Need help for bug 158451

[Regina Henschel]

Hi all,

I can now narrow down the error somewhat.

Look at method SwTextFrame::FormatImpl() in
https://opengrok.libreoffice.org/xref/core/sw/source/core/text/frmform.cxx?r=7d7ca347#1832
It creates
    SwTextFormatInfo aInf( pRenderContext, this );
Later down in the for-loop, aInf is used. The for-loop iterates over
    pObj = aInf.GetTextFly().GetAnchoredObjList()
and performs
    aInf.GetTextFly().AnchoredObjToRect(pObj, aRect)
AnchoredObjToRect crashes then because of an invalid pObj.

You see the AnchoredObjList with these steps:
aInf > SwTextPaintInfo > m_aTextFly > mpAnchoredObjList

When aInf is created, mpAnchoredObjList is empty.
After line #1863
     Format_( aLine, aInf );
you can see the invalid item in that list.

This happens not always. When you use the example file of the bug 
report, first the text of the shape inside the group is handled. That 
works. Then the line where the group is anchored is handled. And there 
it happens.
If the inline anchored object is not a group but a simple shape with 
text, first the line is handled and then the text of the shape.


Next I have examined Format_( aLine, aInf ) for the crash case. It is
void SwTextFrame::Format_( SwTextFormatter &rLine, SwTextFormatInfo 
&rInf const bool bAdjust )
in
https://opengrok.libreoffice.org/xref/core/sw/source/core/text/frmform.cxx?r=7d7ca347#1431
Here watch parameter rInf.
It is OK till #1671. After line #1672
     bFormat = FormatLine( rLine, bPrev );
rInf has the invalid object. That is surprising. The method does no have 
rInf as parameter.


This method is
bool SwTextFrame::FormatLine( SwTextFormatter &rLine, const bool bPrev )
in
https://opengrok.libreoffice.org/xref/core/sw/source/core/text/frmform.cxx?r=7d7ca347#1296
The adding of the faulty object happens there in #1672
in bFormat = FormatLine( rLine, bPrev );

That method is
     bool SwTextFrame::FormatLine( SwTextFormatter &rLine, const bool 
bPrev )
in
https://opengrok.libreoffice.org/xref/core/sw/source/core/text/frmform.cxx?r=7d7ca347#1296


And there I'm now. I have no idea, how something there changes the 
parameter rInfo of SwTextFrame::Format_().
And I still do not know, which object is really needed in the above 
mentioned for-loop.
And I still don't know, whether the problem would be solved, when 
somehow first the line and then the group would be handled.

I appreciate any help.

Kind regards,
Regina

Regina Henschel schrieb am 11.12.2023 um 03:15:
> Hi all,
> 
> I need help for bug 158451. Problem: A group or a drawing canvas in a 
> docx file crashes Writer, in case it is anchored 'inline' and has a 
> child shape with text. The crash happens in 
> SwAnchoredObject::GetObjRectWithSpaces(). There is no crash, if such 
> group is in an odt file.
> 
> It is not a new problem, but it will effect more users now, because the 
> drawing canvas and not the VML fallback is imported now and the drawing 
> canvas is anchored 'inline' as default in Word.
> 
> Steps before the crash are
>      SwTextFormatter::NewPortion()
>      SwTextFormatter::CalcFlyWidth()
>      SwTextFly::GetFrame()
>      SwTextFly::ForEach()
>      SwAnchoredObject::GetObjRectWithSpaces()
> 
> I think the crash should be fixed till release, but I'm not familiar 
> with these frames. Do you have tips for me?
> Do you have an idea why a group from docx is different from a group from 
> odt, for example?
> 
> Attila Bakos had worked in that area, but NISZ does no longer exist.
> 
> Kind regards,
> Regina
>