https://bugs.documentfoundation.org/show_bug.cgi?id=174008
--- Comment #1 from Maxi <[email protected]> --- Created attachment 209119 --> https://bugs.documentfoundation.org/attachment.cgi?id=209119&action=edit Minimal reproducer: heap corruption in soffice Minimal reproducer: heap corruption in soffice via unguarded SvxUnoTextRangeBase::~SvxUnoTextRangeBase() -> removeRange() on URP release. Pattern (common in document-generation scripts): enumerate paragraphs and text portions of Impress text shapes and set a char property on each. Every enumeration/paragraph/portion proxy that Python drops is released through an asynchronous URP "release" message, which soffice executes in a cppu_threadpool thread WITHOUT the SolarMutex, racing with the next synchronous call. Usage: python3 mre_textrange_race.py [--soffice PATH] [--seconds N] [--shapes N] Exit codes: 0 = survived, 3 = soffice crashed (stderr tail printed), 2 = setup error. -- You are receiving this mail because: You are the assignee for the bug.
