[Libreoffice-commits] core.git: Branch 'libreoffice-6-0-0' - sw/qa sw/source

[Julien Nabet]

 sw/qa/extras/odfimport/data/tdf115079.odt |binary
 sw/qa/extras/odfimport/odfimport.cxx      |    5 +++++
 sw/source/core/layout/tabfrm.cxx          |    9 ++++++++-
 3 files changed, 13 insertions(+), 1 deletion(-)

New commits:
commit e5f952e6bc6b0d0944cb9125b5aa243de5c742d7
Author: Julien Nabet <serval2412 at yahoo.fr>
Date:   Thu Jan 18 08:37:04 2018 +0100

    tdf#115079: check that row frame belongs to table frame to avoid segfault
    
    A row frame may not belong to a table frame, when it is being cut, e.g., in
    lcl_PostprocessRowsInCells().
    Its SwRowFrame::Cut() has been called; it in turn called SwLayoutFrame::Cut(),
    which nullified row's upper in RemoveFromLayout(), and then called Shrink()
    for its former upper.
    Regardless of whether it will be pasted back, or destroyed, currently it's not
    part of layout, and its height does not count.
    
    See bt https://bugs.documentfoundation.org/attachment.cgi?id=139171
    
    Change-Id: I4010e1f246a3ebb89b3f972a03619a2775146da4
    Reviewed-on: https://gerrit.libreoffice.org/48089
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Mike Kaganski <mike.kaganski at collabora.com>
    (cherry picked from commit daf1b10f4e266818b6e14f0f1dfddd66f0a3a2f0)
    Reviewed-on: https://gerrit.libreoffice.org/48276
    Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice at googlemail.com>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    Reviewed-by: Eike Rathke <erack at redhat.com>
    Tested-by: Eike Rathke <erack at redhat.com>

diff --git a/sw/qa/extras/odfimport/data/tdf115079.odt b/sw/qa/extras/odfimport/data/tdf115079.odt
new file mode 100644
index 000000000000..6c1039e71ced
Binary files /dev/null and b/sw/qa/extras/odfimport/data/tdf115079.odt differ
diff --git a/sw/qa/extras/odfimport/odfimport.cxx b/sw/qa/extras/odfimport/odfimport.cxx
index 032a4a5da574..a638dd818574 100644
--- a/sw/qa/extras/odfimport/odfimport.cxx
+++ b/sw/qa/extras/odfimport/odfimport.cxx
@@ -882,5 +882,10 @@ DECLARE_ODFIMPORT_TEST(testBlankBeforeFirstPage, "tdf94882.odt")
     );
 }
 
+DECLARE_ODFIMPORT_TEST(testTdf115079, "tdf115079.odt")
+{
+    // This document caused segfault when layouting
+}
+
 CPPUNIT_PLUGIN_IMPLEMENT();
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/sw/source/core/layout/tabfrm.cxx b/sw/source/core/layout/tabfrm.cxx
index 491c3f3b2e52..859c78b9c50d 100644
--- a/sw/source/core/layout/tabfrm.cxx
+++ b/sw/source/core/layout/tabfrm.cxx
@@ -4093,7 +4093,14 @@ static SwTwips lcl_calcHeightOfRowBeforeThisFrame(const SwRowFrame& rRow)
         {
             // We've found another row frame that is part of the same table row
             const SwTabFrame* pCurTab = pCurRow->FindTabFrame();
-            if (pCurTab->IsAnFollow(pTab))
+            // A row frame may not belong to a table frame, when it is being cut, e.g., in
+            // lcl_PostprocessRowsInCells().
+            // Its SwRowFrame::Cut() has been called; it in turn called SwLayoutFrame::Cut(),
+            // which nullified row's upper in RemoveFromLayout(), and then called Shrink()
+            // for its former upper.
+            // Regardless of whether it will be pasted back, or destroyed, currently it's not
+            // part of layout, and its height does not count
+            if (pCurTab && pCurTab->IsAnFollow(pTab))
             {
                 // The found row frame belongs to a table frame that precedes
                 // (above) this one in chain. So, include it in the sum