Bug 59134

Summary: SIGSEGV upon concurrent SwXTextDocument::close and SwXTextCursor::release
Product: LibreOffice Reporter: Stephan Bergmann <sbergman>
Component: WriterAssignee: Not Assigned <libreoffice-bugs>
Status: NEW --- QA Contact:
Severity: normal    
Priority: medium CC: mst.fdo
Version: 4.1.0.0.alpha0+ Master   
Hardware: Other   
OS: All   
Whiteboard:
i915 platform: i915 features:

Description Stephan Bergmann 2013-01-08 14:05:22 UTC 
With a current Linux master build, sw_unoapi at least once crashed for me with

> Thread 1 (Thread 0x2b7620401700 (LWP 14419)):
> #0  x86_64_fallback_frame_state (fs=0x2b76203fc540, context=<optimized out>) at ./md-unwind-support.h:53
> #1  uw_frame_state_for (context=context@entry=0x2b76203fc450, fs=fs@entry=0x2b76203fc540) at ../../../libgcc/unwind-dw2.c:1187
> #2  0x0000003d8de0ff1c in _Unwind_Backtrace (trace=0x3d8bb05900 <backtrace_helper>, trace_argument=0x2b76203fc700) at ../../../libgcc/unwind.inc:290
> #3  0x0000003d8bb05a96 in __GI___backtrace (array=<optimized out>, size=256) at ../sysdeps/ia64/backtrace.c:110
> #4  0x00002b75f7a51a7d in PrintStack (sig=6) at lo/core/sal/osl/unx/signal.c:829
> #5  0x00002b75f7a51cb7 in CallSystemHandler (Signal=6) at lo/core/sal/osl/unx/signal.c:895
> #6  0x00002b75f7a51f0c in SignalHandlerFunction (Signal=6) at lo/core/sal/osl/unx/signal.c:992
> #7  <signal handler called>
> #8  0x0000003d8ba35935 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
> #9  0x0000003d8ba370e8 in __GI_abort () at abort.c:91
> #10 0x00002b75fc341ff3 in SalAbort (rErrorText="", bDumpCore=true) at lo/core/vcl/unx/generic/plugadapt/salplug.cxx:282
> #11 0x00002b75fbd01c3d in Application::Abort (rErrorText="") at lo/core/vcl/source/app/svapp.cxx:378
> #12 0x00002b75f7cf6410 in desktop::Desktop::Exception (this=0x7fff6da119d0, nError=768) at lo/core/desktop/source/app/app.cxx:1272
> #13 0x00002b75fbd0d0ec in VCLExceptionSignal_impl (pInfo=0x2b76203fdaa0) at lo/core/vcl/source/app/svmain.cxx:132
> #14 0x00002b75f7a51b32 in CallSignalHandler (pInfo=0x2b76203fdaa0) at lo/core/sal/osl/unx/signal.c:854
> #15 0x00002b75f7a51ef1 in SignalHandlerFunction (Signal=6) at lo/core/sal/osl/unx/signal.c:989
> #16 <signal handler called>
> #17 0x0000003d8ba35935 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
> #18 0x0000003d8ba370e8 in __GI_abort () at abort.c:91
> #19 0x00002b7638700bd9 in ?? () from /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.9.x86_64/jre/lib/amd64/server/libjvm.so
> #20 0x00002b763885c1b2 in ?? () from /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.9.x86_64/jre/lib/amd64/server/libjvm.so
> #21 0x00002b763885cbf0 in ?? () from /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.9.x86_64/jre/lib/amd64/server/libjvm.so
> #22 <signal handler called>
> #23 0x00002b763333f305 in ?? ()
> #24 0x00002b7638700bb0 in ?? () from /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.9.x86_64/jre/lib/amd64/server/libjvm.so
> #25 0x00002b763885c51f in ?? () from /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.9.x86_64/jre/lib/amd64/server/libjvm.so
> #26 0x00002b7638707f4f in JVM_handle_linux_signal () from /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.9.x86_64/jre/lib/amd64/server/libjvm.so
> #27 <signal handler called>
> #28 0x00002b762fb22479 in SvxShape::HasSdrObjectOwnership (this=0x2aaab138cab8) at lo/core/svx/source/unodraw/unoshape.cxx:270
> #29 0x00002b762f9761d0 in SdrObject::Free (_rpObject=@0x2b76203ff128: 0x0) at lo/core/svx/source/svdraw/svdobj.cxx:509
> #30 0x00002b762cca1d82 in SwDrawContact::~SwDrawContact (this=0x2b762869e0d0, __in_chrg=<optimized out>) at lo/core/sw/source/core/draw/dcontact.cxx:678
> #31 0x00002b762cca1e38 in SwDrawContact::~SwDrawContact (this=0x2b762869e0d0, __in_chrg=<optimized out>) at lo/core/sw/source/core/draw/dcontact.cxx:680
> #32 0x00002b762cd988f5 in SwDrawFrmFmt::~SwDrawFrmFmt (this=0x2aaab1823160, __in_chrg=<optimized out>) at lo/core/sw/source/core/layout/atrfrm.cxx:3156
> #33 0x00002b762cd98982 in SwDrawFrmFmt::~SwDrawFrmFmt (this=0x2aaab1823160, __in_chrg=<optimized out>) at lo/core/sw/source/core/layout/atrfrm.cxx:3157
> #34 0x00002b762cafda06 in SwDoc::DelFrmFmt (this=0x2b76281374a0, pFmt=0x2aaab1823160, bBroadcast=false) at lo/core/sw/source/core/doc/docfmt.cxx:1341
> #35 0x00002b762cb211ea in SwDoc::DelLayoutFmt (this=0x2b76281374a0, pFmt=0x2aaab1823160) at lo/core/sw/source/core/doc/doclay.cxx:336
> #36 0x00002b762d008007 in SwTxtNode::DestroyAttr (this=0x2aaab0a581e0, pAttr=0x2b76286a8e00) at lo/core/sw/source/core/txtnode/thints.cxx:1101
> #37 0x00002b762cfe8867 in SwTxtNode::~SwTxtNode (this=0x2aaab0a581e0, __in_chrg=<optimized out>) at lo/core/sw/source/core/txtnode/ndtxt.cxx:248
> #38 0x00002b762cfe8a30 in SwTxtNode::~SwTxtNode (this=0x2aaab0a581e0, __in_chrg=<optimized out>) at lo/core/sw/source/core/txtnode/ndtxt.cxx:262
> #39 0x00002b762cc7e31d in SwNodes::RemoveNode (this=0x2b762858a050, nDelPos=9, nSz=1, bDel=1 '\001') at lo/core/sw/source/core/docnode/nodes.cxx:2399
> #40 0x00002b762cc7b3c9 in SwNodes::DelNodes (this=0x2b762858a050, rStart=SwNodeIndex (node 0), nCnt=11) at lo/core/sw/source/core/docnode/nodes.cxx:1504
> #41 0x00002b762cb307cd in SwDoc::~SwDoc (this=0x2b76281374a0, __in_chrg=<optimized out>) at lo/core/sw/source/core/doc/docnew.cxx:602
> #42 0x00002b762cb31bf4 in SwDoc::~SwDoc (this=0x2b76281374a0, __in_chrg=<optimized out>) at lo/core/sw/source/core/doc/docnew.cxx:697
> #43 0x00002b762d3ae760 in SwDocShell::RemoveLink (this=0x2b7628063320) at lo/core/sw/source/ui/app/docshini.cxx:503
> #44 0x00002b762d3adf0d in SwDocShell::~SwDocShell (this=0x2b7628063320, __in_chrg=<optimized out>, __vtt_parm=<optimized out>) at lo/core/sw/source/ui/app/docshini.cxx:411
> #45 0x00002b762d3ae132 in SwDocShell::~SwDocShell (this=0x2b7628063320, __in_chrg=<optimized out>, __vtt_parm=<optimized out>) at lo/core/sw/source/ui/app/docshini.cxx:419
> #46 0x00002b75fb12c6e0 in SvRefBase::QueryDelete (this=0x2b7628063490) at lo/core/tools/source/ref/ref.cxx:29
> #47 0x00002b75f928d0ff in SvRefBase::ReleaseReference (this=0x2b7628063490) at lo/core/solver/unxlngx6/inc/tools/ref.hxx:188
> #48 0x00002b75f928d20d in SfxObjectShellRef::~SfxObjectShellRef (this=0x2b76281cc178, __in_chrg=<optimized out>) at lo/core/sfx2/inc/sfx2/objsh.hxx:764
> #49 0x00002b75f95a9297 in IMPL_SfxBaseModel_DataContainer::~IMPL_SfxBaseModel_DataContainer (this=0x2b76281cc170, __in_chrg=<optimized out>) at lo/core/sfx2/source/doc/sfxbasemodel.cxx:243
> #50 0x00002b75f95a949a in IMPL_SfxBaseModel_DataContainer::~IMPL_SfxBaseModel_DataContainer (this=0x2b76281cc170, __in_chrg=<optimized out>) at lo/core/sfx2/source/doc/sfxbasemodel.cxx:244
> #51 0x00002b75f958ff3b in SfxBaseModel::dispose (this=0x2aab29b25a58) at lo/core/sfx2/source/doc/sfxbasemodel.cxx:829
> #52 0x00002b762d59ad36 in SwXTextDocument::dispose (this=0x2aab29b25928) at lo/core/sw/source/ui/uno/unotxdoc.cxx:564
> #53 0x00002b75f95933b0 in SfxBaseModel::close (this=0x2aab29b25a58, bDeliverOwnership=1 '\001') at lo/core/sfx2/source/doc/sfxbasemodel.cxx:1452
> #54 0x00002b762d59adf2 in SwXTextDocument::close (this=0x2aab29b25928, bDeliverOwnership=1 '\001') at lo/core/sw/source/ui/uno/unotxdoc.cxx:572
> #55 0x00002b7608e2bda6 in gcc3::callVirtualMethod (pThis=0x2aab29b25b28, nVtableIndex=5, pRegisterReturn=0x0, pReturnTypeRef=0x16d63c0, bSimpleReturn=true, pStack=0x2b7620400210, nStack=0, pGPR=0x2b7620400280, nGPR=2, pFPR=0x2b76204002b0, nFPR=0) at lo/core/bridges/source/cpp_uno/gcc3_linux_x86-64/callvirtualmethod.cxx:119
> #56 0x00002b7608e33788 in cpp_call (pThis=0x2b76286c4cc0, aVtableSlot=..., pReturnTypeRef=0x16d63c0, nParams=1, pParams=0x2b7624004740, pUnoReturn=0x0, pUnoArgs=0x2b76280d3ab0, ppUnoExc=0x2b7620400668) at lo/core/bridges/source/cpp_uno/gcc3_linux_x86-64/uno2cpp.cxx:237
> #57 0x00002b7608e342ec in bridges::cpp_uno::shared::unoInterfaceProxyDispatch (pUnoI=0x2b76286c4cc0, pMemberDescr=0x2b7624004810, pReturn=0x0, pArgs=0x2b76280d3ab0, ppException=0x2b7620400668) at lo/core/bridges/source/cpp_uno/gcc3_linux_x86-64/uno2cpp.cxx:431
> #58 0x00002b761446b157 in binaryurp::IncomingRequest::execute_throw (this=0x2b7624002220, returnValue=0x2b7620400ad0, outArguments=0x2b7620400a40) at lo/core/binaryurp/source/incomingrequest.cxx:245
> #59 0x00002b761446a027 in binaryurp::IncomingRequest::execute (this=0x2b7624002220) at lo/core/binaryurp/source/incomingrequest.cxx:74
> #60 0x00002b761448535d in binaryurp::(anonymous namespace)::request (pThreadSpecificData=0x2b7624002220) at lo/core/binaryurp/source/reader.cxx:87
> #61 0x00002b75f84a81da in cppu_threadpool::JobQueue::enter (this=0x2b762400f4a0, nDisposeId=47786410177056, bReturnWhenNoJob=1 '\001') at lo/core/cppu/source/threadpool/jobqueue.cxx:115
> #62 0x00002b75f84abac5 in cppu_threadpool::ORequestThread::run (this=0x2b762400f220) at lo/core/cppu/source/threadpool/thread.cxx:173
> #63 0x00002b75f84ac2ab in osl::threadFunc (param=0x2b762400f230) at lo/core/solver/unxlngx6/inc/osl/thread.hxx:187
> #64 0x00002b75f7a4ec43 in osl_thread_start_Impl (pData=0x2b76240119e0) at lo/core/sal/osl/unx/thread.c:252
> #65 0x0000003d8be07d14 in start_thread (arg=0x2b7620401700) at pthread_create.c:309
> #66 0x0000003d8baf168d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115

> Thread 23 (Thread 0x2aab28854700 (LWP 14425)):
> #0  __lll_lock_wait () at ../nptl/sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:136
> #1  0x0000003d8be09c71 in _L_lock_889 () from /lib64/libpthread.so.0
> #2  0x0000003d8be09b8a in __pthread_mutex_lock (mutex=0x16d4150) at pthread_mutex_lock.c:86
> #3  0x00002b75f7a4413e in osl_acquireMutex (Mutex=0x16d4150) at lo/core/sal/osl/unx/mutex.c:114
> #4  0x00002b75fbd00bc6 in vcl::SolarMutexObject::acquire (this=0x16d4120) at lo/core/vcl/source/app/solarmutex.cxx:35
> #5  0x00002b75fc28c4e0 in SalYieldMutex::acquire (this=0x16d4120) at lo/core/vcl/generic/app/geninst.cxx:49
> #6  0x00002b762c926ec6 in SolarMutexGuard::SolarMutexGuard (this=0x2aab28852eb0) at lo/core/solver/unxlngx6/inc/vcl/svapp.hxx:434
> #7  0x00002b762d141d9f in sw::UnoImplPtr<SwXTextCursor::Impl>::~UnoImplPtr (this=0x2b76163a9bf0, __in_chrg=<optimized out>) at lo/core/sw/inc/unobaseclass.hxx:111
> #8  0x00002b762d1361e5 in SwXTextCursor::~SwXTextCursor (this=0x2b76163a9b58, __in_chrg=<optimized out>) at lo/core/sw/source/core/unocore/unoobj.cxx:824
> #9  0x00002b762d136268 in SwXTextCursor::~SwXTextCursor (this=0x2b76163a9b58, __in_chrg=<optimized out>) at lo/core/sw/source/core/unocore/unoobj.cxx:826
> #10 0x00002b75f87fd17b in cppu::OWeakObject::release (this=0x2b76163a9b58) at lo/core/cppuhelper/source/weak.cxx:204
> #11 0x00002b762d1426f6 in cppu::WeakImplHelper12<com::sun::star::lang::XServiceInfo, com::sun::star::beans::XPropertySet, com::sun::star::beans::XPropertyState, com::sun::star::beans::XMultiPropertyStates, com::sun::star::container::XEnumerationAccess, com::sun::star::container::XContentEnumerationAccess, com::sun::star::util::XSortable, com::sun::star::document::XDocumentInsertable, com::sun::star::text::XSentenceCursor, com::sun::star::text::XWordCursor, com::sun::star::text::XParagraphCursor, com::sun::star::text::XRedline>::release (this=0x2b76163a9b58) at lo/core/solver/unxlngx6/inc/cppuhelper/implbase12.hxx:117
> #12 0x00002b762d14042a in SwXTextCursor::release (this=0x2b76163a9b58) at lo/core/sw/source/core/unocore/unoobj.cxx:2937
> #13 0x00002b7608e35f58 in bridges::cpp_uno::shared::freeUnoInterfaceProxy (pEnv=0x2b76180009e0, pProxy=0x2b76284c7950) at lo/core/bridges/source/cpp_uno/shared/unointerfaceproxy.cxx:43
> #14 0x00002b75f84dde10 in (anonymous namespace)::s_stub_defenv_revokeInterface (pParam=0x2aab288531b8) at lo/core/cppu/source/uno/lbenv.cxx:391
> #15 0x00002b75f84d9896 in s_environment_invoke_v (pCurrEnv=0x0, pTargetEnv=0x2b76180009e0, pCallee=0x2b75f84ddabc <(anonymous namespace)::s_stub_defenv_revokeInterface(va_list*)>, pParam=0x2aab288531b8) at lo/core/cppu/source/uno/EnvStack.cxx:287
> #16 0x00002b75f84d993f in uno_Environment_invoke_v (pTargetEnv=0x2b76180009e0, pCallee=0x2b75f84ddabc <(anonymous namespace)::s_stub_defenv_revokeInterface(va_list*)>, pParam=0x2aab288531b8) at lo/core/cppu/source/uno/EnvStack.cxx:306
> #17 0x00002b75f84d99ff in uno_Environment_invoke (pEnv=0x2b76180009e0, pCallee=0x2b75f84ddabc <(anonymous namespace)::s_stub_defenv_revokeInterface(va_list*)>) at lo/core/cppu/source/uno/EnvStack.cxx:315
> #18 0x00002b75f84de1b8 in (anonymous namespace)::defenv_revokeInterface (pEnv=0x2b76180009e0, pInterface=0x2aab30001850) at lo/core/cppu/source/uno/lbenv.cxx:447
> #19 0x00002b7608e3607e in bridges::cpp_uno::shared::releaseProxy (pUnoI=0x2aab30001850) at lo/core/bridges/source/cpp_uno/shared/unointerfaceproxy.cxx:85
> #20 0x00002b7614453be1 in com::sun::star::uno::UnoInterfaceReference::~UnoInterfaceReference (this=0x2aab288533a0, __in_chrg=<optimized out>) at lo/core/solver/unxlngx6/inc/uno/dispatcher.hxx:88
> #21 0x00002b761444e34b in binaryurp::Bridge::releaseStub (this=0x2b760a231670, oid="2b76163a9b58;gcc3[0];f0a89e755a4744f384aad9519f25ba26", type=...) at lo/core/binaryurp/source/bridge.cxx:525
> #22 0x00002b761446a8a7 in binaryurp::IncomingRequest::execute_throw (this=0x2b7624017c10, returnValue=0x2aab28853ad0, outArguments=0x2aab28853a40) at lo/core/binaryurp/source/incomingrequest.cxx:139
> #23 0x00002b761446a027 in binaryurp::IncomingRequest::execute (this=0x2b7624017c10) at lo/core/binaryurp/source/incomingrequest.cxx:74
> #24 0x00002b761448535d in binaryurp::(anonymous namespace)::request (pThreadSpecificData=0x2b7624017c10) at lo/core/binaryurp/source/reader.cxx:87
> #25 0x00002b75f84a81da in cppu_threadpool::JobQueue::enter (this=0x2b7624011a60, nDisposeId=47786410186816, bReturnWhenNoJob=1 '\001') at lo/core/cppu/source/threadpool/jobqueue.cxx:115
> #26 0x00002b75f84abac5 in cppu_threadpool::ORequestThread::run (this=0x2b7624011840) at lo/core/cppu/source/threadpool/thread.cxx:173
> #27 0x00002b75f84ac2ab in osl::threadFunc (param=0x2b7624011850) at lo/core/solver/unxlngx6/inc/osl/thread.hxx:187
> #28 0x00002b75f7a4ec43 in osl_thread_start_Impl (pData=0x2b762400c9f0) at lo/core/sal/osl/unx/thread.c:252
> #29 0x0000003d8be07d14 in start_thread (arg=0x2aab28854700) at pthread_create.c:309
> #30 0x0000003d8baf168d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115
Comment 1 Stephan Bergmann 2013-01-28 12:15:40 UTC 
A similar SIGSEGV crash now happened to me in sw_unoapi on current Linux master with the below (relevant subset of) threads:

> Thread 14 (Thread 0x2aaab2299700 (LWP 4625)):
> #0  __lll_lock_wait () at ../nptl/sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:135
> #1  0x0000003c80a09cc1 in _L_lock_885 () from /lib64/libpthread.so.0
> #2  0x0000003c80a09bda in __GI___pthread_mutex_lock (mutex=0x15e51f0) at pthread_mutex_lock.c:85
> #3  0x00002aac2d62818e in osl_acquireMutex (Mutex=0x15e51f0) at lo/core/sal/osl/unx/mutex.c:114
> #4  0x00002aac3195ae2e in vcl::SolarMutexObject::acquire (this=0x15e51c0) at lo/core/vcl/source/app/solarmutex.cxx:35
> #5  0x00002aac31ef8390 in SalYieldMutex::acquire (this=0x15e51c0) at lo/core/vcl/generic/app/geninst.cxx:49
> #6  0x00002aac6492b866 in SolarMutexGuard::SolarMutexGuard (this=0x2aaab2297ef0) at lo/core/solver/unxlngx6/inc/vcl/svapp.hxx:435
> #7  0x00002aac651536f1 in sw::UnoImplPtr<SwXTextCursor::Impl>::~UnoImplPtr (this=0x2aac4e3e42e0, __in_chrg=<optimized out>) at lo/core/sw/inc/unobaseclass.hxx:111
> #8  0x00002aac65147727 in SwXTextCursor::~SwXTextCursor (this=0x2aac4e3e4248, __in_chrg=<optimized out>) at lo/core/sw/source/core/unocore/unoobj.cxx:828
> #9  0x00002aac651477aa in SwXTextCursor::~SwXTextCursor (this=0x2aac4e3e4248, __in_chrg=<optimized out>) at lo/core/sw/source/core/unocore/unoobj.cxx:830
> #10 0x00002aac2e40578b in cppu::OWeakObject::release (this=0x2aac4e3e4248) at lo/core/cppuhelper/source/weak.cxx:204
> #11 0x00002aac6515456a in cppu::WeakImplHelper12<com::sun::star::lang::XServiceInfo, com::sun::star::beans::XPropertySet, com::sun::star::beans::XPropertyState, com::sun::star::beans::XMultiPropertyStates, com::sun::star::container::XEnumerationAccess, com::sun::star::container::XContentEnumerationAccess, com::sun::star::util::XSortable, com::sun::star::document::XDocumentInsertable, com::sun::star::text::XSentenceCursor, com::sun::star::text::XWordCursor, com::sun::star::text::XParagraphCursor, com::sun::star::text::XRedline>::release (this=0x2aac4e3e4248) at lo/core/solver/unxlngx6/inc/cppuhelper/implbase12.hxx:117
> #12 0x00002aac65151d3a in SwXTextCursor::release (this=0x2aac4e3e4248) at lo/core/sw/source/core/unocore/unoobj.cxx:2988
> #13 0x00002aac3eaa3fa8 in bridges::cpp_uno::shared::freeUnoInterfaceProxy (pEnv=0x2aac500009e0, pProxy=0x2aac60740af0) at lo/core/bridges/source/cpp_uno/shared/unointerfaceproxy.cxx:43
> #14 0x00002aac2e0ca05c in (anonymous namespace)::s_stub_defenv_revokeInterface (pParam=0x2aaab22981f8) at lo/core/cppu/source/uno/lbenv.cxx:391
> #15 0x00002aac2e0c5ae2 in s_environment_invoke_v (pCurrEnv=0x0, pTargetEnv=0x2aac500009e0, pCallee=0x2aac2e0c9d08 <(anonymous namespace)::s_stub_defenv_revokeInterface(va_list*)>, pParam=0x2aaab22981f8) at lo/core/cppu/source/uno/EnvStack.cxx:287
> #16 0x00002aac2e0c5b8b in uno_Environment_invoke_v (pTargetEnv=0x2aac500009e0, pCallee=0x2aac2e0c9d08 <(anonymous namespace)::s_stub_defenv_revokeInterface(va_list*)>, pParam=0x2aaab22981f8) at lo/core/cppu/source/uno/EnvStack.cxx:306
> #17 0x00002aac2e0c5c4b in uno_Environment_invoke (pEnv=0x2aac500009e0, pCallee=0x2aac2e0c9d08 <(anonymous namespace)::s_stub_defenv_revokeInterface(va_list*)>) at lo/core/cppu/source/uno/EnvStack.cxx:315
> #18 0x00002aac2e0ca404 in (anonymous namespace)::defenv_revokeInterface (pEnv=0x2aac500009e0, pInterface=0x2aab30093690) at lo/core/cppu/source/uno/lbenv.cxx:447
> #19 0x00002aac3eaa40ce in bridges::cpp_uno::shared::releaseProxy (pUnoI=0x2aab30093690) at lo/core/bridges/source/cpp_uno/shared/unointerfaceproxy.cxx:85
> #20 0x00002aac4c456c31 in com::sun::star::uno::UnoInterfaceReference::~UnoInterfaceReference (this=0x2aaab22983e0, __in_chrg=<optimized out>) at lo/core/solver/unxlngx6/inc/uno/dispatcher.hxx:88
> #21 0x00002aac4c45139b in binaryurp::Bridge::releaseStub (this=0x2aac3feb5670, oid="2aac4e3e4248;gcc3[0];7252421390fa443eaf9b864a0ffba99", type=...) at lo/core/binaryurp/source/bridge.cxx:525
> #22 0x00002aac4c46d8a3 in binaryurp::IncomingRequest::execute_throw (this=0x2aac5c01e650, returnValue=0x2aaab2298b10, outArguments=0x2aaab2298a80) at lo/core/binaryurp/source/incomingrequest.cxx:139
> #23 0x00002aac4c46d023 in binaryurp::IncomingRequest::execute (this=0x2aac5c01e650) at lo/core/binaryurp/source/incomingrequest.cxx:74
> #24 0x00002aac4c488359 in binaryurp::(anonymous namespace)::request (pThreadSpecificData=0x2aac5c01e650) at lo/core/binaryurp/source/reader.cxx:87
> #25 0x00002aac2e09422a in cppu_threadpool::JobQueue::enter (this=0x2aac5c0112b0, nDisposeId=46919766307904, bReturnWhenNoJob=1 '\001') at lo/core/cppu/source/threadpool/jobqueue.cxx:115
> #26 0x00002aac2e097b15 in cppu_threadpool::ORequestThread::run (this=0x2aac5c00f440) at lo/core/cppu/source/threadpool/thread.cxx:173
> #27 0x00002aac2e0982fb in osl::threadFunc (param=0x2aac5c00f450) at lo/core/solver/unxlngx6/inc/osl/thread.hxx:187
> #28 0x00002aac2d632c2b in osl_thread_start_Impl (pData=0x2aac5c00fc70) at lo/core/sal/osl/unx/thread.c:252
> #29 0x0000003c80a07d15 in start_thread (arg=0x2aaab2299700) at pthread_create.c:308
> #30 0x0000003c806f246d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:114

> Thread 6 (Thread 0x2aac37e33f40 (LWP 32488)):
> #0  __lll_lock_wait () at ../nptl/sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:135
> #1  0x0000003c80a09cc1 in _L_lock_885 () from /lib64/libpthread.so.0
> #2  0x0000003c80a09bda in __GI___pthread_mutex_lock (mutex=0x15e51f0) at pthread_mutex_lock.c:85
> #3  0x00002aac2d62818e in osl_acquireMutex (Mutex=0x15e51f0) at lo/core/sal/osl/unx/mutex.c:114
> #4  0x00002aac3195ae2e in vcl::SolarMutexObject::acquire (this=0x15e51c0) at lo/core/vcl/source/app/solarmutex.cxx:35
> #5  0x00002aac31ef8390 in SalYieldMutex::acquire (this=0x15e51c0) at lo/core/vcl/generic/app/geninst.cxx:49
> #6  0x00002aac31ef8577 in SalGenericInstance::AcquireYieldMutex (this=0x15e5220, nCount=1) at lo/core/vcl/generic/app/geninst.cxx:108
> #7  0x00002aac3e47a366 in SvpSalInstance::DoReleaseYield (this=0x15e5220, nTimeoutMS=16) at lo/core/vcl/headless/svpinst.cxx:318
> #8  0x00002aac3e47a240 in SvpSalInstance::Yield (this=0x15e5220, bWait=true, bHandleAllCurrentEvents=false) at lo/core/vcl/headless/svpinst.cxx:300
> #9  0x00002aac3195fc8e in ImplYield (i_bWait=true, i_bAllEvents=false) at lo/core/vcl/source/app/svapp.cxx:429
> #10 0x00002aac3195c04d in Application::Yield (i_bAllEvents=false) at lo/core/vcl/source/app/svapp.cxx:463
> #11 0x00002aac3195bfee in Application::Execute () at lo/core/vcl/source/app/svapp.cxx:408
> #12 0x00002aac2d8db85e in desktop::Desktop::Main (this=0x7fff81482930) at lo/core/desktop/source/app/app.cxx:1656
> #13 0x00002aac319673e7 in ImplSVMain () at lo/core/vcl/source/app/svmain.cxx:163
> #14 0x00002aac31967514 in SVMain () at lo/core/vcl/source/app/svmain.cxx:200
> #15 0x00002aac2d91de86 in soffice_main () at lo/core/desktop/source/app/sofficemain.cxx:73
> #16 0x0000000000400998 in sal_main () at lo/core/desktop/source/app/main.c:48
> #17 0x0000000000400979 in main (argc=9, argv=0x7fff81482b18) at lo/core/desktop/source/app/main.c:47

> Thread 1 (Thread 0x2aab29fc8700 (LWP 4622)):
> #0  x86_64_fallback_frame_state (context=0x2aab29fc14d0, context=0x2aab29fc14d0, fs=0x2aab29fc15c0) at ./md-unwind-support.h:53
> #1  uw_frame_state_for (context=context@entry=0x2aab29fc14d0, fs=fs@entry=0x2aab29fc15c0) at ../../../libgcc/unwind-dw2.c:1187
> #2  0x0000003c81e0ff6c in _Unwind_Backtrace (trace=0x3c80706a80 <backtrace_helper>, trace_argument=0x2aab29fc1780) at ../../../libgcc/unwind.inc:290
> #3  0x0000003c80706c16 in __GI___backtrace (array=<optimized out>, size=256) at ../sysdeps/x86_64/backtrace.c:109
> #4  0x00002aac2d635778 in PrintStack (sig=6) at lo/core/sal/osl/unx/signal.c:829
> #5  0x00002aac2d6359b2 in CallSystemHandler (Signal=6) at lo/core/sal/osl/unx/signal.c:895
> #6  0x00002aac2d635adb in SignalHandlerFunction (Signal=6) at lo/core/sal/osl/unx/signal.c:992
> #7  <signal handler called>
> #8  0x0000003c80635ba5 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:63
> #9  0x0000003c80637358 in __GI_abort () at abort.c:90
> #10 0x00002aac31fadf37 in SalAbort (rErrorText="", bDumpCore=true) at lo/core/vcl/unx/generic/plugadapt/salplug.cxx:282
> #11 0x00002aac3195bf2b in Application::Abort (rErrorText="") at lo/core/vcl/source/app/svapp.cxx:382
> #12 0x00002aac2d8da6fa in desktop::Desktop::Exception (this=0x7fff81482930, nError=768) at lo/core/desktop/source/app/app.cxx:1275
> #13 0x00002aac31967314 in VCLExceptionSignal_impl (pInfo=0x2aab29fc2aa0) at lo/core/vcl/source/app/svmain.cxx:132
> #14 0x00002aac2d63582d in CallSignalHandler (pInfo=0x2aab29fc2aa0) at lo/core/sal/osl/unx/signal.c:854
> #15 0x00002aac2d635ac0 in SignalHandlerFunction (Signal=6) at lo/core/sal/osl/unx/signal.c:989
> #16 <signal handler called>
> #17 0x0000003c80635ba5 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:63
> #18 0x0000003c80637358 in __GI_abort () at abort.c:90
> #19 0x00002aac70703149 in os::die () at /usr/src/debug/java-1.7.0-openjdk/openjdk/hotspot/src/os/linux/vm/os_linux.cpp:1597
> #20 0x00002aac7085f822 in VMError::report_and_die (this=0x2aab29fc3230) at /usr/src/debug/java-1.7.0-openjdk/openjdk/hotspot/src/share/vm/utilities/vmError.cpp:1022
> #21 0x00002aac70860260 in crash_handler (sig=11, info=0x2aab29fc3470, ucVoid=0x2aab29fc3340) at /usr/src/debug/java-1.7.0-openjdk/openjdk/hotspot/src/os/linux/vm/vmError_linux.cpp:106
> #22 <signal handler called>
> #23 0x00002aac6b370123 in ?? ()
> #24 0x00002aac70703120 in os::abort (dump_core=true) at /usr/src/debug/java-1.7.0-openjdk/openjdk/hotspot/src/os/linux/vm/os_linux.cpp:1578
> #25 0x00002aac7085fb8f in VMError::report_and_die (this=0x2aab29fc39e0) at /usr/src/debug/java-1.7.0-openjdk/openjdk/hotspot/src/share/vm/utilities/vmError.cpp:1018
> #26 0x00002aac7070a4af in JVM_handle_linux_signal (sig=11, info=0x2aab29fc3c30, ucVoid=0x2aab29fc3b00, abort_if_unrecognized=1) at /usr/src/debug/java-1.7.0-openjdk/openjdk/hotspot/src/os_cpu/linux_x86/vm/os_linux_x86.cpp:528
> #27 <signal handler called>
> #28 0x00002aac67b06c52 in std::auto_ptr<svx::PropertyChangeNotifier_Data>::operator-> (this=0x48) at /usr/lib/gcc/x86_64-redhat-linux/4.7.2/../../../../include/c++/4.7.2/backward/auto_ptr.h:196
> #29 0x00002aac67b04bcb in svx::PropertyChangeNotifier::notifyPropertyChange (this=0x48, _eProperty=svx::eShapePosition) at lo/core/svx/source/unodraw/shapepropertynotifier.cxx:143
> #30 0x00002aac679b2a1c in SdrObject::notifyShapePropertyChange (this=0x2aab30316ac0, _eProperty=svx::eShapePosition) at lo/core/svx/source/svdraw/svdobj.cxx:3032
> #31 0x00002aac679b220b in SdrObject::SendUserCall (this=0x2aab30316ac0, eUserCall=SDRUSERCALL_MOVEONLY, rBoundRect=Rectangle = {...}) at lo/core/svx/source/svdraw/svdobj.cxx:2910
> #32 0x00002aac679acdcf in SdrObject::SetAnchorPos (this=0x2aab30316ac0, rPnt=Point = {...}) at lo/core/svx/source/svdraw/svdobj.cxx:1641
> #33 0x00002aac64e9e68a in objectpositioning::SwAsCharAnchoredObjectPosition::CalcPosition (this=0x2aab29fc47c0) at lo/core/sw/source/core/objectpositioning/ascharanchoredobjectposition.cxx:248
> #34 0x00002aac64f58a7d in SwFlyCntPortion::SetBase (this=0x2aab3010ad10, rFrm=..., rBase=Point = {...}, nLnAscent=0, nLnDescent=0, nFlyAsc=0, nFlyDesc=0, nFlags=6 '\006') at lo/core/sw/source/core/text/porfly.cxx:381
> #35 0x00002aac64f588b5 in SwFlyCntPortion::SwFlyCntPortion (this=0x2aab3010ad10, rFrm=..., pDrawContact=0x2aab303185e0, rBase=Point = {...}, nLnAscent=0, nLnDescent=0, nFlyAsc=0, nFlyDesc=0, nFlags=6 '\006') at lo/core/sw/source/core/text/porfly.cxx:322
> #36 0x00002aac64f49bd1 in SwTxtFormatter::NewFlyCntPortion (this=0x2aab29fc5b50, rInf=..., pHint=0x2aab30318760) at lo/core/sw/source/core/text/itrform2.cxx:2564
> #37 0x00002aac64f8a9c4 in SwTxtFormatter::NewExtraPortion (this=0x2aab29fc5b50, rInf=...) at lo/core/sw/source/core/text/txtfld.cxx:360
> #38 0x00002aac64f44aa9 in SwTxtFormatter::NewPortion (this=0x2aab29fc5b50, rInf=...) at lo/core/sw/source/core/text/itrform2.cxx:1320
> #39 0x00002aac64f42946 in SwTxtFormatter::BuildPortions (this=0x2aab29fc5b50, rInf=...) at lo/core/sw/source/core/text/itrform2.cxx:709
> #40 0x00002aac64f45840 in SwTxtFormatter::FormatLine (this=0x2aab29fc5b50, nStartPos=1) at lo/core/sw/source/core/text/itrform2.cxx:1538
> #41 0x00002aac64f1af0b in SwTxtFrm::FormatLine (this=0x2aac69b68138, rLine=..., bPrev=0 '\000') at lo/core/sw/source/core/text/frmform.cxx:1117
> #42 0x00002aac64f1c341 in SwTxtFrm::_Format (this=0x2aac69b68138, rLine=..., rInf=..., bAdjust=0 '\000') at lo/core/sw/source/core/text/frmform.cxx:1479
> #43 0x00002aac64f1cb9f in SwTxtFrm::_Format (this=0x2aac69b68138, pPara=0x2aab2a3ea380) at lo/core/sw/source/core/text/frmform.cxx:1653
> #44 0x00002aac64f1da56 in SwTxtFrm::Format (this=0x2aac69b68138) at lo/core/sw/source/core/text/frmform.cxx:1803
> #45 0x00002aac64da7580 in SwCntntFrm::MakeAll (this=0x2aac69b68138) at lo/core/sw/source/core/layout/calcmove.cxx:1392
> #46 0x00002aac64da2339 in SwFrm::OptPrepareMake (this=0x2aac69b68138) at lo/core/sw/source/core/layout/calcmove.cxx:394
> #47 0x00002aac64df934a in SwFrm::OptCalc (this=0x2aac69b68138) at lo/core/sw/source/core/inc/frame.hxx:1028
> #48 0x00002aac64df730d in SwLayAction::_FormatCntnt (this=0x2aab29fc6c70, pCntnt=0x2aac69b68138, pPage=0x2aac69bf5210) at lo/core/sw/source/core/layout/layact.cxx:1959
> #49 0x00002aac64df67c4 in SwLayAction::FormatCntnt (this=0x2aab29fc6c70, pPage=0x2aac69bf5210) at lo/core/sw/source/core/layout/layact.cxx:1783
> #50 0x00002aac64df2318 in SwLayAction::InternalAction (this=0x2aab29fc6c70) at lo/core/sw/source/core/layout/layact.cxx:694
> #51 0x00002aac64df16a7 in SwLayAction::Action (this=0x2aab29fc6c70) at lo/core/sw/source/core/layout/layact.cxx:454
> #52 0x00002aac6522116b in ViewShell::ImplEndAction (this=0x2aab301542b0, bIdleEnd=0 '\000') at lo/core/sw/source/core/view/viewsh.cxx:235
> #53 0x00002aac649f57c0 in ViewShell::EndAction (this=0x2aab301542b0, bIdleEnd=0 '\000') at lo/core/sw/inc/viewsh.hxx:594
> #54 0x00002aac649e5a95 in SwCrsrShell::EndAction (this=0x2aab301542b0, bIdleEnd=0 '\000') at lo/core/sw/source/core/crsr/crsrsh.cxx:257
> #55 0x00002aac64cfb5c7 in SwEditShell::EndAllAction (this=0x2aab301542b0) at lo/core/sw/source/core/edit/edws.cxx:119
> #56 0x00002aac653b5be5 in SwDocShell::Notify (this=0x2aab300c7460, rHint=...) at lo/core/sw/source/ui/app/docsh2.cxx:304
> #57 0x00002aac2f89be93 in SfxBroadcaster::Broadcast (this=0x2aab300c7460, rHint=...) at lo/core/svl/source/notify/brdcst.cxx:49
> #58 0x00002aac2f167d31 in SfxObjectShell::ModifyChanged (this=0x2aab300c7460) at lo/core/sfx2/source/doc/objmisc.cxx:365
> #59 0x00002aac2f167c51 in SfxObjectShell::SetModified (this=0x2aab300c7460, bModifiedP=0 '\000') at lo/core/sfx2/source/doc/objmisc.cxx:345
> #60 0x00002aac653bc65c in SwDocShell::SetModified (this=0x2aab300c7460, bSet=0 '\000') at lo/core/sw/source/ui/app/docsh2.cxx:1523
> #61 0x00002aac2f1beee5 in SfxBaseModel::setModified (this=0x2aaab1328458, bModified=0 '\000') at lo/core/sfx2/source/doc/sfxbasemodel.cxx:1365
> #62 0x00002aac3ea99df6 in gcc3::callVirtualMethod (pThis=0x2aaab13284f0, nVtableIndex=6, pRegisterReturn=0x0, pReturnTypeRef=0x15ec250, bSimpleReturn=true, pStack=0x2aab29fc7250, nStack=0, pGPR=0x2aab29fc72c0, nGPR=2, pFPR=0x2aab29fc72f0, nFPR=0) at lo/core/bridges/source/cpp_uno/gcc3_linux_x86-64/callvirtualmethod.cxx:119
> #63 0x00002aac3eaa17d8 in cpp_call (pThis=0x2aab3010ca80, aVtableSlot=..., pReturnTypeRef=0x15ec250, nParams=1, pParams=0x2aac5c004260, pUnoReturn=0x0, pUnoArgs=0x2aab30093ac0, ppUnoExc=0x2aab29fc76a8) at lo/core/bridges/source/cpp_uno/gcc3_linux_x86-64/uno2cpp.cxx:237
> #64 0x00002aac3eaa233c in bridges::cpp_uno::shared::unoInterfaceProxyDispatch (pUnoI=0x2aab3010ca80, pMemberDescr=0x2aac5c0046b0, pReturn=0x0, pArgs=0x2aab30093ac0, ppException=0x2aab29fc76a8) at lo/core/bridges/source/cpp_uno/gcc3_linux_x86-64/uno2cpp.cxx:431
> #65 0x00002aac4c46e153 in binaryurp::IncomingRequest::execute_throw (this=0x2aac5c015d60, returnValue=0x2aab29fc7b10, outArguments=0x2aab29fc7a80) at lo/core/binaryurp/source/incomingrequest.cxx:245
> #66 0x00002aac4c46d023 in binaryurp::IncomingRequest::execute (this=0x2aac5c015d60) at lo/core/binaryurp/source/incomingrequest.cxx:74
> #67 0x00002aac4c488359 in binaryurp::(anonymous namespace)::request (pThreadSpecificData=0x2aac5c015d60) at lo/core/binaryurp/source/reader.cxx:87
> #68 0x00002aac2e09422a in cppu_threadpool::JobQueue::enter (this=0x2aac5c034e50, nDisposeId=46919766305312, bReturnWhenNoJob=1 '\001') at lo/core/cppu/source/threadpool/jobqueue.cxx:115
> #69 0x00002aac2e097b15 in cppu_threadpool::ORequestThread::run (this=0x2aac5c00ea20) at lo/core/cppu/source/threadpool/thread.cxx:173
> #70 0x00002aac2e0982fb in osl::threadFunc (param=0x2aac5c00ea30) at lo/core/solver/unxlngx6/inc/osl/thread.hxx:187
> #71 0x00002aac2d632c2b in osl_thread_start_Impl (pData=0x2aac5c00f5d0) at lo/core/sal/osl/unx/thread.c:252
> #72 0x0000003c80a07d15 in start_thread (arg=0x2aab29fc8700) at pthread_create.c:308
> #73 0x0000003c806f246d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:114

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.