[Libreoffice-commits] core.git: Branch 'libreoffice-5-4' - sw/source

[Michael Stahl]

 sw/source/core/bastyp/swcache.cxx |   32 +++++++++++++++++++++++++-------
 1 file changed, 25 insertions(+), 7 deletions(-)

New commits:
commit e6c9b806cd4eaf166bfe8cfc1a4b6741f2be83f0
Author: Michael Stahl <mstahl at redhat.com>
Date:   Fri Feb 2 15:11:25 2018 +0100

    ofz#5435 sw: fix SwCache::Insert() stale pointers
    
    If SwCache::Insert() happens to delete the object that m_pFirst or
    m_pRealFirst point to, which is unlikely as it means every other object
    is locked, then these pointers must be updated.
    
    This sometimes happens in the bugdoc after scrolling around for some
    time.
    
    Change-Id: I13f04d28c37969469efa4e1109c7f5b751ceba96
    Reviewed-on: https://gerrit.libreoffice.org/49151
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit 269d6d3366eea8541d965181dfdda1fdc5ef2d00)
    Reviewed-on: https://gerrit.libreoffice.org/49234
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/source/core/bastyp/swcache.cxx b/sw/source/core/bastyp/swcache.cxx
index f75468219873..64ae10658518 100644
--- a/sw/source/core/bastyp/swcache.cxx
+++ b/sw/source/core/bastyp/swcache.cxx
@@ -367,16 +367,34 @@ bool SwCache::Insert( SwCacheObj *pNew )
 
         nPos = pObj->GetCachePos();
         if ( pObj == m_pLast )
-        { OSL_ENSURE( pObj->GetPrev(), "Last but no Prev" );
+        {
             m_pLast = pObj->GetPrev();
-            m_pLast->SetNext( nullptr );
+            assert(m_pLast); // must have capacity > 1
         }
-        else
+        if (pObj == m_pFirst)
         {
-            if ( pObj->GetPrev() )
-                pObj->GetPrev()->SetNext( pObj->GetNext() );
-            if ( pObj->GetNext() )
-                pObj->GetNext()->SetPrev( pObj->GetPrev() );
+            if (pObj->GetNext())
+            {
+                m_pFirst = pObj->GetNext();
+            }
+            else
+            {
+                m_pFirst = pObj->GetPrev();
+            }
+            assert(m_pFirst); // must have capacity > 1
+        }
+        if (pObj == m_pRealFirst)
+        {
+            m_pRealFirst = pObj->GetNext();
+            assert(m_pRealFirst); // must have capacity > 1
+        }
+        if (pObj->GetPrev())
+        {
+            pObj->GetPrev()->SetNext( pObj->GetNext() );
+        }
+        if (pObj->GetNext())
+        {
+            pObj->GetNext()->SetPrev( pObj->GetPrev() );
         }
         delete pObj;
         m_aCacheObjects[nPos] = pNew;