tdf#64711 pointer deleted out from under std::shared_ptr

the "end" call will close the shell, which is deleted directly so the local shared_ptr remains
pointed to something which is already deleted.

So:
a) Have activate return true/false to indicate the failure and require the caller to call
'end' in response to failure.
b) A bunch of stuff in the call-stack expects the ViewShell not to get deleted while they are
calling it, so additionally launch that 'end' to happen in the next event loop.

==2838867== Invalid read of size 8
==2838867==    at 0x32F4B83C: sd::ViewShellBase::GetDocShell() const (ViewShellBase.hxx:97)
==2838867==    by 0x335BBCFC: sd::ViewShell::GetDocSh() const (viewshel.cxx:1389)
==2838867==    by 0x3357CAC1: sd::PresentationViewShell::~PresentationViewShell() (presvish.cxx:73)
==2838867==    by 0x330AA34B: void __gnu_cxx::new_allocator<sd::PresentationViewShell>::destroy<sd::PresentationViewShell>(sd::PresentationViewShell*) (new_allocator.h:156)
==2838867==    by 0x330AA2DF: void std::allocator_traits<std::allocator<sd::PresentationViewShell> >::destroy<sd::PresentationViewShell>(std::allocator<sd::PresentationViewShell>&, sd::PresentationViewShell*) (alloc_traits.h:531)
==2838867==    by 0x330AA0BE: std::_Sp_counted_ptr_inplace<sd::PresentationViewShell, std::allocator<sd::PresentationViewShell>, (__gnu_cxx::_Lock_policy)2>::_M_dispose() (shared_ptr_base.h:560)
==2838867==    by 0x32D10D33: std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release() (shared_ptr_base.h:158)
==2838867==    by 0x32D10C79: std::__shared_count<(__gnu_cxx::_Lock_policy)2>::~__shared_count() (shared_ptr_base.h:733)
==2838867==    by 0x330A03BD: std::__shared_ptr<sd::PresentationViewShell, (__gnu_cxx::_Lock_policy)2>::~__shared_ptr() (shared_ptr_base.h:1183)
==2838867==    by 0x3309F847: std::shared_ptr<sd::PresentationViewShell>::~shared_ptr() (shared_ptr.h:121)
==2838867==    by 0x3320E1E8: sd::SlideShow::activate(sd::ViewShellBase&) (slideshow.cxx:999)
==2838867==    by 0x3357CF33: sd::PresentationViewShell::Activate(bool) (presvish.cxx:118)

==2838867==  Address 0x2fb5f320 is 256 bytes inside a block of size 272 free'd
==2838867==    at 0x483BEDD: operator delete(void*) (vg_replace_malloc.c:584)
==2838867==    by 0x33466537: sd::PresentationViewShellBase::~PresentationViewShellBase() (PresentationViewShellBase.cxx:82)
==2838867==    by 0x823076C: SfxViewFrame::ReleaseObjectShell_Impl() (viewfrm.cxx:1113)
==2838867==    by 0x8234B1C: SfxViewFrame::~SfxViewFrame() (viewfrm.cxx:1652)
==2838867==    by 0x8234FEB: SfxViewFrame::~SfxViewFrame() (viewfrm.cxx:1646)
==2838867==    by 0x8230D6C: SfxViewFrame::Close() (viewfrm.cxx:1165)
==2838867==    by 0x81E4217: SfxFrame::DoClose_Impl() (frame.cxx:142)
==2838867==    by 0x821709A: SfxBaseController::dispose() (sfxbasecontroller.cxx:982)
==2838867==    by 0x3337A59F: sd::DrawController::dispose() (DrawController.cxx:164)
==2838867==    by 0x6F35CC0: (anonymous namespace)::XFrameImpl::setComponent(com::sun::star::uno::Reference<com::sun::star::awt::XWindow> const&, com::sun::star::uno::Reference<com::sun::star::frame::XController> const&) (frame.cxx:1485)
==2838867==    by 0x6F3834E: (anonymous namespace)::XFrameImpl::close(unsigned char) (frame.cxx:1692)
==2838867==    by 0x81E3CFA: SfxFrame::DoClose() (frame.cxx:108)
==2838867==    by 0x823802C: SfxViewFrame::DoClose() (viewfrm.cxx:2525)
==2838867==    by 0x3320B971: sd::SlideShow::end() (slideshow.cxx:696)
==2838867==    by 0x3320E1C2: sd::SlideShow::activate(sd::ViewShellBase&) (slideshow.cxx:995)
==2838867==    by 0x3357CF33: sd::PresentationViewShell::Activate(bool) (presvish.cxx:118)

Change-Id: Ida91228b7584491c9a5dc9c0b3f76ce63218a92a
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/103319
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>

0 files changed, 0 insertions, 0 deletions