sd/source/ui/unoidl/unomodel.cxx |   13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

New commits:
commit c183934835a6ab5e74643a671b65e9468592d216
Author:     Luigi Iucci <luigi.iu...@collabora.com>
AuthorDate: Fri May 26 11:49:59 2023 +0200
Commit:     Miklos Vajna <vmik...@collabora.com>
CommitDate: Thu Jun 15 08:38:45 2023 +0200

    sd: fix crash deleting 2 slides during paintTile
    
    pPageView was null in SdXImpressDocument::paintTile while trying
    to paint form controls, which is a corner case in most cases
    then we skip painting in order to avoid a crash
    
    Change-Id: I6c166035220c058fac276f2b7746a8ebc9651f81
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/152379
    Tested-by: Jenkins
    Reviewed-by: Miklos Vajna <vmik...@collabora.com>

diff --git a/sd/source/ui/unoidl/unomodel.cxx b/sd/source/ui/unoidl/unomodel.cxx
index dd2c897b4930..e05aee0f91c0 100644
--- a/sd/source/ui/unoidl/unomodel.cxx
+++ b/sd/source/ui/unoidl/unomodel.cxx
@@ -2306,11 +2306,14 @@ void SdXImpressDocument::paintTile( VirtualDevice& 
rDevice,
     // Draw Form controls
     SdrView* pDrawView = pViewSh->GetDrawView();
     SdrPageView* pPageView = pDrawView->GetSdrPageView();
-    SdrPage* pPage = pPageView->GetPage();
-    ::sd::Window* pActiveWin = pViewSh->GetActiveWindow();
-    ::tools::Rectangle aTileRect(Point(nTilePosX, nTilePosY), Size(nTileWidth, 
nTileHeight));
-    Size aOutputSize(nOutputWidth, nOutputHeight);
-    LokControlHandler::paintControlTile(pPage, pDrawView, *pActiveWin, 
rDevice, aOutputSize, aTileRect);
+    if (pPageView != nullptr)
+    {
+        SdrPage* pPage = pPageView->GetPage();
+        ::sd::Window* pActiveWin = pViewSh->GetActiveWindow();
+        ::tools::Rectangle aTileRect(Point(nTilePosX, nTilePosY), 
Size(nTileWidth, nTileHeight));
+        Size aOutputSize(nOutputWidth, nOutputHeight);
+        LokControlHandler::paintControlTile(pPage, pDrawView, *pActiveWin, 
rDevice, aOutputSize, aTileRect);
+    }
 
     comphelper::LibreOfficeKit::setTiledPainting(false);
 }

Reply via email to