[Libreoffice-commits] core.git: editeng/source sw/source

[Fyodor Yemelyanenko]

 editeng/source/misc/svxacorr.cxx |    2 +-
 sw/source/core/edit/acorrect.cxx |    6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

New commits:
commit aac475436271ddeabf6d9a4c3984ba77accf56ce
Author: Fyodor Yemelyanenko <fyodor_e at hotmail.com>
Date:   Wed Jan 10 10:27:08 2018 +1000

    tdf#83260 editeng sw: avoid accessing dead nodes in AutoCorrect
    
    When change tracking is ON (Redlining) and Edit->Change Tracking->Show==OFF
    Autocorrection and Undo operations crash LO.
    
    Change-Id: I616f2de143b78fc83483a6589cfa1dd1ab61675a
    Reviewed-on: https://gerrit.libreoffice.org/47686
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Tested-by: Michael Stahl <mstahl at redhat.com>

diff --git a/editeng/source/misc/svxacorr.cxx b/editeng/source/misc/svxacorr.cxx
index 46c22fc84c49..1119879f178c 100644
--- a/editeng/source/misc/svxacorr.cxx
+++ b/editeng/source/misc/svxacorr.cxx
@@ -1382,7 +1382,7 @@ void SvxAutoCorrect::DoAutoCorrect( SvxAutoCorrDoc& rDoc, const OUString& rTxt,
 
                     if( IsAutoCorrFlag( ChgToEnEmDash ) )
                     {
-                        FnChgToEnEmDash( rDoc, rTxt, nCapLttrPos, nEnd, eLang );
+                        FnChgToEnEmDash( rDoc, aPara, nCapLttrPos, nEnd, eLang );
                     }
                 }
                 break;
diff --git a/sw/source/core/edit/acorrect.cxx b/sw/source/core/edit/acorrect.cxx
index fbce36232d08..d2595462212f 100644
--- a/sw/source/core/edit/acorrect.cxx
+++ b/sw/source/core/edit/acorrect.cxx
@@ -339,6 +339,12 @@ bool SwAutoCorrDoc::ChgAutoCorrWord( sal_Int32& rSttPos, sal_Int32 nEndPos,
             {
                 // replace the selection
                 pDoc->getIDocumentContentOperations().ReplaceRange( aPam, pFnd->GetLong(), false);
+                // tdf#83260 After calling sw::DocumentContentOperationsManager::ReplaceRange
+                // pTextNd may become invalid when change tracking is on and Edit -> Track Changes -> Show == OFF.
+                // ReplaceRange shows changes, this moves deleted nodes from special section to document.
+                // Then Show mode is disabled again. As a result pTextNd may be invalidated.
+                pTextNd = rCursor.GetNode().GetTextNode();
+
                 bRet = true;
             }
         }