openoffice.org-core vos::OTimerManager::lookupTimer() SIGABRT crash

Binary package hint: openoffice.org-core

openoffice.org-core 2.0.4-0ubuntu2

I tried to reproduce this, but couldn't get it to happen again.

This is what I did before this crash:

1. Edited a file.odt in OpenOffice Writer
2. Clicked "New", and a new Writer opened up.
3. Finished my editing of file.odt, and saved.
4. some mins later I closed the New Writer window.
5. Crash.

Below is a backtrace, and also disassm, so you can see by looking with debug symbols which line it was actually on.

Jon

soffice.bin crashed caused signal 6 (SIGABRT)

(no debugging symbols found)
Using host libthread_db library "/lib/tls/i686/cmov/libthread_db.so.1".
[...]
(no debugging symbols found)
[Thread debugging using libthread_db enabled]
[New Thread -1246197120 (LWP 6096)]
[...]
(no debugging symbols found)
[KCrash handler]
#6 0xffffe410 in __kernel_vsyscall ()
#7 0xb6bf6770 in raise () from /lib/tls/i686/cmov/libc.so.6
#8 0xb6bf7ef3 in abort () from /lib/tls/i686/cmov/libc.so.6
#9 0xb6de7520 in __gnu_cxx::__verbose_terminate_handler ()
   from /usr/lib/libstdc++.so.6
#10 0xb6de4f55 in std::set_unexpected () from /usr/lib/libstdc++.so.6
#11 0xb6de4f92 in std::terminate () from /usr/lib/libstdc++.so.6
#12 0xb6de5675 in __cxa_pure_virtual () from /usr/lib/libstdc++.so.6
#13 0xb7492a9a in vos::OTimerManager::lookupTimer ()
   from /usr/lib/openoffice/program/libvos3gcc3.so
#14 0xb74931be in vos::OTimer::isTicking ()
   from /usr/lib/openoffice/program/libvos3gcc3.so
#15 0xb3c77e42 in ?? () from /usr/lib/openoffice/program/configmgr2.uno.so
#16 0xb3c7830b in ?? () from /usr/lib/openoffice/program/configmgr2.uno.so
#17 0xb3c84d5e in ?? () from /usr/lib/openoffice/program/configmgr2.uno.so
#18 0xb3c8cd75 in ?? () from /usr/lib/openoffice/program/configmgr2.uno.so
#19 0xb3d7fb79 in component_getFactory ()
   from /usr/lib/openoffice/program/configmgr2.uno.so
#20 0xb3da2969 in component_getFactory ()
   from /usr/lib/openoffice/program/configmgr2.uno.so
#21 0xb3da5300 in component_getFactory ()
   from /usr/lib/openoffice/program/configmgr2.uno.so
#22 0xb3da07d5 in component_getFactory ()
   from /usr/lib/openoffice/program/configmgr2.uno.so
#23 0xb3dadaad in component_getFactory ()
   from /usr/lib/openoffice/program/configmgr2.uno.so
#24 0xb3dacf16 in component_getFactory ()
   from /usr/lib/openoffice/program/configmgr2.uno.so
#25 0xb3db16fd in component_getFactory ()
   from /usr/lib/openoffice/program/configmgr2.uno.so
#26 0x0808b580 in desktop::LanguageSelection::setDefaultLocale ()
#27 0x0808c100 in desktop::LanguageSelection::prepareLanguage ()
#28 0x0806199f in desktop::Desktop::Init ()
#29 0xb7cb78a1 in InitVCL () from /usr/lib/openoffice/program/libvcl680li.so
#30 0xb7cb7b21 in InitVCL () from /usr/lib/openoffice/program/libvcl680li.so
#31 0xb7cb7d35 in SVMain () from /usr/lib/openoffice/program/libvcl680li.so
#32 0x0805fdc3 in sal_main ()
#33 0x0805fe46 in main ()

(gdb) frame 13
#13 0xb7492a9a in vos::OTimerManager::lookupTimer ()
   from /usr/lib/openoffice/program/libvos3gcc3.so
(gdb) disas
Dump of assembler code for function _ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE:
0xb7492a70 <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+0>: push %ebp
0xb7492a71 <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+1>: mov %esp,%ebp
0xb7492a73 <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+3>: push %edi
0xb7492a74 <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+4>: push %esi
0xb7492a75 <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+5>: sub $0x10,%esp
0xb7492a78 <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+8>: mov 0xc(%ebp),%esi
0xb7492a7b <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+11>: mov 0x8(%ebp),%edi
0xb7492a7e <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+14>: movl $0x0,0xfffffff0(%ebp)
0xb7492a85 <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+21>: test %esi,%esi
0xb7492a87 <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+23>: je 0xb7492ac4 <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+84>
0xb7492a89 <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+25>: lea 0---Type <return> to continue, or q <return> to quit---
x1c(%edi),%eax
0xb7492a8c <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+28>: mov %eax,0xfffffff4(%ebp)
0xb7492a8f <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+31>: mov 0x1c(%edi),%eax
0xb7492a92 <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+34>: mov 0xfffffff4(%ebp),%edx
0xb7492a95 <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+37>: mov %edx,(%esp)
0xb7492a98 <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+40>: call *(%eax)
0xb7492a9a <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+42>: mov 0x14(%edi),%eax
0xb7492a9d <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+45>: test %eax,%eax
0xb7492a9f <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+47>: jne 0xb7492aaa <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+58>
0xb7492aa1 <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+49>: jmp 0xb7492ace <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+94>
0xb7492aa3 <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+51>: mov 0x1c(%eax),%eax
0xb7492aa6 <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+54>: test %eax,%eax
---Type <return> to continue, or q <return> to quit---
0xb7492aa8 <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+56>: je 0xb7492ace <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+94>
0xb7492aaa <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+58>: cmp %eax,%esi
0xb7492aac <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+60>: lea 0x0(%esi),%esi
0xb7492ab0 <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+64>: jne 0xb7492aa3 <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+51>
0xb7492ab2 <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+66>: movl $0x1,0xfffffff0(%ebp)
0xb7492ab9 <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+73>: mov 0xfffffff4(%ebp),%edx
0xb7492abc <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+76>: mov (%edx),%eax
0xb7492abe <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+78>: mov %edx,(%esp)
0xb7492ac1 <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+81>: call *0x8(%eax)
0xb7492ac4 <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+84>: mov 0xfffffff0(%ebp),%eax
0xb7492ac7 <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+87>: add $0x10,%esp
0xb7492aca <_ZN3vos13OTimerManager11lookupTimerEPKNS_6OTimerE+90>: pop %---Type <return> to continue, or q <return> to quit---