[Libreoffice-commits] core.git: sw/source

[Michael Stahl (via logerrit)]

 sw/source/core/undo/unattr.cxx |    6 ++++++
 1 file changed, 6 insertions(+)

New commits:
commit 4999c99529f1b1543ef110da9e6c0dcbd9f73032
Author:     Michael Stahl <Michael.Stahl at cib.de>
AuthorDate: Tue Jun 25 14:11:46 2019 +0200
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Jun 25 18:30:37 2019 +0200

    tdf#126017 sw: do not restore SwFormatContent in SwUndoFormatAttr
    
    This is a very unusual item that only contains a SwNodeIndex, which may
    "go stale" because the node it's pointing to may be deleted, moving it
    to whatever node may be next.  Restoring such a moved item causes
    crashes like this, where the SwSectionFormat's item does not point to
    its SwSectionNode.
    
    (crash is a regression from 4f0b568ef35353b276ae560fb43502b6f6b2bfdb,
     previously the Undo stack was cleared so you couldn't Undo)
    
    Change-Id: I41a9ed9acc72df5b4b3852875a50e51c29eabe95
    Reviewed-on: https://gerrit.libreoffice.org/74693
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>

diff --git a/sw/source/core/undo/unattr.cxx b/sw/source/core/undo/unattr.cxx
index ff54f61ca06c..e389d4341dab 100644
--- a/sw/source/core/undo/unattr.cxx
+++ b/sw/source/core/undo/unattr.cxx
@@ -128,6 +128,8 @@ SwUndoFormatAttr::SwUndoFormatAttr( const SfxPoolItem& rItem, SwFormat& rChgForm
 
 void SwUndoFormatAttr::Init()
 {
+    // tdf#126017 never save SwNodeIndex, it will go stale
+    m_pOldSet->ClearItem(RES_CNTNT);
     // treat change of anchor specially
     if ( SfxItemState::SET == m_pOldSet->GetItemState( RES_ANCHOR, false )) {
         SaveFlyAnchor( m_bSaveDrawPt );
@@ -353,6 +355,10 @@ SwRewriter SwUndoFormatAttr::GetRewriter() const
 
 void SwUndoFormatAttr::PutAttr( const SfxPoolItem& rItem )
 {
+    if (RES_CNTNT == rItem.Which())
+    {
+        return; // tdf#126017 never save SwNodeIndex, it will go stale
+    }
     m_pOldSet->Put( rItem );
     if ( RES_ANCHOR == rItem.Which() ) {
         SaveFlyAnchor( m_bSaveDrawPt );