[Libreoffice-commits] core.git: Branch 'libreoffice-6-3' - sw/source

[Michael Stahl (via logerrit)]

 sw/source/core/layout/calcmove.cxx |   16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

New commits:
commit 1901a7312e6cb026facc2036b2a49a606d936bea
Author:     Michael Stahl <Michael.Stahl at cib.de>
AuthorDate: Wed Jun 26 19:02:18 2019 +0200
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Thu Jun 27 13:03:04 2019 +0200

    tdf#125751 sw: tweak assert in SwFrame::PrepareMake() a bit more
    
    This fixes 2 cases of the assert that was added in commit
    e14056e6e88d9b8d988b7b88b2776a8fc952031b
    
    * tdf#125751 bugdoc would assert because on a page there were a bunch of
      empty section frames preceding 2 SwTextFrames; the first SwTextFrame
      moved backwards skipping over the empty section frames, hence the
      second SwTextFrame is not the mpNext of the first one's follow
    
    * writerfilter_null_ptr_deref.sample had a SwTextNode with >80k
      characters; turns out there is a check in SwTextFrame::CalcFollow()
      to format only up to 10 follow frames, so the result is 2 follow
      frames on the same page
    
    Change-Id: Ia08afd5a0e227d0613421d74b469c409ee91cfca
    Reviewed-on: https://gerrit.libreoffice.org/74748
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    (cherry picked from commit f8e4845fec50affc20272600a4baf87554b055fb)
    Reviewed-on: https://gerrit.libreoffice.org/74782

diff --git a/sw/source/core/layout/calcmove.cxx b/sw/source/core/layout/calcmove.cxx
index 874168d40fcb..c142221cedc5 100644
--- a/sw/source/core/layout/calcmove.cxx
+++ b/sw/source/core/layout/calcmove.cxx
@@ -326,7 +326,13 @@ void SwFrame::PrepareMake(vcl::RenderContext* pRenderContext)
                                 && SwFlowFrame::CastFlowFrame(GetUpper()->Lower())
                                 && SwFlowFrame::CastFlowFrame(pFrame)->IsAnFollow(
                                     SwFlowFrame::CastFlowFrame(GetUpper()->Lower()))
-                                && GetUpper()->Lower()->GetNext() == this));
+                                && (GetUpper()->Lower()->GetNext() == this
+                                    // if it's more than 10 pages long...
+                                    || (SwFlowFrame::CastFlowFrame(GetUpper()->Lower())->GetFollow()
+                                            == SwFlowFrame::CastFlowFrame(GetUpper()->Lower()->GetNext())
+                                        && GetUpper()->Lower()->GetNext()->GetNext() == this)
+                                    // pre-existing empty section frames may end up between them...
+                                    || GetUpper()->Lower()->GetNext()->IsSctFrame())));
                         break; // tdf#119109 frame was moved backward, prevent
                                // FindNext() returning a frame inside this if
                     }          // this is a table!
@@ -455,7 +461,13 @@ void SwFrame::PrepareCursor()
                             && SwFlowFrame::CastFlowFrame(GetUpper()->Lower())
                             && SwFlowFrame::CastFlowFrame(pFrame)->IsAnFollow(
                                 SwFlowFrame::CastFlowFrame(GetUpper()->Lower()))
-                            && GetUpper()->Lower()->GetNext() == this));
+                            && (GetUpper()->Lower()->GetNext() == this
+                                // if it's more than 10 pages long...
+                                || (SwFlowFrame::CastFlowFrame(GetUpper()->Lower())->GetFollow()
+                                        == SwFlowFrame::CastFlowFrame(GetUpper()->Lower()->GetNext())
+                                    && GetUpper()->Lower()->GetNext()->GetNext() == this)
+                                // pre-existing empty section frames may end up between them...
+                                || GetUpper()->Lower()->GetNext()->IsSctFrame())));
                     break; // tdf#119109 frame was moved backward, prevent
                            // FindNext() returning a frame inside this if
                 }          // this is a table!