sw/source/core/layout/paintfrm.cxx | 1 + sw/source/core/text/porrst.cxx | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-)
New commits: commit 865fb8eea3cda9c3ddcadc1806a4d4651df08592 Author: Michael Stahl <michael.st...@cib.de> AuthorDate: Wed Jun 26 19:13:37 2019 +0200 Commit: Michael Stahl <michael.st...@cib.de> CommitDate: Thu Jun 27 15:53:39 2019 +0200 tdf#125751 sw: don't start recursive layout in SwTextFrame::EmptyHeight() Not sure if this has anything to do with the bug, but i noticed it while debugging... This is the only place that calls GetCurrFrame() *during* formatting, so make sure we don't do stupid recursive things. (regression from 56b2cf0c10d9caa01ebae1d80465e342d046a85c) Change-Id: Icd05f8d634bc9de4d5d16824d30075397e6c9960 Reviewed-on: https://gerrit.libreoffice.org/74750 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.st...@cib.de> (cherry picked from commit 7a05458d39da2f4755cb6e190dce338198655137) Reviewed-on: https://gerrit.libreoffice.org/74784 diff --git a/sw/source/core/text/porrst.cxx b/sw/source/core/text/porrst.cxx index 09611e728441..3ec7042502a4 100644 --- a/sw/source/core/text/porrst.cxx +++ b/sw/source/core/text/porrst.cxx @@ -210,7 +210,8 @@ SwTwips SwTextFrame::EmptyHeight() const SwViewShell *pSh = getRootFrame()->GetCurrShell(); if ( dynamic_cast<const SwCursorShell*>( pSh ) != nullptr ) { SwCursorShell *pCrSh = static_cast<SwCursorShell*>(pSh); - SwContentFrame *pCurrFrame=pCrSh->GetCurrFrame(); + // this is called during formatting so avoid recursive layout + SwContentFrame const*const pCurrFrame = pCrSh->GetCurrFrame(false); if (pCurrFrame==static_cast<SwContentFrame const *>(this)) { // do nothing } else { commit 257bac6e9ad57aa787ab051ae800ec9cf55425ed Author: Michael Stahl <michael.st...@cib.de> AuthorDate: Wed Jun 26 19:09:51 2019 +0200 Commit: Michael Stahl <michael.st...@cib.de> CommitDate: Thu Jun 27 15:53:23 2019 +0200 tdf#125751 sw: fix crash on formatting in SwLayoutFrame::PaintSwFrame() It's less than ideal that the document is painted before being fully formatted, but let's try to apply a band-aid... 0x6120001a97d0 is located 144 bytes inside of 280-byte region [0x6120001a9740,0x6120001a9858) freed by thread T0 here: #1 SwFootnoteFrame::~SwFootnoteFrame() /home/ms/lo/master/sw/source/core/inc/ftnfrm.hxx:64:7 #2 SwFrame::DestroyFrame(SwFrame*) sw/source/core/layout/ssfrm.cxx:389:9 #3 SwContentFrame::Cut() sw/source/core/layout/wsfrm.cxx:1263:25 #4 SwFlowFrame::MoveBwd(bool&) sw/source/core/layout/flowfrm.cxx:2544:17 #5 SwContentFrame::MakeAll(OutputDevice*) sw/source/core/layout/calcmove.cxx:1522:17 #6 SwFrame::PrepareMake(OutputDevice*) sw/source/core/layout/calcmove.cxx:366:5 #7 SwFrame::Calc(OutputDevice*) const sw/source/core/layout/trvlfrm.cxx:1791:37 #8 SwLayoutFrame::PaintSwFrame(OutputDevice&, SwRect const&, SwPrintData const*) const sw/source/core/layout/paintfrm.cxx:3328:17 #9 SwLayoutFrame::PaintSwFrame(OutputDevice&, SwRect const&, SwPrintData const*) const sw/source/core/layout/paintfrm.cxx:3406:21 #10 SwLayoutFrame::PaintSwFrame(OutputDevice&, SwRect const&, SwPrintData const*) const sw/source/core/layout/paintfrm.cxx:3406:21 #11 SwRootFrame::PaintSwFrame(OutputDevice&, SwRect const&, SwPrintData const*) const sw/source/core/layout/paintfrm.cxx:3116:24 #12 SwViewShell::Paint(OutputDevice&, tools::Rectangle const&) sw/source/core/view/viewsh.cxx:1840:34 (reportedly a regression from 18765b9fa739337d2d891513f6e2fb7c3ce23b50) Change-Id: Iff5e783985c180b704b273fa26b7c498820640ac Reviewed-on: https://gerrit.libreoffice.org/74749 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.st...@cib.de> (cherry picked from commit 49f971e9d0a88c9f23262445a17c9b5cecdb9167) Reviewed-on: https://gerrit.libreoffice.org/74783 diff --git a/sw/source/core/layout/paintfrm.cxx b/sw/source/core/layout/paintfrm.cxx index 0b0ed99ff390..ef8cd93212bb 100644 --- a/sw/source/core/layout/paintfrm.cxx +++ b/sw/source/core/layout/paintfrm.cxx @@ -3320,6 +3320,7 @@ void SwLayoutFrame::PaintSwFrame(vcl::RenderContext& rRenderContext, SwRect cons if ( !pFrame ) return; + SwFrameDeleteGuard g(const_cast<SwLayoutFrame*>(this)); // lock because Calc() and recursion SwShortCut aShortCut( *pFrame, rRect ); bool bCnt = pFrame->IsContentFrame(); if ( bCnt ) _______________________________________________ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits