[Libreoffice-commits] core.git: Branch 'distro/collabora/cp-5.3' - 10 commits - formula/source include/formula sc/source sd/source sfx2/source sw/inc sw/qa sw/source vcl/unx

Jan-Marek Glogowski glogow at fbihome.de
Thu Jul 6 18:56:07 UTC 2017


 formula/source/core/api/FormulaCompiler.cxx |    8 ++-
 include/formula/FormulaCompiler.hxx         |    1 
 sc/source/core/tool/token.cxx               |   59 ++++++++++++++++++++++++++++
 sc/source/filter/oox/pagesettings.cxx       |    2 
 sc/source/ui/docshell/docsh4.cxx            |    7 +++
 sd/source/ui/view/drviews6.cxx              |   17 +++-----
 sfx2/source/sidebar/ResourceManager.cxx     |    5 +-
 sw/inc/calc.hxx                             |    8 ++-
 sw/qa/extras/uiwriter/uiwriter.cxx          |   18 ++++++++
 sw/source/core/bastyp/calc.cxx              |    8 +++
 sw/source/core/layout/ftnfrm.cxx            |    3 -
 sw/source/uibase/dbui/dbmgr.cxx             |    8 +++
 sw/source/uibase/inc/uivwimp.hxx            |    2 
 sw/source/uibase/uiview/uivwimp.cxx         |   21 +++++----
 vcl/unx/gtk3/gtk3gtkframe.cxx               |    9 ++--
 15 files changed, 145 insertions(+), 31 deletions(-)

New commits:
commit f2569b85c850aca8b92dfc92aa658c351444b1da
Author: Jan-Marek Glogowski <glogow at fbihome.de>
Date:   Tue Jul 4 17:15:14 2017 +0200

    tdf#108873 fix merge data handling in fields
    
    This is a regression from tdf#70346 /
      commit 4851cde7b98226b0f82ae2b191c290173e9b06c6
    
    It added the whole DB row as variables to the SwCalc hash set.
    This works correct for conditionals when hiding sections, but not
    for conditionals used in fields - actually they break.
    
    Previously the field would do a fallback to query the DB again, if
    no variable was in the dict and the only possible variables in the
    dict could have been user-defined fields.
    
    This handles the added variables correctly for fields.
    
    Also fixes a bug to store the DB number values as number variables
    and adds the record number, as SwCalc::VarLook does.
    
    Change-Id: Ib0dbeda68234e671768ede55b2012235a3680276
    Reviewed-on: https://gerrit.libreoffice.org/39509
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Samuel Mehrbrodt <Samuel.Mehrbrodt at cib.de>
    (cherry picked from commit f54c6938f73b94fb6f722f3ea68454fee424e62e)
    Reviewed-on: https://gerrit.libreoffice.org/39613
    (cherry picked from commit 5cde0b62fd074bca132caf6b6010aa002ccf7c87)

diff --git a/sw/inc/calc.hxx b/sw/inc/calc.hxx
index 8f54ab3bb385..4bf0ec2580cb 100644
--- a/sw/inc/calc.hxx
+++ b/sw/inc/calc.hxx
@@ -102,10 +102,11 @@ enum SwCalcError
 class SwSbxValue : public SbxValue
 {
     bool bVoid;
+    bool bDBvalue;
 public:
     // always default to a number. otherwise it will become a SbxEMPTY
-    SwSbxValue( long n = 0 ) : bVoid(false)  { PutLong( n ); }
-    SwSbxValue( const double& rD ) : bVoid(false) { PutDouble( rD ); }
+    SwSbxValue( long n = 0 ) : bVoid(false), bDBvalue(false)  { PutLong( n ); }
+    SwSbxValue( const double& rD ) : bVoid(false), bDBvalue(false) { PutDouble( rD ); }
 
     bool GetBool() const;
     double GetDouble() const;
@@ -113,6 +114,9 @@ public:
 
     bool IsVoidValue() {return bVoid;}
     void SetVoidValue(bool bSet) {bVoid = bSet;}
+
+    bool IsDBvalue() {return bDBvalue;}
+    void SetDBvalue(bool bSet) {bDBvalue = bSet;}
 };
 
 // Calculate HashTables for VarTable und Operations
diff --git a/sw/source/core/bastyp/calc.cxx b/sw/source/core/bastyp/calc.cxx
index 3f2d0ba89781..a8090a3423dd 100644
--- a/sw/source/core/bastyp/calc.cxx
+++ b/sw/source/core/bastyp/calc.cxx
@@ -499,6 +499,14 @@ SwCalcExp* SwCalc::VarLook( const OUString& rStr, bool bIns )
                 pFndExp->nValue.PutDouble( pUField->GetValue() );
             }
         }
+        else if ( !pFndExp->pFieldType && pFndExp->nValue.IsDBvalue() )
+        {
+            if ( pFndExp->nValue.IsString() )
+                m_aErrExpr.nValue.PutString( pFndExp->nValue.GetOUString() );
+            else if ( pFndExp->nValue.IsDouble() )
+                m_aErrExpr.nValue.PutDouble( pFndExp->nValue.GetDouble() );
+            pFndExp = &m_aErrExpr;
+        }
         return pFndExp;
     }
 
diff --git a/sw/source/uibase/dbui/dbmgr.cxx b/sw/source/uibase/dbui/dbmgr.cxx
index 9adf98c24340..991b6127c251 100644
--- a/sw/source/uibase/dbui/dbmgr.cxx
+++ b/sw/source/uibase/dbui/dbmgr.cxx
@@ -2164,6 +2164,10 @@ bool SwDBManager::FillCalcWithMergeData( SvNumberFormatter *pDocFormatter,
         const OUString* pColNames = aColNames.getConstArray();
         OUString aString;
 
+        // add the "record number" variable, as SwCalc::VarLook would.
+        rCalc.VarChange( GetAppCharClass().lowercase(
+            SwFieldType::GetTypeStr(TYP_DBSETNUMBERFLD) ), GetSelectedRecordId() );
+
         for( int nCol = 0; nCol < aColNames.getLength(); nCol++ )
         {
             // get the column type
@@ -2189,7 +2193,8 @@ bool SwDBManager::FillCalcWithMergeData( SvNumberFormatter *pDocFormatter,
                 if( bValidValue )
                 {
                     SwSbxValue aValue;
-                    aValue.PutString( aString );
+                    aValue.PutDouble( aNumber );
+                    aValue.SetDBvalue( true );
                     SAL_INFO( "sw.ui", "'" << pColNames[nCol] << "': " << aNumber << " / " << aString );
                     rCalc.VarChange( pColNames[nCol], aValue );
                 }
@@ -2198,6 +2203,7 @@ bool SwDBManager::FillCalcWithMergeData( SvNumberFormatter *pDocFormatter,
             {
                 SwSbxValue aValue;
                 aValue.PutString( aString );
+                aValue.SetDBvalue( true );
                 SAL_INFO( "sw.ui", "'" << pColNames[nCol] << "': " << aString );
                 rCalc.VarChange( pColNames[nCol], aValue );
             }
commit 7ae220a53b671175a0f15e3ee70ed5b28de1f008
Author: Eike Rathke <erack at redhat.com>
Date:   Tue Jul 4 15:22:23 2017 +0200

    Set error on more than max params (255) per function
    
    Parameter count is size byte, so.. SUM(1,1,1,...) with 256 arguments resulted
    in 0 (uint8 wrapping around).
    
    (cherry picked from commit 209cc5c211260a6c20cc6fb5ac02fd5a88100314)
    
    Change-Id: Ib9997ad0d0d13d4c5171f276148b6c5cad570d5b
    Reviewed-on: https://gerrit.libreoffice.org/39506
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    (cherry picked from commit 1d1bdfd94fc2963d0281ea4fd8d3a98e39f4ccf7)

diff --git a/formula/source/core/api/FormulaCompiler.cxx b/formula/source/core/api/FormulaCompiler.cxx
index 07c39037585a..2a561d2182e3 100644
--- a/formula/source/core/api/FormulaCompiler.cxx
+++ b/formula/source/core/api/FormulaCompiler.cxx
@@ -1511,7 +1511,7 @@ void FormulaCompiler::Factor()
                 }
                 else
                     SetError( FormulaError::PairExpected);
-                sal_uInt8 nSepCount = 0;
+                sal_uInt32 nSepCount = 0;
                 const sal_uInt16 nSepPos = pArr->nIndex - 1;    // separator position, if any
                 if( !bNoParam )
                 {
@@ -1521,6 +1521,8 @@ void FormulaCompiler::Factor()
                         NextToken();
                         CheckSetForceArrayParameter( mpToken, nSepCount);
                         nSepCount++;
+                        if (nSepCount > FORMULA_MAXPARAMS)
+                            SetError( FormulaError::CodeOverflow);
                         eOp = Expression();
                     }
                 }
@@ -1617,7 +1619,7 @@ void FormulaCompiler::Factor()
             }
             else
                 SetError( FormulaError::PairExpected);
-            sal_uInt8 nSepCount = 0;
+            sal_uInt32 nSepCount = 0;
             if( !bNoParam )
             {
                 nSepCount++;
@@ -1626,6 +1628,8 @@ void FormulaCompiler::Factor()
                     NextToken();
                     CheckSetForceArrayParameter( mpToken, nSepCount);
                     nSepCount++;
+                    if (nSepCount > FORMULA_MAXPARAMS)
+                        SetError( FormulaError::CodeOverflow);
                     eOp = Expression();
                 }
             }
diff --git a/include/formula/FormulaCompiler.hxx b/include/formula/FormulaCompiler.hxx
index 37da2ef8becc..5293c504b1dd 100644
--- a/include/formula/FormulaCompiler.hxx
+++ b/include/formula/FormulaCompiler.hxx
@@ -38,6 +38,7 @@
 
 #define FORMULA_MAXJUMPCOUNT    32  /* maximum number of jumps (ocChoose) */
 #define FORMULA_MAXTOKENS     8192  /* maximum number of tokens in formula */
+#define FORMULA_MAXPARAMS      255  /* maximum number of parameters per function (byte) */
 
 
 namespace com { namespace sun { namespace star {
commit 3d39e0e1456aa00baa68c0a7e38b864a9b9a4d9e
Author: Miklos Vajna <vmiklos at collabora.co.uk>
Date:   Sat May 27 10:47:53 2017 +0200

    tdf#107976 sw: let a view handle multiple transferables
    
    Otherwise only the last transferable gets unregistered on closing the
    view, which means a use-after-free when trying to paste something copied
    from a closed document.
    
    (cherry picked from commit 336f893c57c3c0281d4899629ad55603837d5d40)
    
    Conflicts:
            sw/qa/extras/uiwriter/uiwriter.cxx
            sw/source/uibase/inc/uivwimp.hxx
    
    Reviewed-on: https://gerrit.libreoffice.org/39499
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit 747be68119f2c85f1cdf6151fac67cd8cb840b76)
    
    Change-Id: I65594e07fa4fefe7ae51a12455b755d64700a00d

diff --git a/sw/qa/extras/uiwriter/uiwriter.cxx b/sw/qa/extras/uiwriter/uiwriter.cxx
index b3c0ff237025..90b54c38d19d 100644
--- a/sw/qa/extras/uiwriter/uiwriter.cxx
+++ b/sw/qa/extras/uiwriter/uiwriter.cxx
@@ -90,6 +90,7 @@
 #include <drawfont.hxx>
 #include <txtfrm.hxx>
 #include <hyp.hxx>
+#include <swdtflvr.hxx>
 #include <editeng/svxenum.hxx>
 #include <comphelper/propertysequence.hxx>
 #include <sfx2/classificationhelper.hxx>
@@ -230,6 +231,7 @@ public:
     void testTdf104814();
     void testTdf105417();
     void testTdf105625();
+    void testTdf107976();
     void testCreateDocxAnnotation();
 
     CPPUNIT_TEST_SUITE(SwUiWriterTest);
@@ -353,6 +355,7 @@ public:
     CPPUNIT_TEST(testTdf104814);
     CPPUNIT_TEST(testTdf105417);
     CPPUNIT_TEST(testTdf105625);
+    CPPUNIT_TEST(testTdf107976);
     CPPUNIT_TEST(testCreateDocxAnnotation);
     CPPUNIT_TEST_SUITE_END();
 
@@ -4475,6 +4478,21 @@ void SwUiWriterTest::testCreateDocxAnnotation()
     CPPUNIT_ASSERT_EQUAL(aResultText, xField->getPropertyValue("Content").get<OUString>());
 }
 
+void SwUiWriterTest::testTdf107976()
+{
+    // Create a document and create two transferables.
+    SwDoc* pDoc = createDoc();
+    SwWrtShell& rShell = *pDoc->GetDocShell()->GetWrtShell();
+    rtl::Reference<SwTransferable> pTransferable(new SwTransferable(rShell));
+    rtl::Reference<SwTransferable> pTransferable2(new SwTransferable(rShell));
+    // Now close the document.
+    mxComponent->dispose();
+    mxComponent.clear();
+    // This failed: the first shell had a pointer to the deleted shell.
+    CPPUNIT_ASSERT(!pTransferable->GetShell());
+    CPPUNIT_ASSERT(!pTransferable2->GetShell());
+}
+
 CPPUNIT_TEST_SUITE_REGISTRATION(SwUiWriterTest);
 CPPUNIT_PLUGIN_IMPLEMENT();
 
diff --git a/sw/source/uibase/inc/uivwimp.hxx b/sw/source/uibase/inc/uivwimp.hxx
index 0b84e88d8bdf..f0bc96d7e661 100644
--- a/sw/source/uibase/inc/uivwimp.hxx
+++ b/sw/source/uibase/inc/uivwimp.hxx
@@ -94,7 +94,7 @@ class SwView_Impl
     css::uno::Reference< css::lang::XEventListener >  xClipEvtLstnr;
     css::uno::Reference< css::frame::XDispatchProviderInterceptor >   xDisProvInterceptor;
     css::uno::Reference< css::view::XSelectionSupplier >              mxXTextView;       // UNO object
-    css::uno::WeakReference< css::lang::XUnoTunnel > xTransferable;
+    std::vector< css::uno::WeakReference< css::lang::XUnoTunnel > > mxTransferables;
 
     // temporary document for printing text of selection / multi selection
     // in PDF export.
diff --git a/sw/source/uibase/uiview/uivwimp.cxx b/sw/source/uibase/uiview/uivwimp.cxx
index 60bcbc615579..687c24479d73 100644
--- a/sw/source/uibase/uiview/uivwimp.cxx
+++ b/sw/source/uibase/uiview/uivwimp.cxx
@@ -214,15 +214,18 @@ void SwView_Impl::AddClipboardListener()
 void SwView_Impl::Invalidate()
 {
     GetUNOObject_Impl()->Invalidate();
-    Reference< XUnoTunnel > xTunnel(xTransferable.get(), UNO_QUERY);
-    if(xTunnel.is())
-
+    for (const auto& xTransferable: mxTransferables)
     {
-        SwTransferable* pTransferable = reinterpret_cast< SwTransferable * >(
-                sal::static_int_cast< sal_IntPtr >(
-                xTunnel->getSomething(SwTransferable::getUnoTunnelId())));
-        if(pTransferable)
-            pTransferable->Invalidate();
+        Reference< XUnoTunnel > xTunnel(xTransferable.get(), UNO_QUERY);
+        if(xTunnel.is())
+
+        {
+            SwTransferable* pTransferable = reinterpret_cast< SwTransferable * >(
+                    sal::static_int_cast< sal_IntPtr >(
+                    xTunnel->getSomething(SwTransferable::getUnoTunnelId())));
+            if(pTransferable)
+                pTransferable->Invalidate();
+        }
     }
 }
 
@@ -231,7 +234,7 @@ void SwView_Impl::AddTransferable(SwTransferable& rTransferable)
     //prevent removing of the non-referenced SwTransferable
     rTransferable.m_refCount++;
     {
-        xTransferable = Reference<XUnoTunnel> (&rTransferable);
+        mxTransferables.push_back(uno::WeakReference<lang::XUnoTunnel>(uno::Reference<lang::XUnoTunnel>(&rTransferable)));
     }
     rTransferable.m_refCount--;
 }
commit b75b0bd20a3805af9f6a329c9b365b3b6a276f50
Author: Michael Stahl <mstahl at redhat.com>
Date:   Mon Jun 19 11:40:12 2017 +0200

    tdf#101821 sw: layout: don't move endnotes into footnotes' container
    
    The bugdoc has a single 1-column section from start to end, no
    footnotes but lots of endnotes, and the section has the settings
    "Footnotes - collect at end of text" unchecked and "Endnotes - collect
    at end of section" checked.
    
    This means that the SwFootnoteContFrame for footnotes would be put
    directly below the SwPageFrame (so that multiple sections on a single
    page can share it), but the SwFootnoteContFrame for the endnotes is
    put below the SwColumnFrame (which is created despite only 1 column)
    below the SwSectionFrame.
    
    Hence content in endnotes has the mbInfSct flag set, and the crash
    happens because the endnotes are moved from below the SwSectionFrame to
    a new SwFootnoteContFrame that is directly below a SwPageFrame, without
    clearing the mbInfSct flag.
    
    Fix the wrong call in SwFootnoteBossFrame::MoveFootnotes_() to
    FindFootnoteBossFrame() that resulted in the wrong (unsuitable for
    endnotes) SwFootnoteContFrame to be used as the target for the move.
    
    Change-Id: I64f6b86441e5ac1f16433f005e97c274a1c69dfa
    (cherry picked from commit 4c0b3520b66477334a7971dbed7ffcdcd265e749)
    Reviewed-on: https://gerrit.libreoffice.org/39104
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit 2d34d70eb928f6818d9f68f1da07673ce48f90ea)

diff --git a/sw/source/core/layout/ftnfrm.cxx b/sw/source/core/layout/ftnfrm.cxx
index 6ec9160ac346..290240b63e9b 100644
--- a/sw/source/core/layout/ftnfrm.cxx
+++ b/sw/source/core/layout/ftnfrm.cxx
@@ -1905,7 +1905,8 @@ void SwFootnoteBossFrame::MoveFootnotes_( SwFootnoteFrames &rFootnoteArr, bool b
     SwFootnoteFrame* pLastInsertedFootnote = nullptr;
     for (SwFootnoteFrame* pFootnote : rFootnoteArr)
     {
-        SwFootnoteBossFrame* pRefBoss = pFootnote->GetRef()->FindFootnoteBossFrame( true );
+        SwFootnoteBossFrame* pRefBoss(pFootnote->GetRef()->FindFootnoteBossFrame(
+                !pFootnote->GetAttr()->GetFootnote().IsEndNote()));
         if( pRefBoss != this )
         {
             const sal_uInt16 nRefNum = pRefBoss->FindPageFrame()->GetPhyPageNum();
commit 18c1755460f57a626e72987d1f3e8c326c82f441
Author: Markus Mohrhard <markus.mohrhard at googlemail.com>
Date:   Wed Jun 28 02:15:04 2017 +0200

    handle SID_ENCRYPTIONDATA for shared password protected docs, tdf#56173
    
    Change-Id: Iadfe880b7be3186410a08568844d8812f176005d
    Reviewed-on: https://gerrit.libreoffice.org/39332
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    (cherry picked from commit 669c12d59b6131f44945f166c77ae98df52ebb9e)
    Reviewed-on: https://gerrit.libreoffice.org/39337
    Reviewed-by: Eike Rathke <erack at redhat.com>
    (cherry picked from commit 20ca5b5fae58ee46362fbd4c5f51ee21e89c3c35)

diff --git a/sc/source/ui/docshell/docsh4.cxx b/sc/source/ui/docshell/docsh4.cxx
index 0bc4581359c7..20f962546326 100644
--- a/sc/source/ui/docshell/docsh4.cxx
+++ b/sc/source/ui/docshell/docsh4.cxx
@@ -2458,6 +2458,13 @@ uno::Reference< frame::XModel > ScDocShell::LoadSharedDocument()
                 aArgs[1].Name = "Password";
                 aArgs[1].Value <<= pPasswordItem->GetValue();
             }
+            const SfxUnoAnyItem* pEncryptionItem = SfxItemSet::GetItem<SfxUnoAnyItem>(GetMedium()->GetItemSet(), SID_ENCRYPTIONDATA, false);
+            if (pEncryptionItem)
+            {
+                aArgs.realloc(aArgs.getLength() + 1);
+                aArgs[aArgs.getLength() - 1].Name = "EncryptionData";
+                aArgs[aArgs.getLength() - 1].Value = pEncryptionItem->GetValue();
+            }
         }
 
         xModel.set(
commit f79c4146930bd20deb0a2e399d31c1f1275fbfee
Author: Markus Mohrhard <markus.mohrhard at googlemail.com>
Date:   Wed Jun 28 04:16:51 2017 +0200

    always import page scaling, tdf#65848
    
    Change-Id: If5bad2336443280dd33d750b1b2749a06f2b5101
    Reviewed-on: https://gerrit.libreoffice.org/39334
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    (cherry picked from commit fef72f9623bac7f9aa50b4f2606e6ec6282cfe1f)
    Reviewed-on: https://gerrit.libreoffice.org/39340
    Reviewed-by: Eike Rathke <erack at redhat.com>
    (cherry picked from commit ae56c9862222718871b6bf098162c2b8b4c44b82)

diff --git a/sc/source/filter/oox/pagesettings.cxx b/sc/source/filter/oox/pagesettings.cxx
index 5af216a589d4..a34aca50b88b 100644
--- a/sc/source/filter/oox/pagesettings.cxx
+++ b/sc/source/filter/oox/pagesettings.cxx
@@ -911,7 +911,7 @@ void PageSettingsConverter::writePageSettingsProperties(
     else
     {
         // scale may be 0 which indicates uninitialized
-        sal_Int16 nScale = (rModel.mbValidSettings && (rModel.mnScale > 0)) ? getLimitedValue< sal_Int16, sal_Int32 >( rModel.mnScale, 10, 400 ) : 100;
+        sal_Int16 nScale = (rModel.mnScale > 0) ? getLimitedValue< sal_Int16, sal_Int32 >( rModel.mnScale, 10, 400 ) : 100;
         rPropSet.setProperty( PROP_PageScale, nScale );
     }
 
commit 5345f96f0dc36cd1dc7e918be837f068be47ec0c
Author: Eike Rathke <erack at redhat.com>
Date:   Wed Jun 21 19:42:36 2017 +0200

    Resolves: tdf#108671 mark named expression single reference #REF! if deleted
    
    Probably broken already since
    
        commit f77c9d5b3cb65d9c2e2417f60bec1113feac50e1
        Date:   Mon Jul 29 14:47:07 2013 -0400
    
    Change-Id: If90a959d000a1bf5ab0804deb22d5cfad413ea5e
    (cherry picked from commit 6580e171ad054dca38f55822e67a400191cecdf5)
    Reviewed-on: https://gerrit.libreoffice.org/39072
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    (cherry picked from commit 777103737f9b20f680d9c9f3d0610e91383f7499)

diff --git a/sc/source/core/tool/token.cxx b/sc/source/core/tool/token.cxx
index bf25d135f728..584502f17c1f 100644
--- a/sc/source/core/tool/token.cxx
+++ b/sc/source/core/tool/token.cxx
@@ -3640,6 +3640,65 @@ sc::RefUpdateResult ScTokenArray::AdjustReferenceInName(
                 case svSingleRef:
                     {
                         ScSingleRefData& rRef = *p->GetSingleRef();
+                        if (rCxt.mnRowDelta < 0)
+                        {
+                            // row(s) deleted.
+
+                            if (rRef.IsRowRel())
+                                // Don't modify relative references in names.
+                                break;
+
+                            ScAddress aAbs = rRef.toAbs(rPos);
+
+                            if (aAbs.Col() < rCxt.maRange.aStart.Col() || rCxt.maRange.aEnd.Col() < aAbs.Col())
+                                // column of the reference is not in the deleted column range.
+                                break;
+
+                            if (aAbs.Tab() > rCxt.maRange.aEnd.Tab() || aAbs.Tab() < rCxt.maRange.aStart.Tab())
+                                // wrong tables
+                                break;
+
+                            const SCROW nDelStartRow = rCxt.maRange.aStart.Row() + rCxt.mnRowDelta;
+                            const SCROW nDelEndRow = nDelStartRow - rCxt.mnRowDelta - 1;
+
+                            if (nDelStartRow <= aAbs.Row() && aAbs.Row() <= nDelEndRow)
+                            {
+                                // This reference is deleted.
+                                rRef.SetRowDeleted(true);
+                                aRes.mbReferenceModified = true;
+                                break;
+                            }
+                        }
+                        else if (rCxt.mnColDelta < 0)
+                        {
+                            // column(s) deleted.
+
+                            if (rRef.IsColRel())
+                                // Don't modify relative references in names.
+                                break;
+
+                            ScAddress aAbs = rRef.toAbs(rPos);
+
+                            if (aAbs.Row() < rCxt.maRange.aStart.Row() || rCxt.maRange.aEnd.Row() < aAbs.Row())
+                                // row of the reference is not in the deleted row range.
+                                break;
+
+                            if (aAbs.Tab() > rCxt.maRange.aEnd.Tab() || aAbs.Tab() < rCxt.maRange.aStart.Tab())
+                                // wrong tables
+                                break;
+
+                            const SCCOL nDelStartCol = rCxt.maRange.aStart.Col() + rCxt.mnColDelta;
+                            const SCCOL nDelEndCol = nDelStartCol - rCxt.mnColDelta - 1;
+
+                            if (nDelStartCol <= aAbs.Col() && aAbs.Col() <= nDelEndCol)
+                            {
+                                // This reference is deleted.
+                                rRef.SetColDeleted(true);
+                                aRes.mbReferenceModified = true;
+                                break;
+                            }
+                        }
+
                         if (adjustSingleRefInName(rRef, rCxt, rPos, nullptr))
                             aRes.mbReferenceModified = true;
                     }
commit 20a0569ae99fc1ef8537ed6b1819e233b5e2f244
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon May 22 09:10:14 2017 +0100

    Resolves: tdf#107959 SdrGrafObj leak triggers later crash
    
    if the graphic doesn't change, then the cloned SdrGrafObj
    persists beyond stylesheet destruction and blows up
    
    Change-Id: I0013e7e118985c1334ab460507bc5c8271700160
    (cherry picked from commit 118401aae4516bf4cc122e96b376d129ab3a3d5e)
    (cherry picked from commit e4db2fc10ba4447fa5393853d0cfed795b260f0b)
    Reviewed-on: https://gerrit.libreoffice.org/39261
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit c00af602013b840f4f92c15b259ce6cdeeaabcae)

diff --git a/sd/source/ui/view/drviews6.cxx b/sd/source/ui/view/drviews6.cxx
index 1e137982404e..ec445e75fe37 100644
--- a/sd/source/ui/view/drviews6.cxx
+++ b/sd/source/ui/view/drviews6.cxx
@@ -276,20 +276,17 @@ void DrawViewShell::ExecBmpMask( SfxRequest& rReq )
 
             if ( pObj && !mpDrawView->IsTextEdit() )
             {
-                SdrGrafObj* pNewObj = pObj->Clone();
+                std::unique_ptr<SdrGrafObj> xNewObj(pObj->Clone());
                 bool bCont = true;
 
-                if( pNewObj->IsLinkedGraphic() )
+                if (xNewObj->IsLinkedGraphic())
                 {
                     ScopedVclPtrInstance< MessageDialog > aQueryBox( static_cast<vcl::Window*>(GetActiveWindow()),"QueryUnlinkImageDialog","modules/sdraw/ui/queryunlinkimagedialog.ui");
 
                     if (RET_YES == aQueryBox->Execute())
-                        pNewObj->ReleaseGraphicLink();
+                        xNewObj->ReleaseGraphicLink();
                     else
-                    {
-                        delete pNewObj;
                         bCont = false;
-                    }
                 }
 
                 SfxChildWindow* pWnd = GetViewFrame()->GetChildWindow(
@@ -298,21 +295,21 @@ void DrawViewShell::ExecBmpMask( SfxRequest& rReq )
                 assert(pBmpMask);
                 if (bCont && pBmpMask)
                 {
-                    const Graphic&  rOldGraphic = pNewObj->GetGraphic();
+                    const Graphic&  rOldGraphic = xNewObj->GetGraphic();
                     const Graphic   aNewGraphic(pBmpMask->Mask(rOldGraphic));
 
                     if( aNewGraphic != rOldGraphic )
                     {
                         SdrPageView* pPV = mpDrawView->GetSdrPageView();
 
-                        pNewObj->SetEmptyPresObj( false );
-                        pNewObj->SetGraphic(pBmpMask->Mask(pNewObj->GetGraphic()));
+                        xNewObj->SetEmptyPresObj(false);
+                        xNewObj->SetGraphic(pBmpMask->Mask(xNewObj->GetGraphic()));
 
                         OUString aStr( mpDrawView->GetDescriptionOfMarkedObjects() );
                         aStr += " " + SD_RESSTR(STR_EYEDROPPER);
 
                         mpDrawView->BegUndo( aStr );
-                        mpDrawView->ReplaceObjectAtView( pObj, *pPV, pNewObj );
+                        mpDrawView->ReplaceObjectAtView(pObj, *pPV, xNewObj.release());
                         mpDrawView->EndUndo();
                     }
                 }
commit 5eef53248781a97d83c9a639350c32859caa341b
Author: Eike Rathke <erack at redhat.com>
Date:   Thu Jun 29 14:02:58 2017 +0200

    Don't let m_nGrabLevel become negative, tdf#108705 related
    
    ... which then later leads to 2 Giga loops on the next GtkSalFrame dtor call,
    for example on the second AutoFilter button popup in Calc.
    
    Fall-out from
    
        commit 9b32355ea6d8d5e34363ba0c57e74d75d7a7b1b7
        Date:   Fri Jun 23 12:48:12 2017 +0100
    
            Resolves: tdf#108705 remove grabs on widget before destroying it
    
    that brought this to surface.
    
    Change-Id: I0edb7eec9384c716800f07ef1ed91fc8f1d7c119
    (cherry picked from commit 637d917d7551fed19c9685f974fb3e732a8f97e2)
    Reviewed-on: https://gerrit.libreoffice.org/39388
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit 5eec9409f10d1a08c826edb689eefb86240b7b25)

diff --git a/vcl/unx/gtk3/gtk3gtkframe.cxx b/vcl/unx/gtk3/gtk3gtkframe.cxx
index 95cad3d56a0a..d8b88f9abc85 100644
--- a/vcl/unx/gtk3/gtk3gtkframe.cxx
+++ b/vcl/unx/gtk3/gtk3gtkframe.cxx
@@ -2573,9 +2573,12 @@ void GtkSalFrame::addGrabLevel()
 
 void GtkSalFrame::removeGrabLevel()
 {
-    --m_nGrabLevel;
-    if (m_nGrabLevel == 0)
-        gtk_grab_remove(getMouseEventWidget());
+    if (m_nGrabLevel > 0)
+    {
+        --m_nGrabLevel;
+        if (m_nGrabLevel == 0)
+            gtk_grab_remove(getMouseEventWidget());
+    }
 }
 
 void GtkSalFrame::closePopup()
commit 67ebaff71f6327d2a6bee4bfd9babef83dd9b2c3
Author: Michael Stahl <mstahl at redhat.com>
Date:   Tue Jun 27 17:32:16 2017 +0200

    tdf#108814 sfx2: fix crash in sidebar when XUpdateModel not implemented
    
    com.sun.star.ui.XUpdateModel was added in 5.1 so pre-existing extensions
    don't implement it.
    
    (regression from 0635208edf1cdee4235ea87666a473ac81007555)
    
    Change-Id: I6749a9cf2fc82b9cd90d85a682247104e369e167
    (cherry picked from commit d109948f0dd4190d7aca1e0fa7e2706ef3f40a6c)
    Reviewed-on: https://gerrit.libreoffice.org/39312
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    (cherry picked from commit 622d2b4c250f6c3cc67f10887f3e3ec9db3f69a5)

diff --git a/sfx2/source/sidebar/ResourceManager.cxx b/sfx2/source/sidebar/ResourceManager.cxx
index 97742b73b5fc..f609c799d066 100644
--- a/sfx2/source/sidebar/ResourceManager.cxx
+++ b/sfx2/source/sidebar/ResourceManager.cxx
@@ -719,7 +719,10 @@ void ResourceManager::UpdateModel(const css::uno::Reference<css::frame::XModel>&
         for (SharedPanelContainer::const_iterator it = rContainer.begin(); it != rContainer.end(); ++it)
         {
             css::uno::Reference<css::ui::XUpdateModel> xPanel((*it)->GetPanelComponent(), css::uno::UNO_QUERY);
-            xPanel->updateModel(xModel);
+            if (xPanel.is()) // tdf#108814 interface is optional
+            {
+                xPanel->updateModel(xModel);
+            }
         }
     }
 }


More information about the Libreoffice-commits mailing list