[New LWP 3384497] [New LWP 3385206] [New LWP 3385202] [New LWP 3384708] [New LWP 3384706] [New LWP 3429504] [New LWP 3386299] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `/home/buildslave/build/instdir/program/soffice.bin -env:UserInstallation=file:/'. Program terminated with signal SIGABRT, Aborted. #0 0x00007efeb3833ebc in ?? () from /lib/x86_64-linux-gnu/libc.so.6 [Current thread is 1 (Thread 0x7efeae8e3e00 (LWP 3384497))] Thread 7 (Thread 0x7efe88bff6c0 (LWP 3386299)): #0 0x00007efeb382ef16 in () at /lib/x86_64-linux-gnu/libc.so.6 #1 0x00007efeb38315d8 in pthread_cond_wait () at /lib/x86_64-linux-gnu/libc.so.6 #2 0x00007efeb36235cc in std::condition_variable::wait >(std::unique_lock &, struct {...}) (this=this@entry=0x7efeb3627288 <(anonymous namespace)::getTimerManager()::aManager+72>, __lock=..., __p=__p@entry=...) at /usr/include/c++/12/condition_variable:102 #3 0x00007efeb3623ee7 in salhelper::TimerManager::run() (this=0x7efeb3627240 <(anonymous namespace)::getTimerManager()::aManager>) at /home/buildslave/source/libo-core/salhelper/source/timer.cxx:380 a_Guard = {_M_device = 0x7efeb3627260 <(anonymous namespace)::getTimerManager()::aManager+32>, _M_owns = true} #4 0x00007efeb36233c9 in osl::threadFunc(void*) (param=0x7efeb3627240 <(anonymous namespace)::getTimerManager()::aManager>) at /home/buildslave/source/libo-core/include/osl/thread.hxx:189 pObj = 0x7efeb3627240 <(anonymous namespace)::getTimerManager()::aManager> #5 0x00007efeb3ba941d in osl_thread_start_Impl(void*) (pData=0x7efe8055b370) at /home/buildslave/source/libo-core/sal/osl/unx/thread.cxx:237 terminate = false pImpl = 0x7efe8055b370 __PRETTY_FUNCTION__ = "void* osl_thread_start_Impl(void*)" #6 0x00007efeb38321c4 in () at /lib/x86_64-linux-gnu/libc.so.6 #7 0x00007efeb38b285c in () at /lib/x86_64-linux-gnu/libc.so.6 Thread 6 (Thread 0x7efe9db186c0 (LWP 3429504)): #0 0x00007efeb382f12b in () at /lib/x86_64-linux-gnu/libc.so.6 #1 0x00007efeb38354aa in pthread_mutex_lock () at /lib/x86_64-linux-gnu/libc.so.6 #2 0x00007efeb3b96c53 in osl_acquireMutex(oslMutex) (pMutex=0x55635edf1210) at /home/buildslave/source/libo-core/sal/osl/unx/mutex.cxx:99 nRet = #3 0x00007efeade47fc3 in osl::Mutex::acquire() (this=0x55635edf1518) at /home/buildslave/source/libo-core/include/osl/mutex.hxx:63 pInst = 0x55635edf13e0 __PRETTY_FUNCTION__ = "virtual void SvpSalYieldMutex::doAcquire(sal_uInt32)" #4 SvpSalYieldMutex::doAcquire(unsigned int) (this=0x55635edf1510, nLockCount=1) at /home/buildslave/source/libo-core/vcl/headless/svpinst.cxx:368 pInst = 0x55635edf13e0 __PRETTY_FUNCTION__ = "virtual void SvpSalYieldMutex::doAcquire(sal_uInt32)" #5 0x00007efeb231f2fa in comphelper::SolarMutex::acquire(unsigned int) (this=, nLockCount=nLockCount@entry=1) at /home/buildslave/source/libo-core/include/comphelper/solarmutex.hxx:86 __PRETTY_FUNCTION__ = "void comphelper::SolarMutex::acquire(sal_uInt32)" #6 0x00007efeb231f337 in osl::Guard::Guard(comphelper::SolarMutex&) (t=, this=0x7efe9db15520) at /home/buildslave/source/libo-core/include/osl/mutex.hxx:144 #7 SolarMutexGuard::SolarMutexGuard() (this=) at /home/buildslave/source/libo-core/include/vcl/svapp.hxx:1342 #8 0x00007efeb2423442 in (anonymous namespace)::XFrameImpl::removeActionLock() (this=0x7efe86fa07c0) at /home/buildslave/source/libo-core/framework/source/services/frame.cxx:2690 g = {> = {pT = 0x55635edf1510}, } #9 0x00007efeb240dc49 in framework::ActionLockGuard::freeResource() (this=this@entry=0x7efe9db15ae8) at /home/buildslave/source/libo-core/framework/source/inc/loadenv/actionlockguard.hxx:122 aMutexLock = {_M_device = 0x7efe9db15ae8, _M_owns = false} xLock = uno::Reference to ((anonymous namespace)::XFrameImpl *) 0x7efe86fa0858 bLocked = true #10 0x00007efeb240668b in framework::LoadEnv::impl_reactForLoadingState() (this=this@entry=0x7efe9db159e0) at /home/buildslave/source/libo-core/framework/source/loadenv/loadenv.cxx:1679 aReadLock = {pT = 0x7efe9db159e0} aRequest = Python Exception : bThrow = #11 0x00007efeb2406a87 in framework::LoadEnv::impl_setResult(bool) (this=this@entry=0x7efe9db159e0, bResult=) at /home/buildslave/source/libo-core/framework/source/loadenv/loadenv.cxx:535 g = {pT = 0x7efe9db159e0} #12 0x00007efeb240b6c2 in framework::LoadEnv::impl_loadContent() (this=this@entry=0x7efe9db159e0) at /home/buildslave/source/libo-core/framework/source/loadenv/loadenv.cxx:1183 xTargetFrameProps = uno::Reference to ((anonymous namespace)::XFrameImpl *) 0x7efe86fa0880 bResult = aWriteLock = {pT = 0x7efe9db159e0} sTarget = "_blank" xTargetFrame = uno::Reference to ((anonymous namespace)::XFrameImpl *) 0x7efe86fa0830 xTargetLock = uno::Reference to ((anonymous namespace)::XFrameImpl *) 0x7efe86fa0858 bHidden = bMinimized = false bPreview = false bStartPres = lDescriptor = uno::Sequence of length 12 = {{Name = "URL", Handle = 0, Value = uno::Any("string": "file:///srv/crashtestdata/current/srv/crashtestdata/files/caolan/swtextfly_drawtextopaque_heap_buffer_overflow.docx"), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "UCBContent", Handle = 0, Value = uno::Any("com.sun.star.ucb.XContent": { = {_vptr.XInterface = 0x7efe6462a778}, }), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "UpdateDocMode", Handle = 0, Value = uno::Any("short": 0), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "InteractionHandler", Handle = 0, Value = uno::Any("com.sun.star.task.XInteractionHandler": { = {_vptr.XInterface = 0x7efe90014de8}, }), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "Hidden", Handle = 0, Value = uno::Any("boolean": 1 '\001'), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "AuthenticationHandler", Handle = 0, Value = uno::Any("com.sun.star.task.XInteractionHandler": { = {_vptr.XInterface = 0x7efe90014de8}, }), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "InputStream", Handle = 0, Value = uno::Any("com.sun.star.io.XInputStream": { = {_vptr.XInterface = 0x7efe876041d8}, }), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "TypeName", Handle = 0, Value = uno::Any("string": "writer_MS_Word_2007"), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "AbortOnLoadFailure", Handle = 0, Value = uno::Any("boolean": 1 '\001'), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "ReadOnly", Handle = 0, Value = uno::Any("boolean": 1 '\001'), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "MacroExecutionMode", Handle = 0, Value = uno::Any("short": 0), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}, {Name = "FilterName", Handle = 0, Value = uno::Any("string": "MS Word 2007 XML"), State = com::sun::star::beans::PropertyState::PropertyState_DIRECT_VALUE}} sURL = "file:///srv/crashtestdata/current/srv/crashtestdata/files/caolan/swtextfly_drawtextopaque_heap_buffer_overflow.docx" xLoader = uno::Reference to ((anonymous namespace)::SfxFrameLoader_Impl *) 0x7efe643d1a10 xAsyncLoader = empty uno::Reference xSyncLoader = uno::Reference to ((anonymous namespace)::SfxFrameLoader_Impl *) 0x7efe643d1a38 #13 0x00007efeb240b99e in framework::LoadEnv::start() (this=this@entry=0x7efe9db159e0) at /home/buildslave/source/libo-core/framework/source/loadenv/loadenv.cxx:415 bStarted = #14 0x00007efeb240c0a7 in framework::LoadEnv::startLoading(rtl::OUString const&, com::sun::star::uno::Sequence const&, com::sun::star::uno::Reference const&, rtl::OUString const&, int, LoadEnvFeatures) (this=this@entry=0x7efe9db159e0, sURL="file:///srv/crashtestdata/current/srv/crashtestdata/files/caolan/swtextfly_drawtextopaque_heap_buffer_overflow.docx", lMediaDescriptor=uno::Sequence of length 3 = {...}, xBaseFrame=uno::Reference to (framework::Desktop *) 0x55635f0b1d98, sTarget="_blank", nSearchFlags=nSearchFlags@entry=0, eFeature=LoadEnvFeatures::NONE) at /home/buildslave/source/libo-core/framework/source/loadenv/loadenv.cxx:311 g = {pT = 0x7efe9db159e0} aRealURL = "file:///srv/crashtestdata/current/srv/crashtestdata/files/caolan/swtextfly_drawtextopaque_heap_buffer_overflow.docx" xParser = uno::Reference to ((anonymous namespace)::URLTransformer *) 0x7efe64562048 pIt = {, true>> = {_M_cur = 0x0}, } bUIMode = false #15 0x00007efeb240c2f1 in framework::LoadEnv::loadComponentFromURL(com::sun::star::uno::Reference const&, com::sun::star::uno::Reference const&, rtl::OUString const&, rtl::OUString const&, int, com::sun::star::uno::Sequence const&) (xLoader=uno::Reference to (framework::Desktop *) 0x55635f0b1da8, xContext=uno::Reference to (cppu::(anonymous namespace)::ComponentContext *) 0x55635ededf48, sURL="file:///srv/crashtestdata/current/srv/crashtestdata/files/caolan/swtextfly_drawtextopaque_heap_buffer_overflow.docx", sTarget="_blank", nSearchFlags=0, lArgs=uno::Sequence of length 3 = {...}) at /home/buildslave/source/libo-core/framework/source/loadenv/loadenv.cxx:167 aEnv = Python Exception : No type named std::__detail::_Hash_node, true>. {m_mutex = {mutex = 0x7efe87ca5bb0}, m_xContext = uno::Reference to (class cppu::(anonymous namespace)::ComponentContext *) 0x55635ededf48, m_xBaseFrame = uno::Reference to (class framework::Desktop *) 0x55635f0b1d98, m_xTargetFrame = uno::Reference to (class (anonymous namespace)::XFrameImpl *) 0x7efe86fa0830, m_sTarget = "_blank", m_nSearchFlags = 0, m_lMediaDescriptor = { = {m_aMap = std::__debug::unordered_map with 12 elements}, static PROP_ABORTED = {pData = 0x7efeb261c8f0