Need help for bug 158451

[Michael Stahl]

hi Regina,

On 14/12/2023 01:26, Regina Henschel wrote:
> Hi all,
> 
> I can now narrow down the error somewhat.
> 
> Look at method SwTextFrame::FormatImpl() in
> https://opengrok.libreoffice.org/xref/core/sw/source/core/text/frmform.cxx?r=7d7ca347#1832
> It creates
>     SwTextFormatInfo aInf( pRenderContext, this );
> Later down in the for-loop, aInf is used. The for-loop iterates over
>     pObj = aInf.GetTextFly().GetAnchoredObjList()
> and performs
>     aInf.GetTextFly().AnchoredObjToRect(pObj, aRect)
> AnchoredObjToRect crashes then because of an invalid pObj.
> 
> You see the AnchoredObjList with these steps:
> aInf > SwTextPaintInfo > m_aTextFly > mpAnchoredObjList
> 
> When aInf is created, mpAnchoredObjList is empty.
> After line #1863
>      Format_( aLine, aInf );
> you can see the invalid item in that list.
> 
> This happens not always. When you use the example file of the bug 
> report, first the text of the shape inside the group is handled. That 
> works. Then the line where the group is anchored is handled. And there 
> it happens.
> If the inline anchored object is not a group but a simple shape with 
> text, first the line is handled and then the text of the shape.

the problem is that the type of anchor of the inner shape changes during 
text formatting, which is not supposed to happen.

hope https://gerrit.libreoffice.org/c/core/+/161137 should fix the crash.