Created attachment 123053 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today, I could reproduce this.

*** Bug 98283 has been marked as a duplicate of this bug. ***

Tomaz - looks interesting =)

Julien - it'd be lovely to have a valgrind trace with those debugging symbols.

The iterator piece in it:

slideshow::internal::UnoViewContainer::begin (this=0x9999999999999999) at /home/user/libreoffice/slideshow/source/inc/unoviewcontainer.hxx:76

looks like this could be related to some global iterator / container type change.?

I imagine the:

    // init views and create slide bitmaps
    for( const auto& pView : mrViewContainer )
        this->viewAdded( pView );

that the mrViewContainer is a broken reference at this stage; but valgrind would give us more =)

Created attachment 123094 [details]
valgrind log

Valgrind log with master sources updated yesterday (e03f21d400e7ec911f3b0b65c4f35771bc97b003)
+ SAL_USE_VCLPLUGIN=gen and enable-dbgutil

*** Bug 98295 has been marked as a duplicate of this bug. ***

That's a regression of https://cgit.freedesktop.org/libreoffice/core/commit/slideshow?id=f29c0b2b3e8861909fa2c6c37bf631ab01590541

Noel: following Tomaz's comment, thought you might be interested in this one.

I did some debugging by putting a breakpoint at 'slideshow::internal::SlideChangeBase::~SlideChangeBase'

and noticed that the destructor is being called before the call that crashes LO.

The first stacktrace below is the destruction, and the second call is the crasher.


#0  slideshow::internal::SlideChangeBase::~SlideChangeBase (this=0x2777970, vtt=0x2aaae2899e38 <VTT for slideshow::internal::(anonymous namespace)::ClippedSlideChange+8>)
    at /home/noel/libo4/slideshow/source/engine/transitions/slidechangebase.hxx:51
#1  0x00002aaae24eb8d3 in slideshow::internal::(anonymous namespace)::ClippedSlideChange::~ClippedSlideChange (this=0x2777970, 
    vtt=0x2aaae2899e30 <VTT for slideshow::internal::(anonymous namespace)::ClippedSlideChange>) at /home/noel/libo4/slideshow/source/engine/transitions/slidetransitionfactory.cxx:279
#2  0x00002aaae24eb660 in slideshow::internal::(anonymous namespace)::ClippedSlideChange::~ClippedSlideChange (this=0x2777970)
    at /home/noel/libo4/slideshow/source/engine/transitions/slidetransitionfactory.cxx:279
#3  0x00002aaae24eb699 in slideshow::internal::(anonymous namespace)::ClippedSlideChange::~ClippedSlideChange (this=0x2777970)
    at /home/noel/libo4/slideshow/source/engine/transitions/slidetransitionfactory.cxx:279
#4  0x00002aaae24dedbf in std::_Sp_counted_ptr<slideshow::internal::SlideChangeBase*, (__gnu_cxx::_Lock_policy)2>::_M_dispose (this=0x2688200)
    at /usr/lib/gcc/x86_64-linux-gnu/5.2.1/../../../../include/c++/5.2.1/bits/shared_ptr_base.h:374
#5  0x00002aaae225e775 in std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release (this=0x2688200)
    at /usr/lib/gcc/x86_64-linux-gnu/5.2.1/../../../../include/c++/5.2.1/bits/shared_ptr_base.h:150
#6  0x00002aaae225e72a in std::__shared_count<(__gnu_cxx::_Lock_policy)2>::~__shared_count (this=0x7fffffff3610)
    at /usr/lib/gcc/x86_64-linux-gnu/5.2.1/../../../../include/c++/5.2.1/bits/shared_ptr_base.h:659
#7  0x00002aaae2324c29 in std::__shared_ptr<slideshow::internal::ViewEventHandler, (__gnu_cxx::_Lock_policy)2>::~__shared_ptr (this=0x7fffffff3608)
    at /usr/lib/gcc/x86_64-linux-gnu/5.2.1/../../../../include/c++/5.2.1/bits/shared_ptr_base.h:925
#8  0x00002aaae2324b55 in std::shared_ptr<slideshow::internal::ViewEventHandler>::~shared_ptr (this=0x7fffffff3608)
    at /usr/lib/gcc/x86_64-linux-gnu/5.2.1/../../../../include/c++/5.2.1/bits/shared_ptr.h:93
#9  0x00002aaae24d9de7 in slideshow::internal::SlideChangeBase::prefetch (this=0x2777970) at /home/noel/libo4/slideshow/source/engine/transitions/slidechangebase.cxx:179
#10 0x00002aaae245ecaf in (anonymous namespace)::SlideShowImpl::createSlideTransition(com::sun::star::uno::Reference<com::sun::star::drawing::XDrawPage> const&, std::shared_ptr<slideshow::internal::Slide> const&, std::shared_ptr<slideshow::internal::Slide> const&, std::shared_ptr<slideshow::internal::Event> const&)::$_0::operator()() const (this=0x27295d0)
    at /home/noel/libo4/slideshow/source/engine/slideshowimpl.cxx:861
#11 0x00002aaae245eabd in std::_Function_handler<void (), (anonymous namespace)::SlideShowImpl::createSlideTransition(com::sun::star::uno::Reference<com::sun::star::drawing::XDrawPage> const&, std::shared_ptr<slideshow::internal::Slide> const&, std::shared_ptr<slideshow::internal::Slide> const&, std::shared_ptr<slideshow::internal::Event> const&)::$_0>::_M_invoke(std::_Any_data const&) (__functor=...) at /usr/lib/gcc/x86_64-linux-gnu/5.2.1/../../../../include/c++/5.2.1/functional:1871
#12 0x00002aaae22daebe in std::function<void ()>::operator()() const (this=0x2777cf8) at /usr/lib/gcc/x86_64-linux-gnu/5.2.1/../../../../include/c++/5.2.1/functional:2271
#13 0x00002aaae22dadc4 in slideshow::internal::Delay::fire (this=0x2777ce0) at /home/noel/libo4/slideshow/source/engine/delayevent.cxx:32
#14 0x00002aaae235cb2a in slideshow::internal::EventQueue::process_ (this=0x2754d80, bFireAllEvents=false) at /home/noel/libo4/slideshow/source/engine/eventqueue.cxx:222
#15 0x00002aaae235d0f8 in slideshow::internal::EventQueue::process (this=0x2754d80) at /home/noel/libo4/slideshow/source/engine/eventqueue.cxx:164
#16 0x00002aaae2453339 in (anonymous namespace)::SlideShowImpl::update (this=0x2754ba0, nNextTimeout=@0x7fffffff4110: 0) at /home/noel/libo4/slideshow/source/engine/slideshowimpl.cxx:2000
#17 0x00002aaadc38b0ff in sd::SlideshowImpl::updateSlideShow (this=0x270c210) at /home/noel/libo4/sd/source/ui/slideshow/slideshowimpl.cxx:1765
#18 0x00002aaadc38b019 in sd::SlideshowImpl::updateHdl (this=0x270c210) at /home/noel/libo4/sd/source/ui/slideshow/slideshowimpl.cxx:1750
#19 0x00002aaadc37fb48 in sd::SlideshowImpl::LinkStubupdateHdl (instance=0x270c210, data=0x270c290) at /home/noel/libo4/sd/source/ui/slideshow/slideshowimpl.cxx:1748
#20 0x00002aaab343a4a8 in Link<Timer*, void>::Call (this=0x270c2b0, data=0x270c290) at /home/noel/libo4/include/tools/link.hxx:84
#21 0x00002aaab343a287 in Timer::Invoke (this=0x270c290) at /home/noel/libo4/vcl/source/app/timer.cxx:88


#0  std::__cxx1998::vector<std::shared_ptr<slideshow::internal::UnoView>, std::allocator<std::shared_ptr<slideshow::internal::UnoView> > >::begin (this=0x99999999999999b1)
    at /usr/lib/gcc/x86_64-linux-gnu/5.2.1/../../../../include/c++/5.2.1/bits/stl_vector.h:557
#1  0x00002aaae22f4dd7 in std::__debug::vector<std::shared_ptr<slideshow::internal::UnoView>, std::allocator<std::shared_ptr<slideshow::internal::UnoView> > >::begin (
    this=0x9999999999999999) at /usr/lib/gcc/x86_64-linux-gnu/5.2.1/../../../../include/c++/5.2.1/debug/vector:281
#2  0x00002aaae22efacc in slideshow::internal::UnoViewContainer::begin (this=0x9999999999999999) at /home/noel/libo4/slideshow/source/inc/unoviewcontainer.hxx:76
#3  0x00002aaae24d9e08 in slideshow::internal::SlideChangeBase::prefetch (this=0x2777970) at /home/noel/libo4/slideshow/source/engine/transitions/slidechangebase.cxx:182
#4  0x00002aaae245ecaf in (anonymous namespace)::SlideShowImpl::createSlideTransition(com::sun::star::uno::Reference<com::sun::star::drawing::XDrawPage> const&, std::shared_ptr<slideshow::internal::Slide> const&, std::shared_ptr<slideshow::internal::Slide> const&, std::shared_ptr<slideshow::internal::Event> const&)::$_0::operator()() const (this=0x27295d0)
    at /home/noel/libo4/slideshow/source/engine/slideshowimpl.cxx:861
#5  0x00002aaae245eabd in std::_Function_handler<void (), (anonymous namespace)::SlideShowImpl::createSlideTransition(com::sun::star::uno::Reference<com::sun::star::drawing::XDrawPage> const&, std::shared_ptr<slideshow::internal::Slide> const&, std::shared_ptr<slideshow::internal::Slide> const&, std::shared_ptr<slideshow::internal::Event> const&)::$_0>::_M_invoke(std::_Any_data const&) (__functor=...) at /usr/lib/gcc/x86_64-linux-gnu/5.2.1/../../../../include/c++/5.2.1/functional:1871
#6  0x00002aaae22daebe in std::function<void ()>::operator()() const (this=0x2777cf8) at /usr/lib/gcc/x86_64-linux-gnu/5.2.1/../../../../include/c++/5.2.1/functional:2271
#7  0x00002aaae22dadc4 in slideshow::internal::Delay::fire (this=0x2777ce0) at /home/noel/libo4/slideshow/source/engine/delayevent.cxx:32
#8  0x00002aaae235cb2a in slideshow::internal::EventQueue::process_ (this=0x2754d80, bFireAllEvents=false) at /home/noel/libo4/slideshow/source/engine/eventqueue.cxx:222
#9  0x00002aaae235d0f8 in slideshow::internal::EventQueue::process (this=0x2754d80) at /home/noel/libo4/slideshow/source/engine/eventqueue.cxx:164
#10 0x00002aaae2453339 in (anonymous namespace)::SlideShowImpl::update (this=0x2754ba0, nNextTimeout=@0x7fffffff4110: 0) at /home/noel/libo4/slideshow/source/engine/slideshowimpl.cxx:2000
#11 0x00002aaadc38b0ff in sd::SlideshowImpl::updateSlideShow (this=0x270c210) at /home/noel/libo4/sd/source/ui/slideshow/slideshowimpl.cxx:1765
#12 0x00002aaadc38b019 in sd::SlideshowImpl::updateHdl (this=0x270c210) at /home/noel/libo4/sd/source/ui/slideshow/slideshowimpl.cxx:1750
#13 0x00002aaadc37fb48 in sd::SlideshowImpl::LinkStubupdateHdl (instance=0x270c210, data=0x270c290) at /home/noel/libo4/sd/source/ui/slideshow/slideshowimpl.cxx:1748
#14 0x00002aaab343a4a8 in Link<Timer*, void>::Call (this=0x270c2b0, data=0x270c290) at /home/noel/libo4/include/tools/link.hxx:84
#15 0x00002aaab343a287 in Timer::Invoke (this=0x270c290) at /home/noel/libo4/vcl/source/app/timer.cxx:88

OK, I've figured this out.

I converted 

   shared_from_this()

to 

   std::shared_ptr<Activity>((Activity*)this) )

all over the place, which is bad, I should have used

   std::dynamic_pointer_cast<ViewEventHandler>(shared_from_this())

patch coming up.

(In reply to Noel Grandin from comment #9)
> OK, I've figured this out.
> 
> I converted 
> 
>    shared_from_this()
> 
> to 
> 
>    std::shared_ptr<Activity>((Activity*)this) )
> 
> all over the place, which is bad, I should have used
> 
>    std::dynamic_pointer_cast<ViewEventHandler>(shared_from_this())
> 
> patch coming up.

You 're faster than me

After reverting (in that order)

git revert 4e354737908b89713297ebf5216eb44f3d9ae990
git revert 93de1f80e8b6ea49be8eca57a87e6ba92dc6cae9
git revert ef3aea797bc33edc6d8a975ed74bb3a38031d62b
git revert f29c0b2b3e8861909fa2c6c37bf631ab01590541

I got too that idea of replacing shared_from_this() was wrong

Noel Grandin committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=037de512546917786c313d23995daaa0521a8e6e

tdf#98175 fix Impress crash

It will be available in 5.2.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.

(In reply to Commit Notification from comment #11)

> Affected users are encouraged to test the fix and report feedback.

It works now

*** Bug 97195 has been marked as a duplicate of this bug. ***

Noel - interesting; it seems that some variant of this same issue pre-existed your fixes as well; since we see bug#97195 - before your re-work (and fix) - with a very similar stack-trace.

I wonder - would it be possible to back-port some sub-set of your cleanup & associated fix to -5-1 as well (and 5-0?).

Thanks !

On pc Debian x86-64 with master sources updated today, I don't reproduce this anymore.
Thank you Tomaz for the pointer and Noel for the fix! :-)

(In reply to Michael Meeks from comment #14)
> Noel - interesting; it seems that some variant of this same issue
> pre-existed your fixes as well; since we see bug#97195 - before your re-work
> (and fix) - with a very similar stack-trace.
> 
> I wonder - would it be possible to back-port some sub-set of your cleanup &
> associated fix to -5-1 as well (and 5-0?).
> 
> Thanks !

Back-porting to the latest Still would be very good for LO's image.

Unfortunately, this cleanup was pretty much all-or-nothing, since the shared_ptr infrastructure is pervasive throughout slideshow.

So backporting is not really an option.

This fix is already available in the latest stable build (5.2) anyhow.

It's not over yet. I've just downloaded 5.2.2.2 (Windows 64bit) and the bug is still there!

Actually the bug is in the latest Still: 5.1.5.2 too.

I need to continue work on a presentation soon. In which version was the bug introduced?

(In reply to Kumāra from comment #18)

> Actually the bug is in the latest Still: 5.1.5.2 too.
> 

steps for reproducion are the same as mine?