[Libreoffice-commits] core.git: Branch 'libreoffice-6-0' - sw/source

[Michael Stahl]

 sw/source/core/bastyp/swcache.cxx |   32 +++++++++++++++++++++++++-------
 1 file changed, 25 insertions(+), 7 deletions(-)

New commits:
commit 578f679bb5e5601bc7b8f16cb7166d623c9255ce
Author: Michael Stahl <mstahl at redhat.com>
Date:   Fri Feb 2 15:11:25 2018 +0100

    ofz#5435 sw: fix SwCache::Insert() stale pointers
    
    If SwCache::Insert() happens to delete the object that m_pFirst or
    m_pRealFirst point to, which is unlikely as it means every other object
    is locked, then these pointers must be updated.
    
    This sometimes happens in the bugdoc after scrolling around for some
    time.
    
    Change-Id: I13f04d28c37969469efa4e1109c7f5b751ceba96
    Reviewed-on: https://gerrit.libreoffice.org/49151
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit 269d6d3366eea8541d965181dfdda1fdc5ef2d00)
    Reviewed-on: https://gerrit.libreoffice.org/49159
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/source/core/bastyp/swcache.cxx b/sw/source/core/bastyp/swcache.cxx
index 200c8f59f4ab..1bf45c0d1fdc 100644
--- a/sw/source/core/bastyp/swcache.cxx
+++ b/sw/source/core/bastyp/swcache.cxx
@@ -367,16 +367,34 @@ bool SwCache::Insert( SwCacheObj *pNew )
 
         nPos = pObj->GetCachePos();
         if ( pObj == m_pLast )
-        { OSL_ENSURE( pObj->GetPrev(), "Last but no Prev" );
+        {
             m_pLast = pObj->GetPrev();
-            m_pLast->SetNext( nullptr );
+            assert(m_pLast); // must have capacity > 1
         }
-        else
+        if (pObj == m_pFirst)
         {
-            if ( pObj->GetPrev() )
-                pObj->GetPrev()->SetNext( pObj->GetNext() );
-            if ( pObj->GetNext() )
-                pObj->GetNext()->SetPrev( pObj->GetPrev() );
+            if (pObj->GetNext())
+            {
+                m_pFirst = pObj->GetNext();
+            }
+            else
+            {
+                m_pFirst = pObj->GetPrev();
+            }
+            assert(m_pFirst); // must have capacity > 1
+        }
+        if (pObj == m_pRealFirst)
+        {
+            m_pRealFirst = pObj->GetNext();
+            assert(m_pRealFirst); // must have capacity > 1
+        }
+        if (pObj->GetPrev())
+        {
+            pObj->GetPrev()->SetNext( pObj->GetNext() );
+        }
+        if (pObj->GetNext())
+        {
+            pObj->GetNext()->SetPrev( pObj->GetPrev() );
         }
         delete pObj;
         m_aCacheObjects[nPos] = pNew;