Dangling SwAccessibleContext -> SwAccessibleMap
Stephan Bergmann
sbergman at redhat.com
Wed Feb 17 16:40:58 UTC 2016
<http://ci.libreoffice.org/job/lo_tb_master_linux_dbg/5478/> crashed in
JunitTest_sw_unoapi_1 with a SEGV as below. Smells like the
SwAccessibleContext (base class of SwAccessibleParagraph)'s m_pMap
(pointing at an SwAccessibleMap) is dangling. The lifecycle of any
SwAccessibleMap instances is controlled by SwViewShellImp (member
m_pAccessibleMap, deleted during dtor).
It wouldn't even easily work to notify all SwAccessibleContext instances
registered at SwViewShellImp::m_pAccessibleMap when the latter is
destroyed (so that the former could clear their m_pMap members), as what
gets registered in the map are not the SwAccessibleContext instances
themselves, but their GetFrame() objects (cf.
SwAccessibleContext::RemoveFrameFromAccessibleMap).
Any friend of the Writer and/or accessibility code got any idea?
> #0 0x00002b9ed7115bd0 in pthread_mutex_lock () at /lib64/libpthread.so.0
> #1 0x00002b9ed677f9fb in osl_acquireMutex(oslMutexImpl*) (pMutex=0x9999999999999999) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/sal/osl/unx/mutex.cxx:99
> nRet = 0
> #2 0x00002b9efb0a180d in osl::Mutex::acquire() (this=0x346b820) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/include/osl/mutex.hxx:56
> #3 0x00002b9efb0a53c0 in osl::Guard<osl::Mutex>::Guard(osl::Mutex&) (this=0x2b9ef7d34fd0, t=...) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/include/osl/mutex.hxx:129
> #4 0x00002b9efb0d36fc in SwAccessibleMap::RemoveContext(SwFrame const*) (this=0x346b810, pFrame=0x2b6c2a0) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/sw/source/core/access/accmap.cxx:2188
> aGuard = {pT = 0x346b820}
> #5 0x00002b9efb0aea6a in SwAccessibleContext::RemoveFrameFromAccessibleMap() (this=0x346c9e0) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/sw/source/core/access/acccontext.cxx:1417
> #6 0x00002b9efb0a9e96 in SwAccessibleContext::~SwAccessibleContext() (this=0x346c9e0, __in_chrg=<optimized out>) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/sw/source/core/access/acccontext.cxx:531
> aGuard = {m_solarMutex = @0x17348e0}
> #7 0x00002b9efb0fdd6a in SwAccessibleParagraph::~SwAccessibleParagraph() (this=0x346c9c0, __in_chrg=<optimized out>) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/sw/source/core/access/accpara.cxx:560
> #8 0x00002b9efb0fddd0 in SwAccessibleParagraph::~SwAccessibleParagraph() (this=0x346c9c0, __in_chrg=<optimized out>) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/sw/source/core/access/accpara.cxx:569
> #9 0x00002b9ed8b8993c in cppu::OWeakObject::release() (this=0x346c9e0) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/cppuhelper/source/weak.cxx:204
> #10 0x00002b9efb0a4e6a in cppu::WeakImplHelper<com::sun::star::accessibility::XAccessible, com::sun::star::accessibility::XAccessibleContext, com::sun::star::accessibility::XAccessibleComponent, com::sun::star::accessibility::XAccessibleEventBroadcaster, com::sun::star::lang::XServiceInfo>::release() (this=0x346c9e0) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/include/cppuhelper/implbase.hxx:113
> #11 0x00002b9efb110378 in SwAccessibleParagraph::release() (this=0x346c9c0) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/sw/source/core/access/accpara.hxx:311
> #12 0x00002b9ef7394c48 in bridges::cpp_uno::shared::freeUnoInterfaceProxy(_uno_ExtEnvironment*, void*) (pEnv=0x2538910, pProxy=0x346c970) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/bridges/source/cpp_uno/shared/unointerfaceproxy.cxx:42
> pThis = 0x346c970
> __PRETTY_FUNCTION__ = "void bridges::cpp_uno::shared::freeUnoInterfaceProxy(uno_ExtEnvironment*, void*)"
> #13 0x00002b9ed8821a5c in (anonymous namespace)::s_stub_defenv_revokeInterface(va_list*) (pParam=0x2b9ef7d353e0) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/cppu/source/uno/lbenv.cxx:373
> rEntry = @0x346d1d0: {refCount = 2, pInterface = 0x346c970, fpFreeProxy = 0x2b9ef7394ba0 <bridges::cpp_uno::shared::freeUnoInterfaceProxy(_uno_ExtEnvironment*, void*)>, pTypeDescr = 0x25c57e0}
> nPos = 0
> guard = {pT = 0x0}
> pOEntry = 0x346c4d0
> pEnv = 0x2538910
> pInterface = 0x2a01970
> that = 0x2538910
> iFind = {<std::__detail::_Node_iterator_base<std::pair<void* const, (anonymous namespace)::ObjectEntry*>, true>> = {_M_cur = }, <No data fields>}
> #14 0x00002b9ed881c1cc in s_environment_invoke_v(uno_Environment*, uno_Environment*, uno_EnvCallee*, va_list*) (pCurrEnv=0x0, pTargetEnv=0x2538910, pCallee=0x2b9ed88216d0 <(anonymous namespace)::s_stub_defenv_revokeInterface(va_list*)>, pParam=0x2b9ef7d353e0) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/cppu/source/uno/EnvStack.cxx:293
> hld = 0x0
> pNextEnv = 0x0
> #15 0x00002b9ed881c27e in uno_Environment_invoke_v(uno_Environment*, uno_EnvCallee*, va_list*) (pTargetEnv=0x2538910, pCallee=0x2b9ed88216d0 <(anonymous namespace)::s_stub_defenv_revokeInterface(va_list*)>, pParam=0x2b9ef7d353e0) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/cppu/source/uno/EnvStack.cxx:312
> #16 0x00002b9ed881c350 in uno_Environment_invoke(uno_Environment*, uno_EnvCallee*, ...) (pEnv=0x2538910, pCallee=0x2b9ed88216d0 <(anonymous namespace)::s_stub_defenv_revokeInterface(va_list*)>) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/cppu/source/uno/EnvStack.cxx:321
> param = {{gp_offset = 32, fp_offset = 48, overflow_arg_area = 0x2b9ef7d354c0, reg_save_area = 0x2b9ef7d35400}}
> #17 0x00002b9ed8821eae in (anonymous namespace)::defenv_revokeInterface(uno_ExtEnvironment*, void*) (pEnv=0x2538910, pInterface=0x2a01970) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/cppu/source/uno/lbenv.cxx:427
> #18 0x00002b9ef7394d6d in bridges::cpp_uno::shared::releaseProxy(_uno_Interface*) (pUnoI=0x2a01970) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/bridges/source/cpp_uno/shared/unointerfaceproxy.cxx:83
> #19 0x00002b9ef860bd61 in com::sun::star::uno::UnoInterfaceReference::~UnoInterfaceReference() (this=0x2b9ef7d35560, __in_chrg=<optimized out>) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/include/uno/dispatcher.hxx:92
> #20 0x00002b9ef860675f in binaryurp::Bridge::releaseStub(rtl::OUString const&, com::sun::star::uno::TypeDescription const&) (this=0x2537720, oid=..., type=...) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/binaryurp/source/bridge.cxx:511
> __PRETTY_FUNCTION__ = "void binaryurp::Bridge::releaseStub(const rtl::OUString&, const com::sun::star::uno::TypeDescription&)"
> obj = {m_pUnoI = 0x2a01970}
> unused = false
> #21 0x00002b9ef8625da1 in binaryurp::IncomingRequest::execute_throw(binaryurp::BinaryAny*, std::__debug::vector<binaryurp::BinaryAny, std::allocator<binaryurp::BinaryAny> >*) const (this=0x2d60640, returnValue=0x2b9ef7d35a10, outArguments=0x2b9ef7d35a90) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/binaryurp/source/incomingrequest.cxx:136
> isExc = false
> #22 0x00002b9ef862552f in binaryurp::IncomingRequest::execute() const (this=0x2d60640) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/binaryurp/source/incomingrequest.cxx:73
> resetCc = false
> oldCc = {m_pUnoI = 0x0}
> ret = {data_ = {pType = 0x174c7f0, pData = 0xdeadbeef, pReserved = 0x2b9ef7d35ae7}}
> outArgs = std::__debug::vector of length 0, capacity 0
> isExc = false
> #23 0x00002b9ef8645f3e in binaryurp::(anonymous namespace)::request(void*) (pThreadSpecificData=0x2d60640) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/binaryurp/source/reader.cxx:85
> __PRETTY_FUNCTION__ = "void binaryurp::{anonymous}::request(void*)"
> #24 0x00002b9ed87e7805 in cppu_threadpool::JobQueue::enter(long, bool) (this=0x2dcd990, nDisposeId=41467568, bReturnWhenNoJob=true) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/cppu/source/threadpool/jobqueue.cxx:107
> guard = {pT = 0x2dcd990}
> job = {pThreadSpecificData = 0x2d60640, doRequest = 0x2b9ef8645ed5 <binaryurp::(anonymous namespace)::request(void*)>}
> pReturn = 0x0
> #25 0x00002b9ed87eb25b in cppu_threadpool::ORequestThread::run() (this=0x278beb0) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/cppu/source/threadpool/thread.cxx:172
> #26 0x00002b9ed87eb6a5 in osl::threadFunc(void*) (param=0x278bec0) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/include/osl/thread.hxx:185
> pObj = 0x278bec0
> #27 0x00002b9ed6793854 in osl_thread_start_Impl(void*) (pData=0x33eb5f0) at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/sal/osl/unx/thread.cxx:240
> terminate = false
> pImpl = 0x33eb5f0
> __PRETTY_FUNCTION__ = "void* osl_thread_start_Impl(void*)"
> #28 0x00002b9ed7113dc5 in start_thread () at /lib64/libpthread.so.0
> #29 0x00002b9ed6e4121d in clone () at /lib64/libc.so.6
More information about the LibreOffice
mailing list