https://bugs.freedesktop.org/show_bug.cgi?id=59134
Priority: medium
Bug ID: 59134
CC: [email protected]
Assignee: [email protected]
Summary: SIGSEGV upon concurrent SwXTextDocument::close and
SwXTextCursor::release
Severity: normal
Classification: Unclassified
OS: All
Reporter: [email protected]
Hardware: Other
Status: NEW
Version: 4.1.0.0.alpha0+ Master
Component: Writer
Product: LibreOffice
With a current Linux master build, sw_unoapi at least once crashed for me with
> Thread 1 (Thread 0x2b7620401700 (LWP 14419)):
> #0 x86_64_fallback_frame_state (fs=0x2b76203fc540, context=<optimized out>)
> at ./md-unwind-support.h:53
> #1 uw_frame_state_for (context=context@entry=0x2b76203fc450,
> fs=fs@entry=0x2b76203fc540) at ../../../libgcc/unwind-dw2.c:1187
> #2 0x0000003d8de0ff1c in _Unwind_Backtrace (trace=0x3d8bb05900
> <backtrace_helper>, trace_argument=0x2b76203fc700) at
> ../../../libgcc/unwind.inc:290
> #3 0x0000003d8bb05a96 in __GI___backtrace (array=<optimized out>, size=256)
> at ../sysdeps/ia64/backtrace.c:110
> #4 0x00002b75f7a51a7d in PrintStack (sig=6) at
> lo/core/sal/osl/unx/signal.c:829
> #5 0x00002b75f7a51cb7 in CallSystemHandler (Signal=6) at
> lo/core/sal/osl/unx/signal.c:895
> #6 0x00002b75f7a51f0c in SignalHandlerFunction (Signal=6) at
> lo/core/sal/osl/unx/signal.c:992
> #7 <signal handler called>
> #8 0x0000003d8ba35935 in __GI_raise (sig=sig@entry=6) at
> ../nptl/sysdeps/unix/sysv/linux/raise.c:64
> #9 0x0000003d8ba370e8 in __GI_abort () at abort.c:91
> #10 0x00002b75fc341ff3 in SalAbort (rErrorText="", bDumpCore=true) at
> lo/core/vcl/unx/generic/plugadapt/salplug.cxx:282
> #11 0x00002b75fbd01c3d in Application::Abort (rErrorText="") at
> lo/core/vcl/source/app/svapp.cxx:378
> #12 0x00002b75f7cf6410 in desktop::Desktop::Exception (this=0x7fff6da119d0,
> nError=768) at lo/core/desktop/source/app/app.cxx:1272
> #13 0x00002b75fbd0d0ec in VCLExceptionSignal_impl (pInfo=0x2b76203fdaa0) at
> lo/core/vcl/source/app/svmain.cxx:132
> #14 0x00002b75f7a51b32 in CallSignalHandler (pInfo=0x2b76203fdaa0) at
> lo/core/sal/osl/unx/signal.c:854
> #15 0x00002b75f7a51ef1 in SignalHandlerFunction (Signal=6) at
> lo/core/sal/osl/unx/signal.c:989
> #16 <signal handler called>
> #17 0x0000003d8ba35935 in __GI_raise (sig=sig@entry=6) at
> ../nptl/sysdeps/unix/sysv/linux/raise.c:64
> #18 0x0000003d8ba370e8 in __GI_abort () at abort.c:91
> #19 0x00002b7638700bd9 in ?? () from
> /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.9.x86_64/jre/lib/amd64/server/libjvm.so
> #20 0x00002b763885c1b2 in ?? () from
> /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.9.x86_64/jre/lib/amd64/server/libjvm.so
> #21 0x00002b763885cbf0 in ?? () from
> /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.9.x86_64/jre/lib/amd64/server/libjvm.so
> #22 <signal handler called>
> #23 0x00002b763333f305 in ?? ()
> #24 0x00002b7638700bb0 in ?? () from
> /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.9.x86_64/jre/lib/amd64/server/libjvm.so
> #25 0x00002b763885c51f in ?? () from
> /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.9.x86_64/jre/lib/amd64/server/libjvm.so
> #26 0x00002b7638707f4f in JVM_handle_linux_signal () from
> /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.9.x86_64/jre/lib/amd64/server/libjvm.so
> #27 <signal handler called>
> #28 0x00002b762fb22479 in SvxShape::HasSdrObjectOwnership
> (this=0x2aaab138cab8) at lo/core/svx/source/unodraw/unoshape.cxx:270
> #29 0x00002b762f9761d0 in SdrObject::Free (_rpObject=@0x2b76203ff128: 0x0) at
> lo/core/svx/source/svdraw/svdobj.cxx:509
> #30 0x00002b762cca1d82 in SwDrawContact::~SwDrawContact (this=0x2b762869e0d0,
> __in_chrg=<optimized out>) at lo/core/sw/source/core/draw/dcontact.cxx:678
> #31 0x00002b762cca1e38 in SwDrawContact::~SwDrawContact (this=0x2b762869e0d0,
> __in_chrg=<optimized out>) at lo/core/sw/source/core/draw/dcontact.cxx:680
> #32 0x00002b762cd988f5 in SwDrawFrmFmt::~SwDrawFrmFmt (this=0x2aaab1823160,
> __in_chrg=<optimized out>) at lo/core/sw/source/core/layout/atrfrm.cxx:3156
> #33 0x00002b762cd98982 in SwDrawFrmFmt::~SwDrawFrmFmt (this=0x2aaab1823160,
> __in_chrg=<optimized out>) at lo/core/sw/source/core/layout/atrfrm.cxx:3157
> #34 0x00002b762cafda06 in SwDoc::DelFrmFmt (this=0x2b76281374a0,
> pFmt=0x2aaab1823160, bBroadcast=false) at
> lo/core/sw/source/core/doc/docfmt.cxx:1341
> #35 0x00002b762cb211ea in SwDoc::DelLayoutFmt (this=0x2b76281374a0,
> pFmt=0x2aaab1823160) at lo/core/sw/source/core/doc/doclay.cxx:336
> #36 0x00002b762d008007 in SwTxtNode::DestroyAttr (this=0x2aaab0a581e0,
> pAttr=0x2b76286a8e00) at lo/core/sw/source/core/txtnode/thints.cxx:1101
> #37 0x00002b762cfe8867 in SwTxtNode::~SwTxtNode (this=0x2aaab0a581e0,
> __in_chrg=<optimized out>) at lo/core/sw/source/core/txtnode/ndtxt.cxx:248
> #38 0x00002b762cfe8a30 in SwTxtNode::~SwTxtNode (this=0x2aaab0a581e0,
> __in_chrg=<optimized out>) at lo/core/sw/source/core/txtnode/ndtxt.cxx:262
> #39 0x00002b762cc7e31d in SwNodes::RemoveNode (this=0x2b762858a050,
> nDelPos=9, nSz=1, bDel=1 '\001') at
> lo/core/sw/source/core/docnode/nodes.cxx:2399
> #40 0x00002b762cc7b3c9 in SwNodes::DelNodes (this=0x2b762858a050,
> rStart=SwNodeIndex (node 0), nCnt=11) at
> lo/core/sw/source/core/docnode/nodes.cxx:1504
> #41 0x00002b762cb307cd in SwDoc::~SwDoc (this=0x2b76281374a0,
> __in_chrg=<optimized out>) at lo/core/sw/source/core/doc/docnew.cxx:602
> #42 0x00002b762cb31bf4 in SwDoc::~SwDoc (this=0x2b76281374a0,
> __in_chrg=<optimized out>) at lo/core/sw/source/core/doc/docnew.cxx:697
> #43 0x00002b762d3ae760 in SwDocShell::RemoveLink (this=0x2b7628063320) at
> lo/core/sw/source/ui/app/docshini.cxx:503
> #44 0x00002b762d3adf0d in SwDocShell::~SwDocShell (this=0x2b7628063320,
> __in_chrg=<optimized out>, __vtt_parm=<optimized out>) at
> lo/core/sw/source/ui/app/docshini.cxx:411
> #45 0x00002b762d3ae132 in SwDocShell::~SwDocShell (this=0x2b7628063320,
> __in_chrg=<optimized out>, __vtt_parm=<optimized out>) at
> lo/core/sw/source/ui/app/docshini.cxx:419
> #46 0x00002b75fb12c6e0 in SvRefBase::QueryDelete (this=0x2b7628063490) at
> lo/core/tools/source/ref/ref.cxx:29
> #47 0x00002b75f928d0ff in SvRefBase::ReleaseReference (this=0x2b7628063490)
> at lo/core/solver/unxlngx6/inc/tools/ref.hxx:188
> #48 0x00002b75f928d20d in SfxObjectShellRef::~SfxObjectShellRef
> (this=0x2b76281cc178, __in_chrg=<optimized out>) at
> lo/core/sfx2/inc/sfx2/objsh.hxx:764
> #49 0x00002b75f95a9297 in
> IMPL_SfxBaseModel_DataContainer::~IMPL_SfxBaseModel_DataContainer
> (this=0x2b76281cc170, __in_chrg=<optimized out>) at
> lo/core/sfx2/source/doc/sfxbasemodel.cxx:243
> #50 0x00002b75f95a949a in
> IMPL_SfxBaseModel_DataContainer::~IMPL_SfxBaseModel_DataContainer
> (this=0x2b76281cc170, __in_chrg=<optimized out>) at
> lo/core/sfx2/source/doc/sfxbasemodel.cxx:244
> #51 0x00002b75f958ff3b in SfxBaseModel::dispose (this=0x2aab29b25a58) at
> lo/core/sfx2/source/doc/sfxbasemodel.cxx:829
> #52 0x00002b762d59ad36 in SwXTextDocument::dispose (this=0x2aab29b25928) at
> lo/core/sw/source/ui/uno/unotxdoc.cxx:564
> #53 0x00002b75f95933b0 in SfxBaseModel::close (this=0x2aab29b25a58,
> bDeliverOwnership=1 '\001') at lo/core/sfx2/source/doc/sfxbasemodel.cxx:1452
> #54 0x00002b762d59adf2 in SwXTextDocument::close (this=0x2aab29b25928,
> bDeliverOwnership=1 '\001') at lo/core/sw/source/ui/uno/unotxdoc.cxx:572
> #55 0x00002b7608e2bda6 in gcc3::callVirtualMethod (pThis=0x2aab29b25b28,
> nVtableIndex=5, pRegisterReturn=0x0, pReturnTypeRef=0x16d63c0,
> bSimpleReturn=true, pStack=0x2b7620400210, nStack=0, pGPR=0x2b7620400280,
> nGPR=2, pFPR=0x2b76204002b0, nFPR=0) at
> lo/core/bridges/source/cpp_uno/gcc3_linux_x86-64/callvirtualmethod.cxx:119
> #56 0x00002b7608e33788 in cpp_call (pThis=0x2b76286c4cc0, aVtableSlot=...,
> pReturnTypeRef=0x16d63c0, nParams=1, pParams=0x2b7624004740, pUnoReturn=0x0,
> pUnoArgs=0x2b76280d3ab0, ppUnoExc=0x2b7620400668) at
> lo/core/bridges/source/cpp_uno/gcc3_linux_x86-64/uno2cpp.cxx:237
> #57 0x00002b7608e342ec in bridges::cpp_uno::shared::unoInterfaceProxyDispatch
> (pUnoI=0x2b76286c4cc0, pMemberDescr=0x2b7624004810, pReturn=0x0,
> pArgs=0x2b76280d3ab0, ppException=0x2b7620400668) at
> lo/core/bridges/source/cpp_uno/gcc3_linux_x86-64/uno2cpp.cxx:431
> #58 0x00002b761446b157 in binaryurp::IncomingRequest::execute_throw
> (this=0x2b7624002220, returnValue=0x2b7620400ad0,
> outArguments=0x2b7620400a40) at
> lo/core/binaryurp/source/incomingrequest.cxx:245
> #59 0x00002b761446a027 in binaryurp::IncomingRequest::execute
> (this=0x2b7624002220) at lo/core/binaryurp/source/incomingrequest.cxx:74
> #60 0x00002b761448535d in binaryurp::(anonymous namespace)::request
> (pThreadSpecificData=0x2b7624002220) at lo/core/binaryurp/source/reader.cxx:87
> #61 0x00002b75f84a81da in cppu_threadpool::JobQueue::enter
> (this=0x2b762400f4a0, nDisposeId=47786410177056, bReturnWhenNoJob=1 '\001')
> at lo/core/cppu/source/threadpool/jobqueue.cxx:115
> #62 0x00002b75f84abac5 in cppu_threadpool::ORequestThread::run
> (this=0x2b762400f220) at lo/core/cppu/source/threadpool/thread.cxx:173
> #63 0x00002b75f84ac2ab in osl::threadFunc (param=0x2b762400f230) at
> lo/core/solver/unxlngx6/inc/osl/thread.hxx:187
> #64 0x00002b75f7a4ec43 in osl_thread_start_Impl (pData=0x2b76240119e0) at
> lo/core/sal/osl/unx/thread.c:252
> #65 0x0000003d8be07d14 in start_thread (arg=0x2b7620401700) at
> pthread_create.c:309
> #66 0x0000003d8baf168d in clone () at
> ../sysdeps/unix/sysv/linux/x86_64/clone.S:115
> Thread 23 (Thread 0x2aab28854700 (LWP 14425)):
> #0 __lll_lock_wait () at
> ../nptl/sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:136
> #1 0x0000003d8be09c71 in _L_lock_889 () from /lib64/libpthread.so.0
> #2 0x0000003d8be09b8a in __pthread_mutex_lock (mutex=0x16d4150) at
> pthread_mutex_lock.c:86
> #3 0x00002b75f7a4413e in osl_acquireMutex (Mutex=0x16d4150) at
> lo/core/sal/osl/unx/mutex.c:114
> #4 0x00002b75fbd00bc6 in vcl::SolarMutexObject::acquire (this=0x16d4120) at
> lo/core/vcl/source/app/solarmutex.cxx:35
> #5 0x00002b75fc28c4e0 in SalYieldMutex::acquire (this=0x16d4120) at
> lo/core/vcl/generic/app/geninst.cxx:49
> #6 0x00002b762c926ec6 in SolarMutexGuard::SolarMutexGuard
> (this=0x2aab28852eb0) at lo/core/solver/unxlngx6/inc/vcl/svapp.hxx:434
> #7 0x00002b762d141d9f in sw::UnoImplPtr<SwXTextCursor::Impl>::~UnoImplPtr
> (this=0x2b76163a9bf0, __in_chrg=<optimized out>) at
> lo/core/sw/inc/unobaseclass.hxx:111
> #8 0x00002b762d1361e5 in SwXTextCursor::~SwXTextCursor (this=0x2b76163a9b58,
> __in_chrg=<optimized out>) at lo/core/sw/source/core/unocore/unoobj.cxx:824
> #9 0x00002b762d136268 in SwXTextCursor::~SwXTextCursor (this=0x2b76163a9b58,
> __in_chrg=<optimized out>) at lo/core/sw/source/core/unocore/unoobj.cxx:826
> #10 0x00002b75f87fd17b in cppu::OWeakObject::release (this=0x2b76163a9b58) at
> lo/core/cppuhelper/source/weak.cxx:204
> #11 0x00002b762d1426f6 in
> cppu::WeakImplHelper12<com::sun::star::lang::XServiceInfo,
> com::sun::star::beans::XPropertySet, com::sun::star::beans::XPropertyState,
> com::sun::star::beans::XMultiPropertyStates,
> com::sun::star::container::XEnumerationAccess,
> com::sun::star::container::XContentEnumerationAccess,
> com::sun::star::util::XSortable,
> com::sun::star::document::XDocumentInsertable,
> com::sun::star::text::XSentenceCursor, com::sun::star::text::XWordCursor,
> com::sun::star::text::XParagraphCursor,
> com::sun::star::text::XRedline>::release (this=0x2b76163a9b58) at
> lo/core/solver/unxlngx6/inc/cppuhelper/implbase12.hxx:117
> #12 0x00002b762d14042a in SwXTextCursor::release (this=0x2b76163a9b58) at
> lo/core/sw/source/core/unocore/unoobj.cxx:2937
> #13 0x00002b7608e35f58 in bridges::cpp_uno::shared::freeUnoInterfaceProxy
> (pEnv=0x2b76180009e0, pProxy=0x2b76284c7950) at
> lo/core/bridges/source/cpp_uno/shared/unointerfaceproxy.cxx:43
> #14 0x00002b75f84dde10 in (anonymous
> namespace)::s_stub_defenv_revokeInterface (pParam=0x2aab288531b8) at
> lo/core/cppu/source/uno/lbenv.cxx:391
> #15 0x00002b75f84d9896 in s_environment_invoke_v (pCurrEnv=0x0,
> pTargetEnv=0x2b76180009e0, pCallee=0x2b75f84ddabc <(anonymous
> namespace)::s_stub_defenv_revokeInterface(va_list*)>, pParam=0x2aab288531b8)
> at lo/core/cppu/source/uno/EnvStack.cxx:287
> #16 0x00002b75f84d993f in uno_Environment_invoke_v
> (pTargetEnv=0x2b76180009e0, pCallee=0x2b75f84ddabc <(anonymous
> namespace)::s_stub_defenv_revokeInterface(va_list*)>, pParam=0x2aab288531b8)
> at lo/core/cppu/source/uno/EnvStack.cxx:306
> #17 0x00002b75f84d99ff in uno_Environment_invoke (pEnv=0x2b76180009e0,
> pCallee=0x2b75f84ddabc <(anonymous
> namespace)::s_stub_defenv_revokeInterface(va_list*)>) at
> lo/core/cppu/source/uno/EnvStack.cxx:315
> #18 0x00002b75f84de1b8 in (anonymous namespace)::defenv_revokeInterface
> (pEnv=0x2b76180009e0, pInterface=0x2aab30001850) at
> lo/core/cppu/source/uno/lbenv.cxx:447
> #19 0x00002b7608e3607e in bridges::cpp_uno::shared::releaseProxy
> (pUnoI=0x2aab30001850) at
> lo/core/bridges/source/cpp_uno/shared/unointerfaceproxy.cxx:85
> #20 0x00002b7614453be1 in
> com::sun::star::uno::UnoInterfaceReference::~UnoInterfaceReference
> (this=0x2aab288533a0, __in_chrg=<optimized out>) at
> lo/core/solver/unxlngx6/inc/uno/dispatcher.hxx:88
> #21 0x00002b761444e34b in binaryurp::Bridge::releaseStub
> (this=0x2b760a231670,
> oid="2b76163a9b58;gcc3[0];f0a89e755a4744f384aad9519f25ba26", type=...) at
> lo/core/binaryurp/source/bridge.cxx:525
> #22 0x00002b761446a8a7 in binaryurp::IncomingRequest::execute_throw
> (this=0x2b7624017c10, returnValue=0x2aab28853ad0,
> outArguments=0x2aab28853a40) at
> lo/core/binaryurp/source/incomingrequest.cxx:139
> #23 0x00002b761446a027 in binaryurp::IncomingRequest::execute
> (this=0x2b7624017c10) at lo/core/binaryurp/source/incomingrequest.cxx:74
> #24 0x00002b761448535d in binaryurp::(anonymous namespace)::request
> (pThreadSpecificData=0x2b7624017c10) at lo/core/binaryurp/source/reader.cxx:87
> #25 0x00002b75f84a81da in cppu_threadpool::JobQueue::enter
> (this=0x2b7624011a60, nDisposeId=47786410186816, bReturnWhenNoJob=1 '\001')
> at lo/core/cppu/source/threadpool/jobqueue.cxx:115
> #26 0x00002b75f84abac5 in cppu_threadpool::ORequestThread::run
> (this=0x2b7624011840) at lo/core/cppu/source/threadpool/thread.cxx:173
> #27 0x00002b75f84ac2ab in osl::threadFunc (param=0x2b7624011850) at
> lo/core/solver/unxlngx6/inc/osl/thread.hxx:187
> #28 0x00002b75f7a4ec43 in osl_thread_start_Impl (pData=0x2b762400c9f0) at
> lo/core/sal/osl/unx/thread.c:252
> #29 0x0000003d8be07d14 in start_thread (arg=0x2aab28854700) at
> pthread_create.c:309
> #30 0x0000003d8baf168d in clone () at
> ../sysdeps/unix/sysv/linux/x86_64/clone.S:115
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
Libreoffice-bugs mailing list
[email protected]
http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs
