Lets hold our breath and gloss over the -horrible- details of passing
raw pointers through an UNO sequence as a byte array and then ... [ it
seems the D&D code - which is also threaded ] is some living nightmare
in this regard ;-)
Anyhow - the question is: how to find this stuff ? the problem being
that when you track every one of the (2000+) acquire/releases on the
underlying ref-count they all appear to be correct: there are just more
releases than there should be. [ the ref-count is stored in the object
not the VclPtr which is clobbered ].
Anyhow - here is how:
a) run soffice.bin under gdb:
gdb --args ./soffice.bin 2>&1 | tee /tmp/gdb-log.txt
place a breakpoint in the 'makeFoo' function you're
interested in - it is rather useful to get this function
before the construction really gets going.
This creates a hardware watch-point so whenever the ref-count
changes you get a trace.
(gdb) set pagination off
<it will break shortly afterwards>
This will then produce a log of all stack frames that maniplate the
'mnRefCnt' - in my case this produced 2000+ of them or so ;-)
It is probable that you want a dbgutil build - or at least one with
When you hit your crash quit gdb.
You should have a nice gdb-log.txt now.
$ cat gdb-log.txt | chase.pl
Problematic ref-count mis-matches on VclPtr instances with values:
Search for the above pointer values in your log.
Then look for the above ptr values in your log eg.
Old value = 22
New value = 21
0x00007ffff2af3647 in OutputDevice::release (this=0x2252e10) at /data/opt/libreoffice/master/include/vcl/outdev.hxx:284
284 if (!--mnRefCnt)
#0 0x00007ffff2af3647 in OutputDevice::release (this=0x2252e10) at /data/opt/libreoffice/master/include/vcl/outdev.hxx:284
#1 0x00007ffff2baa6bb in rtl::Reference<SvTreeListBox>::~Reference (this=0x7fffd7391148, __in_chrg=<optimized out>) at /data/opt/libreoffice/master/include/rtl/ref.hxx:81
#2 0x00007ffff2ba9eca in VclPtr<SvTreeListBox>::~VclPtr (this=0x7fffd7391148, __in_chrg=<optimized out>) at /data/opt/libreoffice/master/include/vcl/vclptr.hxx:83
******* ^^^^^^^^^^^^^^ matching mis-counted VclPtr 'this'
#3 0x00007ffff2bdf75e in SvLBoxDDInfo::~SvLBoxDDInfo (this=0x7fffd7391140, __in_chrg=<optimized out>) at /data/opt/libreoffice/master/include/svtools/treelistbox.hxx:820
#4 0x00007ffff2bd4fdd in SvTreeListBox::ExecuteDrop (this=0x222eda0, rEvt=..., pSourceView=0x2252e10) at /data/opt/libreoffice/master/svtools/source/contnr/treelistbox.cxx:1282
And this of course took me straight to the SvLBoxDDInfo code.