[Libreoffice-commits] core.git: Branch 'libreoffice-4-1' - sw/inc sw/source

[Caolán McNamara]

 sw/inc/anchoredobject.hxx                |    7 ++-----
 sw/source/core/inc/layfrm.hxx            |   14 ++++++++++++++
 sw/source/core/layout/anchoredobject.cxx |   12 ++++++++++++
 sw/source/core/layout/ssfrm.cxx          |    8 ++++++++
 4 files changed, 36 insertions(+), 5 deletions(-)

New commits:
commit 7eae50f9ff5877ef880be9a85d3f7e52b1fec49f
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Nov 8 14:53:42 2013 +0000

    Access by AnchoredObject of a deleted SwLayoutFrm
    
    as demonstrated by abi10075-1.doc
    
    just register the AnchoredObjects in the SwLayoutFrm and
    inform them when the SwLayoutFrm goes away.
    
    This crash was triggered by "1e113cb7604e1509e7d598a9be329f1f7b6e9322" import
    different first page header/footer from doc. But that commit is blameless.
    
    Change-Id: Ia079cc635a81dff1ccbf740641f441aa784328a4
    (cherry picked from commit b376eacdfae11f5d39eb7011efe67390d9f495e7)
    Reviewed-on: https://gerrit.libreoffice.org/6622
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Tested-by: Michael Stahl <mstahl at redhat.com>

diff --git a/sw/inc/anchoredobject.hxx b/sw/inc/anchoredobject.hxx
index cc5edbf..ff4b88ad 100644
--- a/sw/inc/anchoredobject.hxx
+++ b/sw/inc/anchoredobject.hxx
@@ -269,15 +269,12 @@ class SW_DLLPUBLIC SwAnchoredObject
 
         // accessors to data of position calculation:
         // frame vertical position is orient at
-        inline const SwLayoutFrm* GetVertPosOrientFrm() const
+        const SwLayoutFrm* GetVertPosOrientFrm() const
         {
             return mpVertPosOrientFrm;
         }
         // method to clear member <mpVertPosOrientFrm>
-        inline void ClearVertPosOrientFrm()
-        {
-            mpVertPosOrientFrm = 0L;
-        }
+        void ClearVertPosOrientFrm();
 
         /** check anchor character rectangle and top of line
 
diff --git a/sw/source/core/inc/layfrm.hxx b/sw/source/core/inc/layfrm.hxx
index fdd6b7c..d17b6e5 100644
--- a/sw/source/core/inc/layfrm.hxx
+++ b/sw/source/core/inc/layfrm.hxx
@@ -21,6 +21,7 @@
 
 #include "frame.hxx"
 
+class SwAnchoredObject;
 class SwCntntFrm;
 class SwFlowFrm;
 class SwFmtCol;
@@ -53,6 +54,7 @@ protected:
     virtual void MakeAll();
 
     SwFrm           *pLower;
+    std::vector<SwAnchoredObject*> aVertPosOrientFrmsFor;
 
     virtual SwTwips ShrinkFrm( SwTwips, sal_Bool bTst = sal_False, sal_Bool bInfo = sal_False );
     virtual SwTwips GrowFrm  ( SwTwips, sal_Bool bTst = sal_False, sal_Bool bInfo = sal_False );
@@ -164,6 +166,18 @@ public:
     inline SwFrm* GetLastLower();
 
     virtual void PaintBreak() const;
+
+    void SetVertPosOrientFrmFor(SwAnchoredObject *pObj)
+    {
+        aVertPosOrientFrmsFor.push_back(pObj);
+    }
+
+    void ClearVertPosOrientFrmFor(SwAnchoredObject *pObj)
+    {
+        aVertPosOrientFrmsFor.erase(
+            std::remove(aVertPosOrientFrmsFor.begin(),
+                aVertPosOrientFrmsFor.end(), pObj), aVertPosOrientFrmsFor.end());
+    }
 };
 
 //Um doppelte Implementierung zu sparen wird hier ein bischen gecasted
diff --git a/sw/source/core/layout/anchoredobject.cxx b/sw/source/core/layout/anchoredobject.cxx
index ab4a193..77cf548 100644
--- a/sw/source/core/layout/anchoredobject.cxx
+++ b/sw/source/core/layout/anchoredobject.cxx
@@ -107,8 +107,18 @@ SwAnchoredObject::SwAnchoredObject() :
 {
 }
 
+void SwAnchoredObject::ClearVertPosOrientFrm()
+{
+    if (mpVertPosOrientFrm)
+    {
+        const_cast<SwLayoutFrm*>(mpVertPosOrientFrm)->ClearVertPosOrientFrmFor(this);
+        mpVertPosOrientFrm = NULL;
+    }
+}
+
 SwAnchoredObject::~SwAnchoredObject()
 {
+    ClearVertPosOrientFrm();
 }
 
 // =============================================================================
@@ -238,6 +248,8 @@ void SwAnchoredObject::SetVertPosOrientFrm( const SwLayoutFrm& _rVertPosOrientFr
 {
     mpVertPosOrientFrm = &_rVertPosOrientFrm;
 
+    const_cast<SwLayoutFrm*>(mpVertPosOrientFrm)->SetVertPosOrientFrmFor(this);
+
     // #i28701# - take over functionality of deleted method
     // <SwFlyAtCntFrm::AssertPage()>: assure for at-paragraph and at-character
     // an anchored object, that it is registered at the correct page frame
diff --git a/sw/source/core/layout/ssfrm.cxx b/sw/source/core/layout/ssfrm.cxx
index 4ae962e..1fc5ff0 100644
--- a/sw/source/core/layout/ssfrm.cxx
+++ b/sw/source/core/layout/ssfrm.cxx
@@ -557,6 +557,14 @@ void SwCntntFrm::DelFrms( const SwCntntNode& rNode )
 
 void SwLayoutFrm::Destroy()
 {
+    while (!aVertPosOrientFrmsFor.empty())
+    {
+        SwAnchoredObject *pObj = *aVertPosOrientFrmsFor.begin();
+        pObj->ClearVertPosOrientFrm();
+    }
+
+    assert(aVertPosOrientFrmsFor.empty());
+
     SwFrm *pFrm = pLower;
 
     if( GetFmt() && !GetFmt()->GetDoc()->IsInDtor() )