make impress start again without crashing

triggered by commit 0143805a565418d2a114c16b7eeba3b784176d9e

from Implementation::Update the mpViewShellManagerLock.reset is triggering
reentry to the same method, this time in the other branch and calling
mpViewShellManagerLock.release and delete pLock

it's all a bit appalling really

==15411== Invalid read of size 8
==15411==    at 0x214B62F4: boost::detail::shared_count::~shared_count() (shared_count.hpp:371)
==15411==    by 0x216C3EE3: boost::shared_ptr<sd::ViewShellManager>::~shared_ptr() (shared_ptr.hpp:328)
==15411==    by 0x21883EE8: sd::ViewShellManager::UpdateLock::~UpdateLock() (in /home/caolan/LibreOffice/core/solver/unxlngx6/lib/libsdlo.so)
==15411==    by 0x21972275: std::auto_ptr<sd::ViewShellManager::UpdateLock>::reset(sd::ViewShellManager::UpdateLock*) (auto_ptr.h:244)
==15411==    by 0x21969F20: sd::ToolBarManager::Implementation::Update(std::auto_ptr<(anonymous namespace)::LayouterLock>) (ToolBarManager.cxx:957)
==15411==    by 0x21969C46: sd::ToolBarManager::Implementation::UnlockUpdate() (ToolBarManager.cxx:884)
==15411==    by 0x21968053: sd::ToolBarManager::UnlockUpdate() (ToolBarManager.cxx:540)
==15411==    by 0x216E03A4: sd::ToolBarManager::UpdateLock::~UpdateLock() (in /home/caolan/LibreOffice/core/solver/unxlngx6/lib/libsdlo.so)
==15411==    by 0x216E051C: void boost::checked_delete<sd::ToolBarManager::UpdateLock>(sd::ToolBarManager::UpdateLock*) (checked_delete.hpp:34)
==15411==    by 0x216E0484: boost::scoped_ptr<sd::ToolBarManager::UpdateLock>::~scoped_ptr() (scoped_ptr.hpp:82)
==15411==    by 0x216E04FC: boost::scoped_ptr<sd::ToolBarManager::UpdateLock>::reset(sd::ToolBarManager::UpdateLock*) (scoped_ptr.hpp:88)
==15411==    by 0x216E01D6: sd::framework::ToolBarModule::HandleUpdateEnd() (ToolBarModule.cxx:203)
==15411==    by 0x216DFEA5: sd::framework::ToolBarModule::notifyConfigurationChange(com::sun::star::drawing::framework::ConfigurationChangeEvent const&) (ToolBarModule.cxx:125)
==15411==    by 0x2169D2F6: sd::framework::ConfigurationControllerBroadcaster::NotifyListeners(std::__debug::vector<sd::framework::ConfigurationControllerBroadcaster::ListenerDescriptor, std::allocator<sd::framework::ConfigurationControllerBroadcaster::ListenerDescriptor> > const&, com::sun::star::drawing::framework::ConfigurationChangeEvent const&) (ConfigurationControllerBroadcaster.cxx:104)
==15411==    by 0x2169D62C: sd::framework::ConfigurationControllerBroadcaster::NotifyListeners(com::sun::star::drawing::framework::ConfigurationChangeEvent const&) (ConfigurationControllerBroadcaster.cxx:132)
==15411==    by 0x216A9A49: sd::framework::ConfigurationUpdater::UpdateConfiguration() (ConfigurationUpdater.cxx:202)
==15411==    by 0x216A9692: sd::framework::ConfigurationUpdater::RequestUpdate(com::sun::star::uno::Reference<com::sun::star::drawing::framework::XConfiguration> const&) (ConfigurationUpdater.cxx:124)
==15411==    by 0x2168D0AE: sd::framework::ChangeRequestQueueProcessor::ProcessOneEvent() (ChangeRequestQueueProcessor.cxx:186)
==15411==    by 0x2168CE39: sd::framework::ChangeRequestQueueProcessor::ProcessEvent(void*) (ChangeRequestQueueProcessor.cxx:139)
==15411==    by 0x2168CDFA: sd::framework::ChangeRequestQueueProcessor::LinkStubProcessEvent(void*, void*) (ChangeRequestQueueProcessor.cxx:131)
==15411==    by 0x90D9283: Link::Call(void*) const (link.hxx:123)
==15411==    by 0x96A2CC3: ImplHandleUserEvent(ImplSVEvent*) (winproc.cxx:1986)
==15411==    by 0x96A422A: ImplWindowFrameProc(Window*, SalFrame*, unsigned short, void const*) (winproc.cxx:2601)
==15411==    by 0x96B28CA: SalFrame::CallCallback(unsigned short, void const*) const (in /home/caolan/LibreOffice/core/solver/unxlngx6/lib/libvcllo.so)
==15411==    by 0x96B2355: SalGenericDisplay::DispatchInternalEvent() (gendisp.cxx:91)
==15411==    by 0x16DB2069: GtkData::userEventFn(void*) (gtkdata.cxx:935)
==15411==    by 0x16DB20C4: call_userEventFn (gtkdata.cxx:945)
==15411==    by 0x3795647A54: g_main_context_dispatch (gmain.c:2715)
==15411==    by 0x3795647D87: g_main_context_iterate.isra.24 (gmain.c:3290)
==15411==    by 0x3795647E43: g_main_context_iteration (gmain.c:3351)
==15411==    by 0x16DB0F2D: GtkData::Yield(bool, bool) (gtkdata.cxx:574)
==15411==    by 0x16DB4ACD: GtkInstance::Yield(bool, bool) (gtkinst.cxx:404)
==15411==    by 0x90F2FEF: ImplYield(bool, bool) (svapp.cxx:422)
==15411==    by 0x90EF588: Application::Yield(bool) (svapp.cxx:456)
==15411==    by 0x90EF529: Application::Execute() (svapp.cxx:401)
==15411==    by 0x4EC7147: desktop::Desktop::Main() (app.cxx:1720)
==15411==    by 0x90FBA70: ImplSVMain() (svmain.cxx:162)
==15411==    by 0x90FBB59: SVMain() (svmain.cxx:198)
==15411==    by 0x4F098B5: soffice_main (sofficemain.cxx:82)
==15411==    by 0x400967: sal_main (main.c:48)
==15411==    by 0x400948: main (main.c:47)
==15411==  Address 0x1f2a66b8 is 8 bytes inside a block of size 16 free'd
==15411==    at 0x4A073CC: operator delete(void*) (vg_replace_malloc.c:480)
==15411==    by 0x21969E8B: sd::ToolBarManager::Implementation::Update(std::auto_ptr<(anonymous namespace)::LayouterLock>) (ToolBarManager.cxx:936)
==15411==    by 0x21969C46: sd::ToolBarManager::Implementation::UnlockUpdate() (ToolBarManager.cxx:884)
==15411==    by 0x21968053: sd::ToolBarManager::UnlockUpdate() (ToolBarManager.cxx:540)
==15411==    by 0x216E03A4: sd::ToolBarManager::UpdateLock::~UpdateLock() (in /home/caolan/LibreOffice/core/solver/unxlngx6/lib/libsdlo.so)
==15411==    by 0x21967962: sd::ToolBarManager::ResetToolBars(sd::ToolBarManager::ToolBarGroup) (ToolBarManager.cxx:410)
==15411==    by 0x219AC02F: sd::DrawViewShell::ChangeEditMode(EditMode, bool) (drviews1.cxx:363)
==15411==    by 0x219CC31E: sd::DrawViewShell::ReadFrameViewData(sd::FrameView*) (drviews5.cxx:295)
==15411==    by 0x21A45CBA: sd::ViewShell::Activate(unsigned char) (viewshel.cxx:350)
==15411==    by 0x219AB09E: sd::DrawViewShell::Activate(unsigned char) (drviews1.cxx:93)
==15411==    by 0x663DA02: SfxShell::DoActivate_Impl(SfxViewFrame*, unsigned char) (shell.cxx:571)
==15411==    by 0x69853B7: SfxDispatcher::FlushImpl() (in /home/caolan/LibreOffice/core/solver/unxlngx6/lib/libsfxlo.so)
==15411==    by 0x652A459: SfxDispatcher::Flush() (dispatch.hxx:237)
==15411==    by 0x6974199: SfxViewShell::AddSubShell(SfxShell&) (viewsh.cxx:1409)
==15411==    by 0x21986D9B: sd::ViewShellManager::Implementation::UpdateShellStack() (ViewShellManager.cxx:963)
==15411==    by 0x21986785: sd::ViewShellManager::Implementation::UnlockUpdate() (ViewShellManager.cxx:881)
==15411==    by 0x21983F27: sd::ViewShellManager::UnlockUpdate() (ViewShellManager.cxx:425)
==15411==    by 0x21883EDC: sd::ViewShellManager::UpdateLock::~UpdateLock() (in /home/caolan/LibreOffice/core/solver/unxlngx6/lib/libsdlo.so)
==15411==    by 0x21972275: std::auto_ptr<sd::ViewShellManager::UpdateLock>::reset(sd::ViewShellManager::UpdateLock*) (auto_ptr.h:244)
==15411==    by 0x21969F20: sd::ToolBarManager::Implementation::Update(std::auto_ptr<(anonymous namespace)::LayouterLock>) (ToolBarManager.cxx:957)
==15411==    by 0x21969C46: sd::ToolBarManager::Implementation::UnlockUpdate() (ToolBarManager.cxx:884)
==15411==    by 0x21968053: sd::ToolBarManager::UnlockUpdate() (ToolBarManager.cxx:540)
==15411==    by 0x216E03A4: sd::ToolBarManager::UpdateLock::~UpdateLock() (in /home/caolan/LibreOffice/core/solver/unxlngx6/lib/libsdlo.so)
==15411==    by 0x216E051C: void boost::checked_delete<sd::ToolBarManager::UpdateLock>(sd::ToolBarManager::UpdateLock*) (checked_delete.hpp:34)
==15411==    by 0x216E0484: boost::scoped_ptr<sd::ToolBarManager::UpdateLock>::~scoped_ptr() (scoped_ptr.hpp:82)
==15411==    by 0x216E04FC: boost::scoped_ptr<sd::ToolBarManager::UpdateLock>::reset(sd::ToolBarManager::UpdateLock*) (scoped_ptr.hpp:88)
==15411==    by 0x216E01D6: sd::framework::ToolBarModule::HandleUpdateEnd() (ToolBarModule.cxx:203)
==15411==    by 0x216DFEA5: sd::framework::ToolBarModule::notifyConfigurationChange(com::sun::star::drawing::framework::ConfigurationChangeEvent const&) (ToolBarModule.cxx:125)
==15411==    by 0x2169D2F6: sd::framework::ConfigurationControllerBroadcaster::NotifyListeners(std::__debug::vector<sd::framework::ConfigurationControllerBroadcaster::ListenerDescriptor, std::allocator<sd::framework::ConfigurationControllerBroadcaster::ListenerDescriptor> > const&, com::sun::star::drawing::framework::ConfigurationChangeEvent const&) (ConfigurationControllerBroadcaster.cxx:104)
==15411==    by 0x2169D62C: sd::framework::ConfigurationControllerBroadcaster::NotifyListeners(com::sun::star::drawing::framework::ConfigurationChangeEvent const&) (ConfigurationControllerBroadcaster.cxx:132)
==15411==    by 0x216A9A49: sd::framework::ConfigurationUpdater::UpdateConfiguration() (ConfigurationUpdater.cxx:202)
==15411==    by 0x216A9692: sd::framework::ConfigurationUpdater::RequestUpdate(com::sun::star::uno::Reference<com::sun::star::drawing::framework::XConfiguration> const&) (ConfigurationUpdater.cxx:124)
==15411==    by 0x2168D0AE: sd::framework::ChangeRequestQueueProcessor::ProcessOneEvent() (ChangeRequestQueueProcessor.cxx:186)
==15411==    by 0x2168CE39: sd::framework::ChangeRequestQueueProcessor::ProcessEvent(void*) (ChangeRequestQueueProcessor.cxx:139)
==15411==    by 0x2168CDFA: sd::framework::ChangeRequestQueueProcessor::LinkStubProcessEvent(void*, void*) (ChangeRequestQueueProcessor.cxx:131)
==15411==    by 0x90D9283: Link::Call(void*) const (link.hxx:123)
==15411==    by 0x96A2CC3: ImplHandleUserEvent(ImplSVEvent*) (winproc.cxx:1986)
==15411==    by 0x96A422A: ImplWindowFrameProc(Window*, SalFrame*, unsigned short, void const*) (winproc.cxx:2601)
==15411==    by 0x96B28CA: SalFrame::CallCallback(unsigned short, void const*) const (in /home/caolan/LibreOffice/core/solver/unxlngx6/lib/libvcllo.so)
==15411==    by 0x96B2355: SalGenericDisplay::DispatchInternalEvent() (gendisp.cxx:91)
==15411==    by 0x16DB2069: GtkData::userEventFn(void*) (gtkdata.cxx:935)
==15411==    by 0x16DB20C4: call_userEventFn (gtkdata.cxx:945)
==15411==    by 0x3795647A54: g_main_context_dispatch (gmain.c:2715)
==15411==    by 0x3795647D87: g_main_context_iterate.isra.24 (gmain.c:3290)
==15411==    by 0x3795647E43: g_main_context_iteration (gmain.c:3351)
==15411==    by 0x16DB0F2D: GtkData::Yield(bool, bool) (gtkdata.cxx:574)
==15411==    by 0x16DB4ACD: GtkInstance::Yield(bool, bool) (gtkinst.cxx:404)
==15411==    by 0x90F2FEF: ImplYield(bool, bool) (svapp.cxx:422)
==15411==    by 0x90EF588: Application::Yield(bool) (svapp.cxx:456)
==15411==    by 0x90EF529: Application::Execute() (svapp.cxx:401)

Change-Id: I0171225067dd0f7f8da1400beb9c97727a0c414f
(cherry picked from commit 66a10f2817ea28c36c1709c84d58b0befad207ca)

1 files changed, 5 insertions, 1 deletions

diff --git a/sd/source/ui/view/ToolBarManager.cxx b/sd/source/ui/view/ToolBarManager.cxx
index d0188211bc1d..6c1eac406d29 100644
--- a/sd/source/ui/view/ToolBarManager.cxx
+++ b/sd/source/ui/view/ToolBarManager.cxx
@@ -954,7 +954,11 @@ void ToolBarManager::Implementation::Update (
         }
         else
         {
-            mpViewShellManagerLock.reset();
+            //do this in two steps, first clear mpViewShellManagerLock to be NULL
+            ViewShellManager::UpdateLock* pLock = mpViewShellManagerLock.release();
+            //now delete the lock so reentry to this method triggered by this
+            //delete will encounter an empty mpViewShellManagerLock
+            delete pLock;
             pLocalLayouterLock.reset();
         }
     }