When exiting Base, I got a crash, which seems local to Basic code. Not systematically reproducible. Backtrace attached.

Analysis
#29 0x00007f226a93c553 in basic::ImplRepository::getDocumentBasicManager (this=0x2f44060, _rxDocumentModel=uno::Reference to (dbaccess::ODatabaseDocument *) 0x33e2370)
    at /home/master/src/libreoffice/workdirs/libreoffice-4.1/basic/source/basmgr/basicmanagerrepository.cxx:253
(gdb) list
251	        BasicManagerPointer& pBasicManager = impl_getLocationForModel( _rxDocumentModel );
252	        if ( pBasicManager == NULL )
253	            impl_createManagerForModel( pBasicManager, _rxDocumentModel );

So it seems that here pBasicManager was NULL, and impl_createManagerForModel was called with its first argument being NULL initially.

(gdb) down
#28 0x00007f226a93dfad in basic::ImplRepository::impl_createManagerForModel (this=0x2f44060, _out_rpBasicManager=@0x3b9c848: 0x9999999999999999, _rxDocumentModel=
    uno::Reference to (dbaccess::ODatabaseDocument *) 0x33e2370) at /home/master/src/libreoffice/workdirs/libreoffice-4.1/basic/source/basmgr/basicmanagerrepository.cxx:497
(gdb) list
496	        // register as listener for the BasicManager being destroyed
497	        StartListening( *_out_rpBasicManager );
(gdb) print _out_rpBasicManager
$5 = (basic::BasicManagerPointer &) @0x3b9c848: 0x9999999999999999

The first argument is 0x9999999999999999. From our MALLOC_PERTURB_=153 in ooenv, all 9's is the value that free()d/deleted memory gets. So it seems there is some lifetime issue, but from staring at the code, I don't guess where. impl_createManagerForModel should create a BasicManager and stick it in _out_rpBasicManager, but where would it be destroyed?


Possibly the problem is actually (much) higher? Frame 39/40, I see the destructor of BasicManager; it seems suspicious to me that a new BasicManager is constructed from the destructor of the same type!!