[Libreoffice-commits] core.git: 2 commits - sw/source

[Michael Stahl]

 sw/source/core/access/accmap.cxx   |    5 ++++-
 sw/source/core/layout/calcmove.cxx |    6 ++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

New commits:
commit c99f72bebdce6d294eb47e070fa1397a98ba2087
Author: Michael Stahl <mstahl at redhat.com>
Date:   Fri Apr 21 23:50:23 2017 +0200

    sw: fix a11y crash on double Dispose
    
    When testing with the bugdoc for tdf#107126, it happend that upon
    applying a page style, SwAccessibleContext::Dispose() was called twice,
    and that's not supposed to happen (and crashes, too, at least inside
    an assertion).
    
    There was an Action that queued up a bunch of events, but the Action did
    not complete formatting the document, so right after that during Paint
    more formatting happened and then the FireEvents() called Dispose()
    and InvalidatePosOrSize() called it again.  Guess we shouldn't generate
    events for objects that we know are disposed due to not being visible.
    
    Change-Id: I5a0f04c0f32ee5e949b552f7a373c10ceee5c279

diff --git a/sw/source/core/access/accmap.cxx b/sw/source/core/access/accmap.cxx
index 0e3d01b66f45..bf530abb7349 100644
--- a/sw/source/core/access/accmap.cxx
+++ b/sw/source/core/access/accmap.cxx
@@ -2390,7 +2390,10 @@ void SwAccessibleMap::InvalidatePosOrSize( const SwFrame *pFrame,
             else
             {
                 FireEvents();
-                xAccImpl->InvalidatePosOrSize( rOldBox );
+                if (xAccImpl->GetMap()) // not if disposed by FireEvents()
+                {
+                    xAccImpl->InvalidatePosOrSize(rOldBox);
+                }
             }
         }
         else if( xParentAccImpl.is() )
commit 4d43f9e9dda5edeeb6e4b99487b5b6a1fae4bd56
Author: Michael Stahl <mstahl at redhat.com>
Date:   Fri Apr 21 22:44:14 2017 +0200

    tdf#107126 sw: fix layout crash with section in footnote
    
    SwContentFrame::WouldFit_() contains a hack to temporarily reparent a
    SwTextFrame.  In the bugdoc, there is a SwTextFrame below a
    SwSectionFrame below a SwFootnoteFrame.  The reparenting ignores the
    SwSectionFrame so the result is a SwTextFrame below SwFootnoteFrame, but
    it still has its mbInfSct set, hence crashes with a null pointer.
    
    If the SwTextFrame is permanently moved later on, in
    SwFlowFrame::MoveBwd() line 2450 a new SwSectionFrame is created.
    
    Change-Id: I45a7ab793b4459e551bd11b7fb83dedc58a6c8da

diff --git a/sw/source/core/layout/calcmove.cxx b/sw/source/core/layout/calcmove.cxx
index 26eda5e3fef2..65fab03a33c8 100644
--- a/sw/source/core/layout/calcmove.cxx
+++ b/sw/source/core/layout/calcmove.cxx
@@ -1868,6 +1868,11 @@ bool SwContentFrame::WouldFit_( SwTwips nSpace,
             SwFrame *pOldNext = pTmpFrame->GetNext();
             pTmpFrame->RemoveFromLayout();
             pTmpFrame->InsertBefore( pNewUpper, nullptr );
+            // tdf#107126 for a section in a footnote, we have only inserted
+            // the SwTextFrame but no SwSectionFrame - reset mbInfSct flag
+            // to avoid crashing (but perhaps we should create a temp
+            // SwSectionFrame here because WidowsAndOrphans checks for that?)
+            pTmpFrame->InvalidateInfFlags();
             if ( pFrame->IsTextFrame() &&
                  ( bTstMove ||
                    static_cast<SwTextFrame*>(pFrame)->HasFollow() ||
@@ -1885,6 +1890,7 @@ bool SwContentFrame::WouldFit_( SwTwips nSpace,
 
             pTmpFrame->RemoveFromLayout();
             pTmpFrame->InsertBefore( pUp, pOldNext );
+            pTmpFrame->InvalidateInfFlags(); // restore flags
         }
         else
         {