[Libreoffice-commits] core.git: sw/qa sw/source

[Libreoffice Gerrit user]

 sw/qa/core/data/ww8/pass/forcepoint50-rows-1.doc |binary
 sw/source/core/layout/tabfrm.cxx                 |   20 +++++++-------------
 2 files changed, 7 insertions(+), 13 deletions(-)

New commits:
commit 3da20d39e2cbda4d4c01ad206668924ab8c3f2b6
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon Jul 16 08:48:11 2018 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Mon Jul 16 13:06:05 2018 +0200

    forcepoint#50 refetch FirstNonHeadlineRow
    
    Invalid read of size 8
       at 0x43D42DE6: SwFrame::GetUpper() const (frame.hxx:664)
       by 0x44427435: SwRowFrame::ShouldRowKeepWithNext() const (tabfrm.cxx:4618)
       by 0x4441FA5C: SwTabFrame::MakeAll(OutputDevice*) (tabfrm.cxx:2403)
       by 0x4433492F: SwFrame::PrepareMake(OutputDevice*) (calcmove.cxx:343)
       by 0x44431B6F: SwFrame::Calc(OutputDevice*) const (trvlfrm.cxx:1799)
       by 0x44334430: SwFrame::PrepareMake(OutputDevice*) (calcmove.cxx:246)
       by 0x44431B6F: SwFrame::Calc(OutputDevice*) const (trvlfrm.cxx:1799)
       by 0x44334430: SwFrame::PrepareMake(OutputDevice*) (calcmove.cxx:246)
       by 0x44431B6F: SwFrame::Calc(OutputDevice*) const (trvlfrm.cxx:1799)
       by 0x44334A67: SwFrame::OptPrepareMake() (calcmove.cxx:354)
       by 0x443982CE: SwFrame::OptCalc() const (frame.hxx:1051)
       by 0x44395F18: SwLayAction::FormatContent_(SwContentFrame const*, SwPageFrame const*) (layact.cxx:1794)
     Address 0x352771b0 is 144 bytes inside a block of size 280 free'd
       at 0x4C2EDAC: free (vg_replace_malloc.c:530)
       by 0x4E5B9D7: rtl_freeMemory_SYSTEM(void*) (alloc_global.cxx:237)
       by 0x4E5BC93: rtl_freeMemory (alloc_global.cxx:303)
       by 0x4E5A7A2: rtl_cache_free (alloc_cache.cxx:1081)
       by 0xF28B5B9: FixedMemPool::Free(void*) (mempool.cxx:49)
       by 0x442FF36D: SwRowFrame::operator delete(void*, unsigned long) (rowfrm.hxx:123)
       by 0x444243E8: SwRowFrame::~SwRowFrame() (tabfrm.cxx:3702)
       by 0x4441630C: SwFrame::DestroyFrame(SwFrame*) (ssfrm.cxx:384)
       by 0x4441AC31: SwTabFrame::RemoveFollowFlowLine() (tabfrm.cxx:900)
       by 0x4441D7EB: SwTabFrame::MakeAll(OutputDevice*) (tabfrm.cxx:1836)
       by 0x4433492F: SwFrame::PrepareMake(OutputDevice*) (calcmove.cxx:343)
       by 0x44431B6F: SwFrame::Calc(OutputDevice*) const (trvlfrm.cxx:1799)
    
    Change-Id: I36fe0df0ef96b4019e0ca5756b06df72e9f0d8cb
    Reviewed-on: https://gerrit.libreoffice.org/57480
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/qa/core/data/ww8/pass/forcepoint50-rows-1.doc b/sw/qa/core/data/ww8/pass/forcepoint50-rows-1.doc
new file mode 100644
index 000000000000..e91f9dd3242c
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/forcepoint50-rows-1.doc differ
diff --git a/sw/source/core/layout/tabfrm.cxx b/sw/source/core/layout/tabfrm.cxx
index 8fad05cf2508..a5538ea3f707 100644
--- a/sw/source/core/layout/tabfrm.cxx
+++ b/sw/source/core/layout/tabfrm.cxx
@@ -164,7 +164,7 @@ void SwTabFrame::RegistFlys()
 }
 
 void SwInvalidateAll( SwFrame *pFrame, long nBottom );
-static bool lcl_RecalcRow( SwRowFrame* pRow, long nBottom );
+static void lcl_RecalcRow( SwRowFrame* pRow, long nBottom );
 static bool lcl_ArrangeLowers( SwLayoutFrame *pLay, long lYStart, bool bInva );
 // #i26945# - add parameter <_bOnlyRowsAndCells> to control
 // that only row and cell frames are formatted.
@@ -1562,8 +1562,7 @@ static bool lcl_InnerCalcLayout( SwFrame *pFrame,
     return bRet;
 }
 
-// returns false if pRow is invalid
-static bool lcl_RecalcRow( SwRowFrame* pRow, long nBottom )
+static void lcl_RecalcRow( SwRowFrame* pRow, long nBottom )
 {
     // FME 2007-08-30 #i81146# new loop control
     int nLoopControlRuns_1 = 0;
@@ -1621,7 +1620,7 @@ static bool lcl_RecalcRow( SwRowFrame* pRow, long nBottom )
             if (!bRowStillExists)
             {
                 SAL_WARN("sw.layout", "no row anymore at " << pRow);
-                return false;
+                return;
             }
 
             // NEW TABLES
@@ -1665,8 +1664,7 @@ static bool lcl_RecalcRow( SwRowFrame* pRow, long nBottom )
             }
         }
         break;
-    } while (true);
-    return true;
+    } while( true );
 }
 
 static void lcl_RecalcTable( SwTabFrame& rTab,
@@ -2353,7 +2351,7 @@ void SwTabFrame::MakeAll(vcl::RenderContext* pRenderContext)
 
             // 1. Try: bTryToSplit = true  => Try to split the row.
             // 2. Try: bTryToSplit = false => Split the table between the rows.
-            if ((pFirstNonHeadlineRow && pFirstNonHeadlineRow->GetNext()) || bTryToSplit )
+            if ( pFirstNonHeadlineRow->GetNext() || bTryToSplit )
             {
                 SwTwips nDeadLine = aRectFnSet.GetPrtBottom(*GetUpper());
                 if( IsInSct() || GetUpper()->IsInTab() ) // TABLE IN TABLE)
@@ -2362,11 +2360,7 @@ void SwTabFrame::MakeAll(vcl::RenderContext* pRenderContext)
 
                 {
                     SetInRecalcLowerRow( true );
-                    SwRowFrame* pRow = static_cast<SwRowFrame*>(Lower());
-                    if (!lcl_RecalcRow(pRow, nDeadLine))
-                    {
-                        pFirstNonHeadlineRow = GetFirstNonHeadlineRow();
-                    }
+                    ::lcl_RecalcRow( static_cast<SwRowFrame*>(Lower()), nDeadLine );
                     SetInRecalcLowerRow( false );
                 }
                 m_bLowersFormatted = true;
@@ -2400,7 +2394,7 @@ void SwTabFrame::MakeAll(vcl::RenderContext* pRenderContext)
 
                 if ( bTableRowKeep )
                 {
-                    const SwRowFrame* pTmpRow = pFirstNonHeadlineRow;
+                    const SwRowFrame* pTmpRow = GetFirstNonHeadlineRow();
                     while ( pTmpRow && pTmpRow->ShouldRowKeepWithNext() )
                     {
                         ++nMinNumOfLines;