PRETTY_FUNCTION__ = "virtual void SvpSalYieldMutex::doAcquire(sal_uInt32)" #4 SvpSalYieldMutex::doAcquire(unsigned int) (this=0x55b3172c35a0, nLockCount=1) at /home/buildslave/source/libo-core/vcl/headless/svpinst.cxx:328 pInst = 0x55b3172c3470 __PRETTY_FUNCTION__ = "virtual void SvpSalYieldMutex::doAcquire(sal_uInt32)" #5 0x00007fba800d988a in comphelper::SolarMutex::acquire(unsigned int) (this=, nLockCount=nLockCount@entry=1) at /home/buildslave/source/libo-core/include/comphelper/solarmutex.hxx:86 __PRETTY_FUNCTION__ = "void comphelper::SolarMutex::acquire(sal_uInt32)" #6 0x00007fba800d98c7 in osl::Guard::Guard(comphelper::SolarMutex&) (t=, this=0x7fba579fc590) at /home/buildslave/source/libo-core/include/osl/mutex.hxx:144 #7 SolarMutexGuard::SolarMutexGuard() (this=) at /home/buildslave/source/libo-core/include/vcl/svapp.hxx:1340 #8 0x00007fba801dad56 in (anonymous namespace)::XFrameImpl::getContainerWindow() (this=0x55b3186ca0b0) at /home/buildslave/source/libo-core/framework/source/services/frame.cxx:839 g = {> = {pT = 0x55b3172c35a0}, } #9 0x00007fba801be310 in framework::LoadEnv::impl_reactForLoadingState() (this=this@entry=0x7fba579fc9e0) at /home/buildslave/source/libo-core/framework/source/loadenv/loadenv.cxx:1595 xWindow = uno::Reference to (com::sun::star::uno::XInterface *) 0x7fba3f800000 bHidden = bMinimized = pFrameName = {, true>> = {_M_cur = 0x1d}, } aReadLock = {pT = 0x7fba579fc9e0} aRequest = bThrow = #10 0x00007fba801be8b9 in framework::LoadEnv::impl_setResult(bool) (this=this@entry=0x7fba579fc9e0, bResult=) at /home/buildslave/source/libo-core/framework/source/loadenv/loadenv.cxx:532 g = {pT = 0x7fba579fc9e0} #11 0x00007fba801c34ef in framework::LoadEnv::impl_loadContent() (this=this@entry=0x7fba579fc9e0) at /home/buildslave/source/libo-core/framework/source/loadenv/loadenv.cxx:1179 xTargetFrameProps = uno::Reference to ((anonymous namespace)::XFrameImpl *) 0x55b3186ca170 bResult = aWriteLock = {pT = 0x7fba579fc9e0} sTarget = "_blank" xTargetFrame = uno::Reference to ((anonymous namespace)::XFrameImpl *) 0x55b3186ca120 xTargetLock = uno::Reference to ((anonymous namespace)::XFrameImpl *) 0x55b3186ca148 bHidden = bMinimized = false bPreview = lDescriptor = uno::Sequence of length 12 = {{Name = "URL", Handle = 0, Value = uno::Any("string": "file:///srv/crashtestdata/current/srv/crashtestdata/files/caolan/swfootnoteframe_unlockbackmove_heap_use_after_free.docx"), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "UCBContent", Handle = 0, Value = uno::Any("com.sun.star.ucb.XContent": { = {_vptr.XInterface = 0x55b31879bd78}, }), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "UpdateDocMode", Handle = 0, Value = uno::Any("short": 0), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "InteractionHandler", Handle = 0, Value = uno::Any("com.sun.star.task.XInteractionHandler": { = {_vptr.XInterface = 0x7fba503f29e8}, }), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "Hidden", Handle = 0, Value = uno::Any("boolean": 1 '\001'), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "AuthenticationHandler", Handle = 0, Value = uno::Any("com.sun.star.task.XInteractionHandler": { = {_vptr.XInterface = 0x7fba503f29e8}, }), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "InputStream", Handle = 0, Value = uno::Any("com.sun.star.io.XInputStream": { = {_vptr.XInterface = 0x7fba501dce28}, }), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "TypeName", Handle = 0, Value = uno::Any("string": "writer_OOXML"), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "AbortOnLoadFailure", Handle = 0, Value = uno::Any("boolean": 1 '\001'), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "ReadOnly", Handle = 0, Value = uno::Any("boolean": 1 '\001'), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "MacroExecutionMode", Handle = 0, Value = uno::Any("short": 0), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "FilterName", Handle = 0, Value = uno::Any("string": "Office Open XML Text"), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}} sURL = "file:///srv/crashtestdata/current/srv/crashtestdata/files/caolan/swfootnoteframe_unlockbackmove_heap_use_after_free.docx" xLoader = uno::Reference to ((anonymous namespace)::SfxFrameLoader_Impl *) 0x7fba50779290 xAsyncLoader = empty uno::Reference xSyncLoader = uno::Reference to ((anonymous namespace)::SfxFrameLoader_Impl *) 0x7fba507792b8 #12 0x00007fba801c37ca in framework::LoadEnv::start() (this=this@entry=0x7fba579fc9e0) at /home/buildslave/source/libo-core/framework/source/loadenv/loadenv.cxx:412 bStarted = #13 0x00007fba801c3ebb in framework::LoadEnv::startLoading(rtl::OUString const&, com::sun::star::uno::Sequence const&, com::sun::star::uno::Reference const&, rtl::OUString const&, int, LoadEnvFeatures) (this=this@entry=0x7fba579fc9e0, sURL="file:///srv/crashtestdata/current/srv/crashtestdata/files/caolan/swfootnoteframe_unlockbackmove_heap_use_after_free.docx", lMediaDescriptor=uno::Sequence of length 3 = {...}, xBaseFrame=uno::Reference to (framework::Desktop *) 0x55b317572938, sTarget="_blank", nSearchFlags=nSearchFlags@entry=0, eFeature=LoadEnvFeatures::NONE) at /home/buildslave/source/libo-core/framework/source/loadenv/loadenv.cxx:308 g = {pT = 0x7fba579fc9e0} aRealURL = "file:///srv/crashtestdata/current/srv/crashtestdata/files/caolan/swfootnoteframe_unlockbackmove_heap_use_after_free.docx" xParser = uno::Reference to ((anonymous namespace)::URLTransformer *) 0x7fba50986278 pIt = {, true>> = {_M_cur = 0x0}, } bUIMode = false #14 0x00007fba801c40c4 in framework::LoadEnv::loadComponentFromURL(com::sun::star::uno::Reference const&, com::sun::star::uno::Reference const&, rtl::OUString const&, rtl::OUString const&, int, com::sun::star::uno::Sequence const&) (xLoader=uno::Reference to (framework::Desktop *) 0x55b317572948, xContext=uno::Reference to (cppu::(anonymous namespace)::ComponentContext *) 0x55b3172c1148, sURL="file:///srv/crashtestdata/current/srv/crashtestdata/files/caolan/swfootnoteframe_unlockbackmove_heap_use_after_free.docx", sTarget="_blank", nSearchFlags=0, lArgs=uno::Sequence of length 3 = {...}) at /home/buildslave/source/libo-core/framework/source/loadenv/loadenv.cxx:168 aEnv = Python Exception : No type named std::__detail::_Hash_node, true>. {m_mutex = {mutex = 0x7fba50095850}, m_xContext = uno::Reference to (class cppu::(anonymous namespace)::ComponentContext *) 0x55b3172c1148, m_xBaseFrame = uno::Reference to (class framework::Desktop *) 0x55b317572938, m_xTargetFrame = uno::Reference to (class (anonymous namespace)::XFrameImpl *) 0x55b3186ca120, m_sTarget = "_blank", m_nSearchFlags = 0, m_lMediaDescriptor = { = {m_aMap = std::__debug::unordered_map with 12 elements}, static PROP_ABORTED = {pData = 0x7fba803cf270