Created attachment 133085 [details]
backtrace

In current LO git ( ae7401002a0b6dabe4136dd8c5654ee2a54e7db6 ) I get a crash when inserting a formula into a presentation. I am on Fedora 25.

Steps to reproduce.
1) open a new presentaton
2) Insert -> Object -> formula
3) Put anything in the formula
4) click outside the formula area to return to the presentation

Error message
soffice.bin: /usr/local/src/libreoffice/core/comphelper/source/misc/accessibleeventnotifier.cxx:136: bool {anonymous}::implLookupClient(comphelper::AccessibleEventNotifier::TClientId, std::__debug::map<unsigned int, comphelper::OInterfaceContainerHelper2*>::iterator&): Assertion `rClients.end() != rPos && "AccessibleEventNotifier::implLookupClient: invalid client id " "(did you register your client?)!"' failed.

Thread 1 "soffice.bin" received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:58
58	}

Backtrace:
#0  0x00007ffff73a391f in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:58
#1  0x00007ffff73a551a in __GI_abort () at abort.c:89
#2  0x00007ffff739bda7 in __assert_fail_base (fmt=<optimized out>, assertion=assertion@entry=0x7ffff490a888 "rClients.end() != rPos && \"AccessibleEventNotifier::implLookupClient: invalid client id \" \"(did you register your client?)!\"", file=file@entry=0x7ffff490a7a0 "/usr/local/src/libreoffice/core/comphelper/source/misc/accessibleeventnotifier.cxx", line=line@entry=136, function=function@entry=0x7ffff490aa80 <(anonymous namespace)::implLookupClient(unsigned int, __gnu_debug::_Safe_iterator<std::_Rb_tree_iterator<std::pair<unsigned int const, comphelper::OInterfaceContainerHelper2*> >, std::__debug::map<unsigned int, comphelper::OInterfaceContainerHelper2*, std::less<unsigned int>, std::allocator<std::pair<unsigned int const, comphelper::OInterfaceContainerHelper2*> > > >&)::__PRETTY_FUNCTION__> "bool {anonymous}::implLookupClient(comphelper::AccessibleEventNotifier::TClientId, std::__debug::map<unsigned int, comphelper::OInterfaceContainerHelper2*>::iterator&)") at assert.c:92
#3  0x00007ffff739be52 in __GI___assert_fail (assertion=0x7ffff490a888 "rClients.end() != rPos && \"AccessibleEventNotifier::implLookupClient: invalid client id \" \"(did you register your client?)!\"", file=0x7ffff490a7a0 "/usr/local/src/libreoffice/core/comphelper/source/misc/accessibleeventnotifier.cxx", line=136, function=0x7ffff490aa80 <(anonymous namespace)::implLookupClient(unsigned int, __gnu_debug::_Safe_iterator<std::_Rb_tree_iterator<std::pair<unsigned int const, comphelper::OInterfaceContainerHelper2*> >, std::__debug::map<unsigned int, comphelper::OInterfaceContainerHelper2*, std::less<unsigned int>, std::allocator<std::pair<unsigned int const, comphelper::OInterfaceContainerHelper2*> > > >&)::__PRETTY_FUNCTION__> "bool {anonymous}::implLookupClient(comphelper::AccessibleEventNotifier::TClientId, std::__debug::map<unsigned int, comphelper::OInterfaceContainerHelper2*>::iterator&)") at assert.c:101
#4  0x00007ffff47c29a8 in (anonymous namespace)::implLookupClient(comphelper::AccessibleEventNotifier::TClientId, std::__debug::map<unsigned int, comphelper::OInterfaceContainerHelper2*, std::less<unsigned int>, std::allocator<std::pair<unsigned int const, comphelper::OInterfaceContainerHelper2*> > >::iterator&) (nClient=0, rPos=...)
    at /usr/local/src/libreoffice/core/comphelper/source/misc/accessibleeventnotifier.cxx:134
#5  0x00007ffff47c2ffd in comphelper::AccessibleEventNotifier::removeEventListener(unsigned int, com::sun::star::uno::Reference<com::sun::star::accessibility::XAccessibleEventListener> const&) (_nClient=0, _rxListener=...) at /usr/local/src/libreoffice/core/comphelper/source/misc/accessibleeventnotifier.cxx:238
#6  0x00007fffbaca5865 in SmGraphicAccessible::removeAccessibleEventListener(com::sun::star::uno::Reference<com::sun::star::accessibility::XAccessibleEventListener> const&) (this=0x2d45050, xListener=...) at /usr/local/src/libreoffice/core/starmath/source/accessibility.cxx:398
#7  0x00007fffd30e3169 in AtkListener::handleChildRemoved(com::sun::star::uno::Reference<com::sun::star::accessibility::XAccessibleContext> const&, com::sun::star::uno::Reference<com::sun::star::accessibility::XAccessible> const&) (this=0x2d726e0, rxParent=..., rxChild=...)
    at /usr/local/src/libreoffice/core/vcl/unx/gtk3/a11y/../../gtk/a11y/atklistener.cxx:213
#8  0x00007fffd30e366b in AtkListener::notifyEvent(com::sun::star::accessibility::AccessibleEventObject const&) (this=0x2d726e0, aEvent=...)
    at /usr/local/src/libreoffice/core/vcl/unx/gtk3/a11y/../../gtk/a11y/atklistener.cxx:428
#9  0x00007ffff47c3261 in comphelper::AccessibleEventNotifier::addEvent(unsigned int, com::sun::star::accessibility::AccessibleEventObject const&) (_nClient=59, _rEvent=...) at /usr/local/src/libreoffice/core/comphelper/source/misc/accessibleeventnotifier.cxx:269
#10 0x00007ffff47c0f72 in comphelper::OAccessibleContextHelper::NotifyAccessibleEvent(short, com::sun::star::uno::Any const&, com::sun::star::uno::Any const&) (this=0x2d5b1a0, _nEventId=7, _rOldValue=..., _rNewValue=...) at /usr/local/src/libreoffice/core/comphelper/source/misc/accessiblecontexthelper.cxx:187
#11 0x00007fffee347686 in VCLXAccessibleComponent::ProcessWindowEvent(VclWindowEvent const&) (this=0x2d5b1a0, rVclWindowEvent=...)
    at /usr/local/src/libreoffice/core/toolkit/source/awt/vclxaccessiblecomponent.cxx:212
#12 0x00007fffee347041 in VCLXAccessibleComponent::WindowEventListener(VclWindowEvent&) (this=0x2d5b1a0, rEvent=...)
    at /usr/local/src/libreoffice/core/toolkit/source/awt/vclxaccessiblecomponent.cxx:126
#13 0x00007fffee346f51 in VCLXAccessibleComponent::LinkStubWindowEventListener(void*, VclWindowEvent&) (instance=0x2d5b1a0, data=...)
    at /usr/local/src/libreoffice/core/toolkit/source/awt/vclxaccessiblecomponent.cxx:115
#14 0x00007fffec6168ab in Link<VclWindowEvent&, void>::Call(VclWindowEvent&) const (this=0x2d177b0, data=...)
    at /usr/local/src/libreoffice/core/include/tools/link.hxx:84
#15 0x00007fffec6134b8 in vcl::Window::CallEventListeners(VclEventId, void*) (this=0x2d491f0, nEvent=VclEventId::WindowChildDestroyed, pData=0x2d7dbf0)
    at /usr/local/src/libreoffice/core/vcl/source/window/event.cxx:240
#16 0x00007fffec72ca9c in vcl::Window::dispose() (this=0x2d7dbf0) at /usr/local/src/libreoffice/core/vcl/source/window/window.cxx:171
#17 0x00007fffeedba054 in ScrollableWindow::dispose() (this=0x2d7dbf0) at /usr/local/src/libreoffice/core/svtools/source/control/scrwin.cxx:55
#18 0x00007fffbadb586a in SmGraphicWindow::dispose() (this=0x2d7dbf0) at /usr/local/src/libreoffice/core/starmath/source/view.cxx:127
---Type <return> to continue, or q <return> to quit---
#19 0x00007fffec8c5310 in VclReferenceBase::disposeOnce() (this=0x2d7df20) at /usr/local/src/libreoffice/core/vcl/source/outdev/vclreferencebase.cxx:42
#20 0x00007fffbadc33ce in VclPtr<SmGraphicWindow>::disposeAndClear() (this=0x2ce8688) at /usr/local/src/libreoffice/core/include/vcl/vclptr.hxx:239
#21 0x00007fffbadbf0a1 in SmViewShell::~SmViewShell() (this=0x2ce8610, __in_chrg=<optimized out>) at /usr/local/src/libreoffice/core/starmath/source/view.cxx:1932
#22 0x00007fffbadbf116 in SmViewShell::~SmViewShell() (this=0x2ce8610, __in_chrg=<optimized out>) at /usr/local/src/libreoffice/core/starmath/source/view.cxx:1933
#23 0x00007ffff22a1534 in SfxViewFrame::ReleaseObjectShell_Impl() (this=0x2d53ba0) at /usr/local/src/libreoffice/core/sfx2/source/view/viewfrm.cxx:979
#24 0x00007ffff22a37c8 in SfxViewFrame::~SfxViewFrame() (this=0x2d53ba0, __in_chrg=<optimized out>)
    at /usr/local/src/libreoffice/core/sfx2/source/view/viewfrm.cxx:1385
#25 0x00007ffff22a39c8 in SfxViewFrame::~SfxViewFrame() (this=0x2d53ba0, __in_chrg=<optimized out>)
    at /usr/local/src/libreoffice/core/sfx2/source/view/viewfrm.cxx:1408
#26 0x00007ffff22a1a09 in SfxViewFrame::Close() (this=0x2d53ba0) at /usr/local/src/libreoffice/core/sfx2/source/view/viewfrm.cxx:1031
#27 0x00007ffff2276699 in SfxFrame::DoClose_Impl() (this=0x2d3f730) at /usr/local/src/libreoffice/core/sfx2/source/view/frame.cxx:161
#28 0x00007ffff2291fd4 in SfxBaseController::dispose() (this=0x2cf4b50) at /usr/local/src/libreoffice/core/sfx2/source/view/sfxbasecontroller.cxx:1022
#29 0x00007fffc825a241 in (anonymous namespace)::Frame::setComponent(com::sun::star::uno::Reference<com::sun::star::awt::XWindow> const&, com::sun::star::uno::Reference<com::sun::star::frame::XController> const&) (this=0x2c79470, xComponentWindow=..., xController=...)
    at /usr/local/src/libreoffice/core/framework/source/services/frame.cxx:1475
#30 0x00007fffc825aac9 in (anonymous namespace)::Frame::close(sal_Bool) (this=0x2c79470, bDeliverOwnership=1 '\001')
    at /usr/local/src/libreoffice/core/framework/source/services/frame.cxx:1685
#31 0x00007fffbb121c2d in DocumentHolder::CloseFrame() (this=0x2e68930) at /usr/local/src/libreoffice/core/embeddedobj/source/general/docholder.cxx:225
#32 0x00007fffbb0f5b58 in OCommonEmbeddedObject::Deactivate() (this=0x2e66ad0) at /usr/local/src/libreoffice/core/embeddedobj/source/commonembedding/embedobj.cxx:115
#33 0x00007fffbb0f6a43 in OCommonEmbeddedObject::SwitchStateTo_Impl(int) (this=0x2e66ad0, nNextState=1)
    at /usr/local/src/libreoffice/core/embeddedobj/source/commonembedding/embedobj.cxx:291
#34 0x00007fffbb0f7a71 in OCommonEmbeddedObject::changeState(int) (this=0x2e66ad0, nNewState=1)
    at /usr/local/src/libreoffice/core/embeddedobj/source/commonembedding/embedobj.cxx:461
#35 0x00007ffff2287848 in SfxInPlaceClient::DeactivateObject() (this=0x2d91440) at /usr/local/src/libreoffice/core/sfx2/source/view/ipclient.cxx:1009
#36 0x00007fffc61604ca in sd::DrawViewShell::SelectionHasChanged() (this=0x2126a20) at /usr/local/src/libreoffice/core/sd/source/ui/view/drviews1.cxx:209
#37 0x00007fffc6153c61 in sd::DrawView::MarkListHasChanged() (this=0x2143580) at /usr/local/src/libreoffice/core/sd/source/ui/view/drawview.cxx:106
#38 0x00007fffefba1b65 in SdrMarkView::UnmarkAllObj(SdrPageView*) (this=0x2143580, pPV=0x0) at /usr/local/src/libreoffice/core/svx/source/svdraw/svdmrkv.cxx:1936
#39 0x00007fffefcb51db in SdrView::UnmarkAll() (this=0x2143580) at /usr/local/src/libreoffice/core/svx/source/svdraw/svdview.cxx:1370
#40 0x00007fffc5ed5de3 in sd::FuSelection::MouseButtonDown(MouseEvent const&) (this=0x2aea1d0, rMEvt=...)
    at /usr/local/src/libreoffice/core/sd/source/ui/func/fusel.cxx:373
#41 0x00007fffc623c838 in sd::ViewShell::MouseButtonDown(MouseEvent const&, sd::Window*) (this=0x2126a20, rMEvt=..., pWin=0x2127390)
    at /usr/local/src/libreoffice/core/sd/source/ui/view/viewshel.cxx:499
#42 0x00007fffc618113a in sd::DrawViewShell::MouseButtonDown(MouseEvent const&, sd::Window*) (this=0x2126a20, rMEvt=..., pWin=0x2127390)
    at /usr/local/src/libreoffice/core/sd/source/ui/view/drviews4.cxx:286
#43 0x00007fffc622af89 in sd::Window::MouseButtonDown(MouseEvent const&) (this=0x2127390, rMEvt=...)
    at /usr/local/src/libreoffice/core/sd/source/ui/view/sdwindow.cxx:250
#44 0x00007fffec750e45 in ImplHandleMouseEvent(VclPtr<vcl::Window> const&, MouseNotifyEvent, bool, long, long, unsigned long, unsigned short, MouseEventModifiers) (xWindow=
    ..., nSVEvent=MouseNotifyEvent::MOUSEBUTTONDOWN, bMouseLeave=false, nX=701, nY=246, nMsgTime=125939936, nCode=1, nMode=(MouseEventModifiers::SIMPLECLICK | MouseEventModifiers::SELECT)) at /usr/local/src/libreoffice/core/vcl/source/window/winproc.cxx:699
#45 0x00007fffec758211 in ImplHandleSalMouseButtonDown(vcl::Window*, SalMouseEvent*) (pWindow=0x1d3c190, pEvent=0x7fffffff1a60)
    at /usr/local/src/libreoffice/core/vcl/source/window/winproc.cxx:2010
#46 0x00007fffec75669d in ImplWindowFrameProc(vcl::Window*, SalEvent, void const*) (_pWindow=0x1d3c190, nEvent=SalEvent::MouseButtonDown, pEvent=0x7fffffff1a60)
---Type <return> to continue, or q <return> to quit---
    at /usr/local/src/libreoffice/core/vcl/source/window/winproc.cxx:2332
#47 0x00007fffd3179d1a in SalFrame::CallCallback(SalEvent, void const*) const (this=0x1d48130, nEvent=SalEvent::MouseButtonDown, pEvent=0x7fffffff1a60)
    at /usr/local/src/libreoffice/core/vcl/inc/salframe.hxx:276
#48 0x00007fffd3179231 in GtkSalFrame::CallCallbackExc(SalEvent, void const*) const (this=0x1d48130, nEvent=SalEvent::MouseButtonDown, pEvent=0x7fffffff1a60)
    at /usr/local/src/libreoffice/core/vcl/unx/gtk3/gtk3gtkframe.cxx:4299
#49 0x00007fffd31743f4 in GtkSalFrame::signalButton(_GtkWidget*, _GdkEventButton*, void*) (pEvent=0x265a1e0, frame=0x1d48130)
    at /usr/local/src/libreoffice/core/vcl/unx/gtk3/gtk3gtkframe.cxx:2652
#50 0x00007fffd29bae7c in _gtk_marshal_BOOLEAN__BOXED () at /lib64/libgtk-3.so.0
#51 0x00007ffff5ddc3e5 in g_closure_invoke () at /lib64/libgobject-2.0.so.0
#52 0x00007ffff5dee432 in signal_emit_unlocked_R () at /lib64/libgobject-2.0.so.0
#53 0x00007ffff5df6b8f in g_signal_emit_valist () at /lib64/libgobject-2.0.so.0
#54 0x00007ffff5df743f in g_signal_emit () at /lib64/libgobject-2.0.so.0
#55 0x00007fffd2b0820c in gtk_widget_event_internal () at /lib64/libgtk-3.so.0
#56 0x00007fffd29b7f4e in propagate_event () at /lib64/libgtk-3.so.0
#57 0x00007fffd29b9fbe in gtk_main_do_event () at /lib64/libgtk-3.so.0
#58 0x00007fffd24d05c5 in _gdk_event_emit () at /lib64/libgdk-3.so.0
#59 0x00007fffd2501582 in gdk_event_source_dispatch () at /lib64/libgdk-3.so.0
#60 0x00007ffff5b03e52 in g_main_context_dispatch () at /lib64/libglib-2.0.so.0
#61 0x00007ffff5b041d0 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#62 0x00007ffff5b0427c in g_main_context_iteration () at /lib64/libglib-2.0.so.0
#63 0x00007fffd30ffeaa in GtkData::Yield(bool, bool) (this=0x75dca0, bWait=true, bHandleAllCurrentEvents=false)
    at /usr/local/src/libreoffice/core/vcl/unx/gtk3/gtk3gtkdata.cxx:460
#64 0x00007fffd310323f in GtkInstance::DoYield(bool, bool, unsigned long) (this=0x76a270, bWait=true, bHandleAllCurrentEvents=false, nReleased=0)
    at /usr/local/src/libreoffice/core/vcl/unx/gtk3/../gtk/gtkinst.cxx:427
#65 0x00007fffecb99ddd in ImplYield(bool, bool, unsigned long) (i_bWait=true, i_bAllEvents=false, nReleased=0)
    at /usr/local/src/libreoffice/core/vcl/source/app/svapp.cxx:496
#66 0x00007fffecb95b3e in Application::Yield() () at /usr/local/src/libreoffice/core/vcl/source/app/svapp.cxx:558
#67 0x00007fffecb958d7 in Application::Execute() () at /usr/local/src/libreoffice/core/vcl/source/app/svapp.cxx:458
#68 0x00007ffff7780aa9 in desktop::Desktop::DoExecute() () at /usr/local/src/libreoffice/core/desktop/source/app/app.cxx:1354
#69 0x00007ffff7781c5e in desktop::Desktop::Main() (this=0x7fffffff2b10) at /usr/local/src/libreoffice/core/desktop/source/app/app.cxx:1674
#70 0x00007fffecba4e05 in ImplSVMain() () at /usr/local/src/libreoffice/core/vcl/source/app/svmain.cxx:191
#71 0x00007fffecba4f6e in SVMain() () at /usr/local/src/libreoffice/core/vcl/source/app/svmain.cxx:229
#72 0x00007ffff77d6619 in soffice_main() () at /usr/local/src/libreoffice/core/desktop/source/app/sofficemain.cxx:166
#73 0x000000000040091e in sal_main () at /usr/local/src/libreoffice/core/desktop/source/app/main.c:48
#74 0x0000000000400904 in main (argc=2, argv=0x7fffffff2e48) at /usr/local/src/libreoffice/core/desktop/source/app/main.c:47

Full backtrace attached.