sw/qa/extras/odfimport/data/tdf115079.odt |binary
sw/qa/extras/odfimport/odfimport.cxx | 5 +++++
sw/source/core/layout/tabfrm.cxx | 9 ++++++++-
3 files changed, 13 insertions(+), 1 deletion(-)
New commits:
commit 66ad52d05a11b87f921e782ffb6a9b49528fc194
Author: Julien Nabet <serval2...@yahoo.fr>
Date: Thu Jan 18 08:37:04 2018 +0100
tdf#115079: check that row frame belongs to table frame to avoid segfault
A row frame may not belong to a table frame, when it is being cut, e.g., in
lcl_PostprocessRowsInCells().
Its SwRowFrame::Cut() has been called; it in turn called
SwLayoutFrame::Cut(),
which nullified row's upper in RemoveFromLayout(), and then called Shrink()
for its former upper.
Regardless of whether it will be pasted back, or destroyed, currently it's
not
part of layout, and its height does not count.
See bt https://bugs.documentfoundation.org/attachment.cgi?id=139171
Change-Id: I4010e1f246a3ebb89b3f972a03619a2775146da4
(cherry picked from commit daf1b10f4e266818b6e14f0f1dfddd66f0a3a2f0)
Reviewed-on: https://gerrit.libreoffice.org/48234
Tested-by: Jenkins <c...@libreoffice.org>
Reviewed-by: Mike Kaganski <mike.kagan...@collabora.com>
diff --git a/sw/qa/extras/odfimport/data/tdf115079.odt
b/sw/qa/extras/odfimport/data/tdf115079.odt
new file mode 100644
index 000000000000..6c1039e71ced
Binary files /dev/null and b/sw/qa/extras/odfimport/data/tdf115079.odt differ
diff --git a/sw/qa/extras/odfimport/odfimport.cxx
b/sw/qa/extras/odfimport/odfimport.cxx
index f502531f8485..6eda80f3febf 100644
--- a/sw/qa/extras/odfimport/odfimport.cxx
+++ b/sw/qa/extras/odfimport/odfimport.cxx
@@ -862,5 +862,10 @@ DECLARE_ODFIMPORT_TEST(testTdf94882, "tdf94882.odt")
CPPUNIT_ASSERT_EQUAL(OUString("This is the first page header"),
headertext);
}
+DECLARE_ODFIMPORT_TEST(testTdf115079, "tdf115079.odt")
+{
+ // This document caused segfault when layouting
+}
+
CPPUNIT_PLUGIN_IMPLEMENT();
/* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/sw/source/core/layout/tabfrm.cxx b/sw/source/core/layout/tabfrm.cxx
index 1de4d238e270..fdeb528a86f0 100644
--- a/sw/source/core/layout/tabfrm.cxx
+++ b/sw/source/core/layout/tabfrm.cxx
@@ -4016,7 +4016,14 @@ static SwTwips lcl_calcHeightOfRowBeforeThisFrame(const
SwRowFrame& rRow)
{
// We've found another row frame that is part of the same table row
const SwTabFrame* pCurTab = pCurRow->FindTabFrame();
- if (pCurTab->IsAnFollow(pTab))
+ // A row frame may not belong to a table frame, when it is being
cut, e.g., in
+ // lcl_PostprocessRowsInCells().
+ // Its SwRowFrame::Cut() has been called; it in turn called
SwLayoutFrame::Cut(),
+ // which nullified row's upper in RemoveFromLayout(), and then
called Shrink()
+ // for its former upper.
+ // Regardless of whether it will be pasted back, or destroyed,
currently it's not
+ // part of layout, and its height does not count
+ if (pCurTab && pCurTab->IsAnFollow(pTab))
{
// The found row frame belongs to a table frame that precedes
// (above) this one in chain. So, include it in the sum
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
