Dangling SwAccessibleContext -> SwAccessibleMap

<http://ci.libreoffice.org/job/lo_tb_master_linux_dbg/5478/> crashed in 
JunitTest_sw_unoapi_1 with a SEGV as below.  Smells like the 
SwAccessibleContext (base class of SwAccessibleParagraph)'s m_pMap 
(pointing at an SwAccessibleMap) is dangling. The lifecycle of any 
SwAccessibleMap instances is controlled by SwViewShellImp (member 
m_pAccessibleMap, deleted during dtor).

It wouldn't even easily work to notify all SwAccessibleContext instances 
registered at SwViewShellImp::m_pAccessibleMap when the latter is 
destroyed (so that the former could clear their m_pMap members), as what 
gets registered in the map are not the SwAccessibleContext instances 
themselves, but their GetFrame() objects (cf. 
SwAccessibleContext::RemoveFrameFromAccessibleMap).

Any friend of the Writer and/or accessibility code got any idea?


> #0  0x00002b9ed7115bd0 in pthread_mutex_lock () at /lib64/libpthread.so.0
> #1  0x00002b9ed677f9fb in osl_acquireMutex(oslMutexImpl*) (pMutex=0x9999999999999999) at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/sal/osl/unx/mutex.cxx:99
>         nRet = 0
> #2  0x00002b9efb0a180d in osl::Mutex::acquire() (this=0x346b820) at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/include/osl/mutex.hxx:56
> #3  0x00002b9efb0a53c0 in osl::Guard<osl::Mutex>::Guard(osl::Mutex&) (this=0x2b9ef7d34fd0, t=...) 
> at /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/include/osl/mutex.hxx:129
> #4  0x00002b9efb0d36fc in SwAccessibleMap::RemoveContext(SwFrame const*) (this=0x346b810, 
> pFrame=0x2b6c2a0) at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/sw/source/core/access/accmap.cxx:2188
>         aGuard = {pT = 0x346b820}
> #5  0x00002b9efb0aea6a in SwAccessibleContext::RemoveFrameFromAccessibleMap() (this=0x346c9e0) at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/sw/source/core/access/acccontext.cxx:1417
> #6  0x00002b9efb0a9e96 in SwAccessibleContext::~SwAccessibleContext() (this=0x346c9e0, 
> __in_chrg=<optimized out>) at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/sw/source/core/access/acccontext.cxx:531
>         aGuard = {m_solarMutex = @0x17348e0}
> #7  0x00002b9efb0fdd6a in SwAccessibleParagraph::~SwAccessibleParagraph() (this=0x346c9c0, 
> __in_chrg=<optimized out>) at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/sw/source/core/access/accpara.cxx:560
> #8  0x00002b9efb0fddd0 in SwAccessibleParagraph::~SwAccessibleParagraph() (this=0x346c9c0, 
> __in_chrg=<optimized out>) at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/sw/source/core/access/accpara.cxx:569
> #9  0x00002b9ed8b8993c in cppu::OWeakObject::release() (this=0x346c9e0) at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/cppuhelper/source/weak.cxx:204
> #10 0x00002b9efb0a4e6a in cppu::WeakImplHelper<com::sun::star::accessibility::XAccessible, 
> com::sun::star::accessibility::XAccessibleContext, com::sun::star::accessibility::XAccessibleComponent, 
> com::sun::star::accessibility::XAccessibleEventBroadcaster, 
> com::sun::star::lang::XServiceInfo>::release() (this=0x346c9e0) at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/include/cppuhelper/implbase.hxx:113
> #11 0x00002b9efb110378 in SwAccessibleParagraph::release() (this=0x346c9c0) at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/sw/source/core/access/accpara.hxx:311
> #12 0x00002b9ef7394c48 in bridges::cpp_uno::shared::freeUnoInterfaceProxy(_uno_ExtEnvironment*, 
> void*) (pEnv=0x2538910, pProxy=0x346c970) at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/bridges/source/cpp_uno/shared/unointerfaceproxy.cxx:42
>         pThis = 0x346c970
>         __PRETTY_FUNCTION__ = "void bridges::cpp_uno::shared::freeUnoInterfaceProxy(uno_ExtEnvironment*, 
> void*)"
> #13 0x00002b9ed8821a5c in (anonymous namespace)::s_stub_defenv_revokeInterface(va_list*) 
> (pParam=0x2b9ef7d353e0) at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/cppu/source/uno/lbenv.cxx:373
>         rEntry = @0x346d1d0: {refCount = 2, pInterface = 0x346c970, fpFreeProxy = 0x2b9ef7394ba0 
> <bridges::cpp_uno::shared::freeUnoInterfaceProxy(_uno_ExtEnvironment*, void*)>, pTypeDescr = 
> 0x25c57e0}
>         nPos = 0
>         guard = {pT = 0x0}
>         pOEntry = 0x346c4d0
>         pEnv = 0x2538910
>         pInterface = 0x2a01970
>         that = 0x2538910
>         iFind = {<std::__detail::_Node_iterator_base<std::pair<void* const, (anonymous 
> namespace)::ObjectEntry*>, true>> = {_M_cur = }, <No data fields>}
> #14 0x00002b9ed881c1cc in s_environment_invoke_v(uno_Environment*, uno_Environment*, uno_EnvCallee*, 
> va_list*) (pCurrEnv=0x0, pTargetEnv=0x2538910, pCallee=0x2b9ed88216d0 <(anonymous 
> namespace)::s_stub_defenv_revokeInterface(va_list*)>, pParam=0x2b9ef7d353e0) at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/cppu/source/uno/EnvStack.cxx:293
>         hld = 0x0
>         pNextEnv = 0x0
> #15 0x00002b9ed881c27e in uno_Environment_invoke_v(uno_Environment*, uno_EnvCallee*, va_list*) 
> (pTargetEnv=0x2538910, pCallee=0x2b9ed88216d0 <(anonymous 
> namespace)::s_stub_defenv_revokeInterface(va_list*)>, pParam=0x2b9ef7d353e0) at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/cppu/source/uno/EnvStack.cxx:312
> #16 0x00002b9ed881c350 in uno_Environment_invoke(uno_Environment*, uno_EnvCallee*, ...) (pEnv=0x2538910, 
> pCallee=0x2b9ed88216d0 <(anonymous namespace)::s_stub_defenv_revokeInterface(va_list*)>) at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/cppu/source/uno/EnvStack.cxx:321
>         param = {{gp_offset = 32, fp_offset = 48, overflow_arg_area = 0x2b9ef7d354c0, reg_save_area 
> = 0x2b9ef7d35400}}
> #17 0x00002b9ed8821eae in (anonymous namespace)::defenv_revokeInterface(uno_ExtEnvironment*, void*) 
> (pEnv=0x2538910, pInterface=0x2a01970) at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/cppu/source/uno/lbenv.cxx:427
> #18 0x00002b9ef7394d6d in bridges::cpp_uno::shared::releaseProxy(_uno_Interface*) (pUnoI=0x2a01970) 
> at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/bridges/source/cpp_uno/shared/unointerfaceproxy.cxx:83
> #19 0x00002b9ef860bd61 in com::sun::star::uno::UnoInterfaceReference::~UnoInterfaceReference() 
> (this=0x2b9ef7d35560, __in_chrg=<optimized out>) at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/include/uno/dispatcher.hxx:92
> #20 0x00002b9ef860675f in binaryurp::Bridge::releaseStub(rtl::OUString const&, 
> com::sun::star::uno::TypeDescription const&) (this=0x2537720, oid=..., type=...) at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/binaryurp/source/bridge.cxx:511
>         __PRETTY_FUNCTION__ = "void binaryurp::Bridge::releaseStub(const rtl::OUString&, const 
> com::sun::star::uno::TypeDescription&)"
>         obj = {m_pUnoI = 0x2a01970}
>         unused = false
> #21 0x00002b9ef8625da1 in binaryurp::IncomingRequest::execute_throw(binaryurp::BinaryAny*, 
> std::__debug::vector<binaryurp::BinaryAny, std::allocator<binaryurp::BinaryAny> >*) const 
> (this=0x2d60640, returnValue=0x2b9ef7d35a10, outArguments=0x2b9ef7d35a90) at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/binaryurp/source/incomingrequest.cxx:136
>         isExc = false
> #22 0x00002b9ef862552f in binaryurp::IncomingRequest::execute() const (this=0x2d60640) at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/binaryurp/source/incomingrequest.cxx:73
>         resetCc = false
>         oldCc = {m_pUnoI = 0x0}
>         ret = {data_ = {pType = 0x174c7f0, pData = 0xdeadbeef, pReserved = 0x2b9ef7d35ae7}}
>         outArgs = std::__debug::vector of length 0, capacity 0
>         isExc = false
> #23 0x00002b9ef8645f3e in binaryurp::(anonymous namespace)::request(void*) 
> (pThreadSpecificData=0x2d60640) at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/binaryurp/source/reader.cxx:85
>         __PRETTY_FUNCTION__ = "void binaryurp::{anonymous}::request(void*)"
> #24 0x00002b9ed87e7805 in cppu_threadpool::JobQueue::enter(long, bool) (this=0x2dcd990, 
> nDisposeId=41467568, bReturnWhenNoJob=true) at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/cppu/source/threadpool/jobqueue.cxx:107
>         guard = {pT = 0x2dcd990}
>         job = {pThreadSpecificData = 0x2d60640, doRequest = 0x2b9ef8645ed5 <binaryurp::(anonymous 
> namespace)::request(void*)>}
>         pReturn = 0x0
> #25 0x00002b9ed87eb25b in cppu_threadpool::ORequestThread::run() (this=0x278beb0) at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/cppu/source/threadpool/thread.cxx:172
> #26 0x00002b9ed87eb6a5 in osl::threadFunc(void*) (param=0x278bec0) at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/include/osl/thread.hxx:185
>         pObj = 0x278bec0
> #27 0x00002b9ed6793854 in osl_thread_start_Impl(void*) (pData=0x33eb5f0) at 
> /home/tdf/lode/jenkins/workspace/lo_tb_master_linux_dbg/sal/osl/unx/thread.cxx:240
>         terminate = false
>         pImpl = 0x33eb5f0
>         __PRETTY_FUNCTION__ = "void* osl_thread_start_Impl(void*)"
> #28 0x00002b9ed7113dc5 in start_thread () at /lib64/libpthread.so.0
> #29 0x00002b9ed6e4121d in clone () at /lib64/libc.so.6