[Libreoffice-commits] core.git: Branch 'distro/collabora/co-2021' - svx/source

[Miklos Vajna (via logerrit)]

 svx/source/table/tablecontroller.cxx |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

New commits:
commit ba0fde9611d8331bcbbb89e752a661ffa1760d93
Author:     Miklos Vajna <vmiklos at collabora.com>
AuthorDate: Mon May 3 20:49:08 2021 +0200
Commit:     Miklos Vajna <vmiklos at collabora.com>
CommitDate: Wed May 5 14:27:58 2021 +0200

    tdf#139500 svx: fix crash on changing table properties during active text edit
    
    Regression from commit fdeb04f7c59cf8032fe17072ed779e70505cc6ab
    (tdf#129961 svx: finish UI for table shadow as direct format,
    2020-12-15), the problem was that the BegUndo() / EndUndo() pair can be
    only used if we know that the text edit of a cell of a table shape is
    not started or ended in-between.
    
    The bugreport scenario was an active text edit, where setting attributes
    on the shape ends the text edit:
    
        #9 0x7f6dbb417121 in SdrEditView::EndTextEditAllViews() const /svx/source/svdraw/svdedtv.cxx:1079:20
        #10 0x7f6dbb466798 in SdrEditView::SetAttrToMarked(SfxItemSet const&, bool) /svx/source/svdraw/svdedtv1.cxx:1095:9
        #11 0x7f6dbc34b0af in sdr::table::SvxTableController::SetAttrToSelectedShape(SfxItemSet const&) /svx/source/table/tablecontroller.cxx:2738:12
    
    Which also means that the underlying edit engine is deleted. But then
    undo/redo would still reference that edit engine:
    
    ==31830==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c0001fc300 at pc 0x7f6dd73a9cb9 bp 0x7fff788db4b0 sp 0x7fff788db4a8
    READ of size 8 at 0x60c0001fc300 thread T0
        #0 0x7f6dd73a9cb8 in EditUndo::GetComment() const /editeng/source/editeng/editundo.cxx:147:34
    
    Fix the problem by not grouping in case there is an active text edit,
    that's not something I considered when I added the original grouping.
    
    (cherry picked from commit ece86ef173cbc070c76f180d02ac80c65e07fff9)
    
    Change-Id: I4f3583e21a27f8380c35b3f4563ce496819bcb81
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/115142
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice at gmail.com>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.com>

diff --git a/svx/source/table/tablecontroller.cxx b/svx/source/table/tablecontroller.cxx
index 429b2e58da43..75c49f599e02 100644
--- a/svx/source/table/tablecontroller.cxx
+++ b/svx/source/table/tablecontroller.cxx
@@ -982,7 +982,7 @@ void SvxTableController::onFormatTable(const SfxRequest& rReq)
                 // Create a single undo action when applying the result of the dialog.
                 SdrTableObj& rTableObject(*mxTableObj);
                 SdrModel& rSdrModel(rTableObject.getSdrModelFromSdrObject());
-                bool bUndo = rSdrModel.IsUndoEnabled();
+                bool bUndo = rSdrModel.IsUndoEnabled() && !mrView.IsTextEdit();
                 if (bUndo)
                 {
                     rSdrModel.BegUndo(SvxResId(STR_TABLE_NUMFORMAT));