[Libreoffice-bugs] [Bug 138925] CRASH: "bad array new length" when editing table cells with faulty expressions

[bugzilla-daemon at bugs.documentfoundation.org]

https://bugs.documentfoundation.org/show_bug.cgi?id=138925

Justin L <jluth at mail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jluth at mail.com

--- Comment #7 from Justin L <jluth at mail.com> ---
Created attachment 169033
  --> https://bugs.documentfoundation.org/attachment.cgi?id=169033&action=edit
EXAMPLE_minimized.odt: about as small as I can get it

(In reply to raal from comment #4)
> It's OK in bibisect-linux-64-5.4 master, but crash in bibisect-linux-64-6.0
> oldest

Same problem with Linux bibisect-50max. Oldest fails, but master in
bibisect-44max is fine.

The backtrace is pointing to the font cache being out of sync. My debug message
prints out:
sw/source/core/txtnode/fntcache.cxx:1586: aStr is rInf.GetText[14.0][4] copy
from copyStart[23]rInf.Getidx[24] CopyLen[2]rInf.GetLen[2] to CopyLen[2]

so the code is trying to copy position 23-25 from "14.0" which doesn't work
very well.


Probably better leave this one to the experts, since this deals with
fundamentals. And of course the fundamentals are all messed up. Why are we even
getting to this section of the code? Why is rInf.GetBullet() even true for all
of the text. Why wouldn't aBulletOverlay = aStr instead of doing the same copy
all over again?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/libreoffice-bugs/attachments/20210120/e4dc59bb/attachment.htm>