[Libreoffice-commits] core.git: Branch 'libreoffice-6-0' - editeng/source sw/source

[Fyodor Yemelyanenko]

 editeng/source/misc/svxacorr.cxx |    2 +-
 sw/source/core/edit/acorrect.cxx |    6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

New commits:
commit aff321ae3c872ad881252979c9f10ab1a01c0ea0
Author: Fyodor Yemelyanenko <fyodor_e at hotmail.com>
Date:   Wed Jan 10 10:27:08 2018 +1000

    tdf#83260 editeng sw: avoid accessing dead nodes in AutoCorrect
    
    When change tracking is ON (Redlining) and Edit->Change Tracking->Show==OFF
    Autocorrection and Undo operations crash LO.
    
    Change-Id: I616f2de143b78fc83483a6589cfa1dd1ab61675a
    Reviewed-on: https://gerrit.libreoffice.org/47686
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Tested-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit aac475436271ddeabf6d9a4c3984ba77accf56ce)
    Reviewed-on: https://gerrit.libreoffice.org/49794
    Tested-by: Jenkins <ci at libreoffice.org>

diff --git a/editeng/source/misc/svxacorr.cxx b/editeng/source/misc/svxacorr.cxx
index 8131483e0241..658e6c619f33 100644
--- a/editeng/source/misc/svxacorr.cxx
+++ b/editeng/source/misc/svxacorr.cxx
@@ -1387,7 +1387,7 @@ void SvxAutoCorrect::DoAutoCorrect( SvxAutoCorrDoc& rDoc, const OUString& rTxt,
 
                     if( IsAutoCorrFlag( ChgToEnEmDash ) )
                     {
-                        FnChgToEnEmDash( rDoc, rTxt, nCapLttrPos, nEnd, eLang );
+                        FnChgToEnEmDash( rDoc, aPara, nCapLttrPos, nEnd, eLang );
                     }
                 }
                 break;
diff --git a/sw/source/core/edit/acorrect.cxx b/sw/source/core/edit/acorrect.cxx
index fbce36232d08..d2595462212f 100644
--- a/sw/source/core/edit/acorrect.cxx
+++ b/sw/source/core/edit/acorrect.cxx
@@ -339,6 +339,12 @@ bool SwAutoCorrDoc::ChgAutoCorrWord( sal_Int32& rSttPos, sal_Int32 nEndPos,
             {
                 // replace the selection
                 pDoc->getIDocumentContentOperations().ReplaceRange( aPam, pFnd->GetLong(), false);
+                // tdf#83260 After calling sw::DocumentContentOperationsManager::ReplaceRange
+                // pTextNd may become invalid when change tracking is on and Edit -> Track Changes -> Show == OFF.
+                // ReplaceRange shows changes, this moves deleted nodes from special section to document.
+                // Then Show mode is disabled again. As a result pTextNd may be invalidated.
+                pTextNd = rCursor.GetNode().GetTextNode();
+
                 bRet = true;
             }
         }