dbaccess/source/ui/relationdesign/RTableConnection.cxx    |    2 
 download.lst                                              |    8 
 forms/source/richtext/parametrizedattributedispatcher.cxx |   14 
 forms/source/richtext/parametrizedattributedispatcher.hxx |    6 
 forms/source/richtext/specialdispatchers.cxx              |   14 
 forms/source/richtext/specialdispatchers.hxx              |    2 
 framework/source/uielement/menubarmanager.cxx             |   11 
 officecfg/registry/data/org/openoffice/Office/Paths.xcu   |    5 
 readlicense_oo/license/CREDITS.fodt                       | 2026 +++++++-------
 sal/rtl/strtmpl.hxx                                       |    5 
 sc/Library_vbaobj.mk                                      |    1 
 sc/source/ui/app/transobj.cxx                             |   31 
 sd/qa/unit/PNGExportTests.cxx                             |    8 
 solenv/gbuild/Rdb.mk                                      |    1 
 svx/source/dialog/framelinkarray.cxx                      |    8 
 sw/qa/core/layout/calcmove.cxx                            |   24 
 sw/qa/core/layout/data/ignore-top-margin-fly.odt          |binary
 sw/qa/extras/uiwriter/data/tdf160842.fodt                 |   75 
 sw/qa/extras/uiwriter/uiwriter6.cxx                       |  157 +
 sw/qa/extras/unowriter/data/tdf161035.fodt                |    9 
 sw/qa/extras/unowriter/unowriter.cxx                      |   27 
 sw/source/core/access/accfrmobj.cxx                       |   15 
 sw/source/core/doc/docdraw.cxx                            |   12 
 sw/source/core/draw/dview.cxx                             |  129 
 sw/source/core/frmedt/fecopy.cxx                          |   25 
 sw/source/core/frmedt/fefly1.cxx                          |   13 
 sw/source/core/frmedt/feshview.cxx                        |   59 
 sw/source/core/layout/anchoreddrawobject.cxx              |    4 
 sw/source/core/layout/anchoredobject.cxx                  |   11 
 sw/source/core/layout/calcmove.cxx                        |    6 
 sw/source/core/layout/fly.cxx                             |    4 
 sw/source/core/layout/flylay.cxx                          |   41 
 sw/source/core/layout/frmtool.cxx                         |   40 
 sw/source/core/layout/pagechg.cxx                         |   19 
 sw/source/core/layout/trvlfrm.cxx                         |   39 
 sw/source/core/txtnode/atrflyin.cxx                       |    3 
 sw/source/core/undo/undraw.cxx                            |   31 
 sw/source/core/unocore/unoportenum.cxx                    |    4 
 sw/source/uibase/docvw/edtwin.cxx                         |   10 
 sw/source/uibase/uiview/viewtab.cxx                       |    2 
 sw/source/uibase/utlui/content.cxx                        |    2 
 vcl/osx/salinst.cxx                                       |   17 
 vcl/skia/gdiimpl.cxx                                      |   20 
 vcl/source/filter/igif/gifread.cxx                        |   36 
 vcl/unx/gtk3/hudawareness.cxx                             |    2 
 45 files changed, 1752 insertions(+), 1226 deletions(-)

New commits:
commit f12e69cc4ccbc02ebb920dd9788b9273f8b8bdf8
Author:     Noel Grandin <noel.gran...@collabora.co.uk>
AuthorDate: Tue May 14 09:08:16 2024 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Fri May 17 19:57:46 2024 +0200

    tdf#161019 tdf#159846 spreadsheet border rendering
    
    regression from
        commit e27d4cc31e04be4c47b5085dfa2363ee45457e8a
        Author: Noel Grandin <noel.gran...@collabora.co.uk>
        Date:   Mon Jun 19 12:23:55 2023 +0200
        tdf#150534 reduce the memory consumption of cells when calculating
    
    Change-Id: Id8b52a3a0880bbb6a7aff28f55bcd57cb1cae048
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167617
    Tested-by: Jenkins
    Reviewed-by: Noel Grandin <noel.gran...@collabora.co.uk>
    (cherry picked from commit 6f8a73a379d97829080367b21d54f9b5fab781c9)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167682
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/svx/source/dialog/framelinkarray.cxx 
b/svx/source/dialog/framelinkarray.cxx
index fa5829438698..897012611151 100644
--- a/svx/source/dialog/framelinkarray.cxx
+++ b/svx/source/dialog/framelinkarray.cxx
@@ -936,7 +936,7 @@ void Array::SetAddMergedLeftSize( sal_Int32 nCol, sal_Int32 
nRow, sal_Int32 nAdd
             return;
         Cell aTempCell(*pTempCell);
         aTempCell.mnAddLeft = nAddSize;
-        mxImpl->PutCell( nCol, nRow, aTempCell );
+        mxImpl->PutCell( aIt.Col(), aIt.Row(), aTempCell );
     }
 }
 
@@ -951,7 +951,7 @@ void Array::SetAddMergedRightSize( sal_Int32 nCol, 
sal_Int32 nRow, sal_Int32 nAd
             return;
         Cell aTempCell(*pTempCell);
         aTempCell.mnAddRight = nAddSize;
-        mxImpl->PutCell( nCol, nRow, aTempCell );
+        mxImpl->PutCell( aIt.Col(), aIt.Row(), aTempCell );
     }
 }
 
@@ -966,7 +966,7 @@ void Array::SetAddMergedTopSize( sal_Int32 nCol, sal_Int32 
nRow, sal_Int32 nAddS
             return;
         Cell aTempCell(*pTempCell);
         aTempCell.mnAddTop = nAddSize;
-        mxImpl->PutCell( nCol, nRow, aTempCell );
+        mxImpl->PutCell( aIt.Col(), aIt.Row(), aTempCell );
     }
 }
 
@@ -981,7 +981,7 @@ void Array::SetAddMergedBottomSize( sal_Int32 nCol, 
sal_Int32 nRow, sal_Int32 nA
             return;
         Cell aTempCell(*pTempCell);
         aTempCell.mnAddBottom = nAddSize;
-        mxImpl->PutCell( nCol, nRow, aTempCell );
+        mxImpl->PutCell( aIt.Col(), aIt.Row(), aTempCell );
     }
 }
 
commit c2308ee58a21624574d8eb4f8c4182be768b0b75
Author:     Miklos Vajna <vmik...@collabora.com>
AuthorDate: Fri May 17 08:07:23 2024 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Fri May 17 19:57:46 2024 +0200

    tdf#160952 sw: ignore top margin only at page top, not in fly
    
    See
    
<https://gerrit.libreoffice.org/c/core/+/167671/2#message-8603b129dd8bd72608259571056ded950182ca96>,
    multi-column shape text can't appear in DOCX files, so collapsing upper
    spacing in that case is not correct, avoid it.
    
    Change-Id: Icf69c8d84fdd15d6e3289ff614b2f6ba7cee1e0e
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167758
    Reviewed-by: Miklos Vajna <vmik...@collabora.com>
    Tested-by: Jenkins
    (cherry picked from commit b969e692000f50aafacc2eb577f545b8836dcc26)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167683
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>

diff --git a/sw/qa/core/layout/calcmove.cxx b/sw/qa/core/layout/calcmove.cxx
index a44dc1256b83..ad53df9bd0f4 100644
--- a/sw/qa/core/layout/calcmove.cxx
+++ b/sw/qa/core/layout/calcmove.cxx
@@ -58,6 +58,30 @@ CPPUNIT_TEST_FIXTURE(Test, testIgnoreTopMarginTable)
     // i.e. the top margin in B1's first paragraph was ignored, but not in 
Word.
     CPPUNIT_ASSERT_EQUAL(static_cast<sal_Int32>(2000), nParaTopMargin);
 }
+
+CPPUNIT_TEST_FIXTURE(Test, testIgnoreTopMarginFly)
+{
+    // Given a document with compat flags like DOCX (>= Word 2013), 2 pages, 
multi-col fly frame on
+    // page 2:
+    createSwDoc("ignore-top-margin-fly.odt");
+
+    // When laying out that document:
+    xmlDocUniquePtr pXmlDoc = parseLayoutDump();
+
+    // Then make sure that the top margin is not ignored inside shape text:
+    sal_Int32 nParaTopMargin
+        = getXPath(
+              pXmlDoc,
+              
"/root/page[2]/body/section/column[2]/body/txt/anchored/fly/column/body/txt/infos/prtBounds"_ostr,
+              "top"_ostr)
+              .toInt32();
+    // Without the accompanying fix in place, this test would have failed with:
+    // - Expected: 4000
+    // - Actual  : 0
+    // i.e. the top margin was ignored inside shape text for Word compat, 
while multi-col shape text
+    // is a Writer feature.
+    CPPUNIT_ASSERT_EQUAL(static_cast<sal_Int32>(4000), nParaTopMargin);
+}
 }
 
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/sw/qa/core/layout/data/ignore-top-margin-fly.odt 
b/sw/qa/core/layout/data/ignore-top-margin-fly.odt
new file mode 100644
index 000000000000..51bda8fe40a9
Binary files /dev/null and b/sw/qa/core/layout/data/ignore-top-margin-fly.odt 
differ
diff --git a/sw/source/core/layout/calcmove.cxx 
b/sw/source/core/layout/calcmove.cxx
index 63c774c25cd6..f358d74af0bd 100644
--- a/sw/source/core/layout/calcmove.cxx
+++ b/sw/source/core/layout/calcmove.cxx
@@ -1092,6 +1092,12 @@ bool SwFrame::IsCollapseUpper() const
         return false;
     }
 
+    if (IsInFly())
+    {
+        // Not in a page's body.
+        return false;
+    }
+
     // Word >= 2013 style: when we're at the top of the page's body, but not 
on the first page, then
     // ignore the upper margin for paragraphs.
     if (GetPrev() || !GetUpper() || !GetUpper()->IsBodyFrame())
commit 39b9041a1e2a4850df33bf1ae36416341fed2e7e
Author:     Mike Kaganski <mike.kagan...@collabora.com>
AuthorDate: Thu May 16 11:07:26 2024 +0500
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Fri May 17 19:57:45 2024 +0200

    tdf#161035: The previous bookmarks can legitimately be not processed
    
    The enumeration may be called for a partial paragraph selection, and
    then the bookmarks prior to the selection are not processed.
    
    Change-Id: Ib725ffb320ec5a81b39ce77f06392a82bd6d8ee0
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167720
    Reviewed-by: Mike Kaganski <mike.kagan...@collabora.com>
    Tested-by: Jenkins
    Reviewed-by: Patrick Luby <guibomac...@gmail.com>
    Signed-off-by: Xisco Fauli <xiscofa...@libreoffice.org>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167754
    Reviewed-by: Adolfo Jayme Barrientos <fit...@ubuntu.com>

diff --git a/sw/qa/extras/unowriter/data/tdf161035.fodt 
b/sw/qa/extras/unowriter/data/tdf161035.fodt
new file mode 100644
index 000000000000..8f1d53b083d6
--- /dev/null
+++ b/sw/qa/extras/unowriter/data/tdf161035.fodt
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<office:document 
xmlns:office="urn:oasis:names:tc:opendocument:xmlns:office:1.0" 
xmlns:text="urn:oasis:names:tc:opendocument:xmlns:text:1.0" 
office:version="1.3" office:mimetype="application/vnd.oasis.opendocument.text">
+ <office:body>
+  <office:text>
+   <text:p>Lorem <text:bookmark text:name="Bookmark"/>ipsum.</text:p>
+  </office:text>
+ </office:body>
+</office:document>
\ No newline at end of file
diff --git a/sw/qa/extras/unowriter/unowriter.cxx 
b/sw/qa/extras/unowriter/unowriter.cxx
index 80b9e556f73b..7175e702d709 100644
--- a/sw/qa/extras/unowriter/unowriter.cxx
+++ b/sw/qa/extras/unowriter/unowriter.cxx
@@ -1222,6 +1222,33 @@ CPPUNIT_TEST_FIXTURE(SwUnoWriter, testTdf160278)
     CPPUNIT_ASSERT_EQUAL(u"12test"_ustr, xText->getString());
 }
 
+CPPUNIT_TEST_FIXTURE(SwUnoWriter, testTdf161035)
+{
+    // Given a paragraph with a bookmark:
+    createSwDoc("tdf161035.fodt");
+    auto xModel = mxComponent.queryThrow<frame::XModel>();
+
+    // Create a text view cursor in the paragraph.
+    auto xController = 
xModel->getCurrentController().queryThrow<text::XTextViewCursorSupplier>();
+    auto xViewCursor = xController->getViewCursor();
+    CPPUNIT_ASSERT(xViewCursor);
+    auto xText = xViewCursor->getText();
+    CPPUNIT_ASSERT(xText);
+    // Create a text cursor from the text view cursor, and move it to the end 
of the paragraph
+    auto xTextCursor = xText->createTextCursorByRange(xViewCursor);
+    CPPUNIT_ASSERT(xTextCursor);
+    xTextCursor->gotoEnd(false);
+    // Get the first paragraph portion from the text cursor
+    auto xParaEnum = 
xTextCursor.queryThrow<container::XEnumerationAccess>()->createEnumeration();
+    CPPUNIT_ASSERT(xParaEnum);
+    auto xPara = 
xParaEnum->nextElement().queryThrow<container::XEnumerationAccess>();
+    // Try to enumerate text portions. Without the fix, it would fail an 
assertion in debug builds,
+    // and hang in release builds, because the paragraph portion started after 
the bookmark, and
+    // so the bookmark wasn't processed (expectedly):
+    auto xRunEnum = xPara->createEnumeration();
+    CPPUNIT_ASSERT(!xRunEnum->hasMoreElements()); // Empty enumeration for 
empty selection
+}
+
 CPPUNIT_PLUGIN_IMPLEMENT();
 
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/sw/source/core/unocore/unoportenum.cxx 
b/sw/source/core/unocore/unoportenum.cxx
index 709d79ef4d4b..9177765c0e32 100644
--- a/sw/source/core/unocore/unoportenum.cxx
+++ b/sw/source/core/unocore/unoportenum.cxx
@@ -608,7 +608,9 @@ static void lcl_ExportBookmark(
         const SwXBookmarkPortion_ImplSharedPtr& pPtr = *aIter;
         if ( nIndex > pPtr->getIndex() )
         {
-            assert(!"Some bookmarks were not consumed earlier");
+            // We may get here, if SwXTextPortionEnumeration ctor was called 
with nStart greater
+            // than this bookmark's index. Just drop it.
+            aIter = rBkmArr.erase(aIter);
             continue;
         }
         if ( nIndex < pPtr->getIndex() )
commit 97863cd0d47c44bd8acdfe39794c7550287d10a5
Author:     Xisco Fauli <xiscofa...@libreoffice.org>
AuthorDate: Tue Apr 30 10:07:23 2024 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Fri May 17 19:57:45 2024 +0200

    Fix UBSan failure (part 2)
    
    Introduced by 495b5db74f0db59395ff68bacc8d8ca67595b66e
    "sw: check GetUserCall"
    
    https: //gerrit.libreoffice.org/c/core/+/166824/comments/8db24a41_2f4e7e4e
    Change-Id: Ib6f981aa3055f0d37d0b83e3284842d310fe6ef0
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/166913
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>
    Signed-off-by: Xisco Fauli <xiscofa...@libreoffice.org>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167002
    Reviewed-by: Christian Lohmaier <lohmaier+libreoff...@googlemail.com>

diff --git a/sw/source/core/frmedt/fefly1.cxx b/sw/source/core/frmedt/fefly1.cxx
index 644c5ccf0e40..d6ff8b296908 100644
--- a/sw/source/core/frmedt/fefly1.cxx
+++ b/sw/source/core/frmedt/fefly1.cxx
@@ -386,7 +386,7 @@ const SwFrameFormat* SwFEShell::IsFlyInFly()
         return nullptr;
 
     SdrObject *pObj = rMrkList.GetMark( 0 )->GetMarkedSdrObj();
-    SwDrawContact *pContact = static_cast<SwDrawContact*>(GetUserCall(pObj));
+    SwContact* pContact = GetUserCall( pObj );
     if (!pContact)
         return nullptr;
 
@@ -400,7 +400,7 @@ const SwFrameFormat* SwFEShell::IsFlyInFly()
         }
         else
         {
-            pFly = pContact->GetAnchorFrame(pObj);
+            pFly = static_cast<SwDrawContact*>(pContact)->GetAnchorFrame(pObj);
         }
 
         OSL_ENSURE( pFly, "IsFlyInFly: Where's my anchor?" );
commit c244511404f2c2693527debf4b59db4ed06126cb
Author:     Xisco Fauli <xiscofa...@libreoffice.org>
AuthorDate: Mon Apr 29 09:54:12 2024 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Fri May 17 19:57:45 2024 +0200

    Fix UBSan failure
    
    Introduced by 495b5db74f0db59395ff68bacc8d8ca67595b66e
    "sw: check GetUserCall"
    
    
https://ci.libreoffice.org/job/lo_ubsan/3154/consoleFull#-1571115798d893063f-7f3d-4b7e-b56f-4e0f225817cd
    Change-Id: Ifc80312890f2e6b82dcc9419b5b7e8bfcd5340a5
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/166824
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>
    Signed-off-by: Xisco Fauli <xiscofa...@libreoffice.org>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167001
    Reviewed-by: Christian Lohmaier <lohmaier+libreoff...@googlemail.com>

diff --git a/sw/source/core/draw/dview.cxx b/sw/source/core/draw/dview.cxx
index 39ecb982c00c..5499dad7c9ca 100644
--- a/sw/source/core/draw/dview.cxx
+++ b/sw/source/core/draw/dview.cxx
@@ -706,13 +706,10 @@ const SwFrame* SwDrawView::CalcAnchor()
         return nullptr;
 
     SdrObject* pObj = rMrkList.GetMark( 0 )->GetMarkedSdrObj();
-    SwDrawContact* pContact = static_cast<SwDrawContact*>(GetUserCall(pObj));
-    if (!pContact)
-        return nullptr;
 
     //Search for paragraph bound objects, otherwise only the
     //current anchor. Search only if we currently drag.
-    const SwFrame* pAnch;
+    const SwFrame* pAnch = nullptr;
     tools::Rectangle aMyRect;
     auto pFlyDrawObj = dynamic_cast<SwVirtFlyDrawObj *>( pObj );
     if ( pFlyDrawObj )
@@ -724,13 +721,16 @@ const SwFrame* SwDrawView::CalcAnchor()
     {
         // determine correct anchor position for 'virtual' drawing objects.
         // #i26791#
-        pAnch = pContact->GetAnchorFrame( pObj );
-        if( !pAnch )
+        if (SwDrawContact* pContact = 
static_cast<SwDrawContact*>(GetUserCall(pObj)))
         {
-            pContact->ConnectToLayout();
-            // determine correct anchor position for 'virtual' drawing objects.
-            // #i26791#
             pAnch = pContact->GetAnchorFrame( pObj );
+            if( !pAnch )
+            {
+                pContact->ConnectToLayout();
+                // determine correct anchor position for 'virtual' drawing 
objects.
+                // #i26791#
+                pAnch = pContact->GetAnchorFrame( pObj );
+            }
         }
         aMyRect = pObj->GetSnapRect();
     }
@@ -765,11 +765,14 @@ const SwFrame* SwDrawView::CalcAnchor()
         {
             const SwRect aRect( aPt.getX(), aPt.getY(), 1, 1 );
 
-            if ( pContact->GetAnchorFrame( pObj ) &&
-                 pContact->GetAnchorFrame( pObj )->IsPageFrame() )
-                pAnch = pContact->GetPageFrame();
-            else
-                pAnch = pContact->FindPage( aRect );
+            if (SwDrawContact* pContact = 
static_cast<SwDrawContact*>(GetUserCall(pObj)))
+            {
+                if ( pContact->GetAnchorFrame( pObj ) &&
+                     pContact->GetAnchorFrame( pObj )->IsPageFrame() )
+                    pAnch = pContact->GetPageFrame();
+                else
+                    pAnch = pContact->FindPage( aRect );
+            }
         }
     }
     if( pAnch && !pAnch->IsProtected() )
commit 274a004c6bc14c392c7cc1cefa6216c2ecdd2084
Author:     Xisco Fauli <xiscofa...@libreoffice.org>
AuthorDate: Thu Apr 25 18:15:12 2024 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Fri May 17 19:57:45 2024 +0200

    sw: check GetUserCall
    
    It might return nullptr
    See 
https://crashreport.libreoffice.org/stats/signature/SwFEShell::ShouldObjectBeSelected(Point%20const%20&)
    
    Change-Id: Ia0ed355a7eb9084b9f57163ffbfe6b549c8bdb3f
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/166642
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>
    (cherry picked from commit 495b5db74f0db59395ff68bacc8d8ca67595b66e)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/166710
    Reviewed-by: Christian Lohmaier <lohmaier+libreoff...@googlemail.com>

diff --git a/sw/source/core/access/accfrmobj.cxx 
b/sw/source/core/access/accfrmobj.cxx
index f78dc2d155db..004ca4ab94e0 100644
--- a/sw/source/core/access/accfrmobj.cxx
+++ b/sw/source/core/access/accfrmobj.cxx
@@ -240,13 +240,16 @@ SwRect SwAccessibleChild::GetBox( const SwAccessibleMap& 
rAccMap ) const
         // by the mpFrame case above b) for genuine SdrObject this must be set
         // if it's connected to layout
         assert(dynamic_cast<SwDrawContact const*>(pContact));
-        SwPageFrame const*const pPage(const_cast<SwAnchoredObject *>(
-            pContact->GetAnchoredObj(mpDrawObj))->FindPageFrameOfAnchor());
-        if (pPage) // may end up here with partial layout -> not visible
+        if (pContact)
         {
-            aBox = SwRect( mpDrawObj->GetCurrentBoundRect() );
-            // tdf#91260 drawing object may be partially off-page
-            aBox.Intersection(pPage->getFrameArea());
+            SwPageFrame const*const pPage(const_cast<SwAnchoredObject *>(
+                pContact->GetAnchoredObj(mpDrawObj))->FindPageFrameOfAnchor());
+            if (pPage) // may end up here with partial layout -> not visible
+            {
+                aBox = SwRect( mpDrawObj->GetCurrentBoundRect() );
+                // tdf#91260 drawing object may be partially off-page
+                aBox.Intersection(pPage->getFrameArea());
+            }
         }
     }
     else if ( mpWindow )
diff --git a/sw/source/core/doc/docdraw.cxx b/sw/source/core/doc/docdraw.cxx
index 521ca2b0ba15..09b1d9afb697 100644
--- a/sw/source/core/doc/docdraw.cxx
+++ b/sw/source/core/doc/docdraw.cxx
@@ -68,6 +68,9 @@ static void lcl_AdjustPositioningAttr( SwDrawFrameFormat* 
_pFrameFormat,
     const SwContact* pContact = GetUserCall( &_rSdrObj );
     OSL_ENSURE( pContact, "<lcl_AdjustPositioningAttr(..)> - missing contact 
object." );
 
+    if (!pContact)
+        return;
+
     // determine position of new group object relative to its anchor frame 
position
     SwTwips nHoriRelPos = 0;
     SwTwips nVertRelPos = 0;
@@ -195,6 +198,9 @@ SwDrawContact* SwDoc::GroupSelection( SdrView& rDrawView )
 
         // Revoke anchor attribute.
         SwDrawContact *pMyContact = 
static_cast<SwDrawContact*>(GetUserCall(pObj));
+        if (!pMyContact)
+            return pNewContact;
+
         const SwFormatAnchor aAnch( pMyContact->GetFormat()->GetAnchor() );
 
         std::unique_ptr<SwUndoDrawGroup> pUndo;
@@ -216,6 +222,9 @@ SwDrawContact* SwDoc::GroupSelection( SdrView& rDrawView )
             pObj = rMrkList.GetMark( i )->GetMarkedSdrObj();
             SwDrawContact *pContact = 
static_cast<SwDrawContact*>(GetUserCall(pObj));
 
+            if (!pContact)
+                continue;
+
             // #i53320#
 #if OSL_DEBUG_LEVEL > 0
             SwAnchoredDrawObject* pAnchoredDrawObj =
@@ -352,6 +361,9 @@ void SwDoc::UnGroupSelection( SdrView& rDrawView )
                 {
                     SwDrawContact *pContact = 
static_cast<SwDrawContact*>(GetUserCall(pObj));
 
+                    if (!pContact)
+                        continue;
+
                     std::shared_ptr<SwTextBoxNode> pTextBoxNode;
                     if (auto pGroupFormat = pContact->GetFormat())
                         pTextBoxNode = pGroupFormat->GetOtherTextBoxFormats();
diff --git a/sw/source/core/draw/dview.cxx b/sw/source/core/draw/dview.cxx
index fe0db61925c4..39ecb982c00c 100644
--- a/sw/source/core/draw/dview.cxx
+++ b/sw/source/core/draw/dview.cxx
@@ -210,10 +210,14 @@ void SwDrawView::AddCustomHdl()
 {
     const SdrMarkList &rMrkList = GetMarkedObjectList();
 
-    if(rMrkList.GetMarkCount() != 1 || !GetUserCall(rMrkList.GetMark( 0 
)->GetMarkedSdrObj()))
+    if(rMrkList.GetMarkCount() != 1)
         return;
 
     SdrObject *pObj = rMrkList.GetMark(0)->GetMarkedSdrObj();
+    SwContact* pContact = ::GetUserCall( pObj );
+    if (!pContact)
+        return;
+
     // make code robust
     SwFrameFormat* pFrameFormat( ::FindFrameFormat( pObj ) );
     if ( !pFrameFormat )
@@ -236,7 +240,7 @@ void SwDrawView::AddCustomHdl()
     {
         // #i28701# - use last character rectangle saved at object
         // in order to avoid a format of the anchor frame
-        SwAnchoredObject* pAnchoredObj = ::GetUserCall( pObj 
)->GetAnchoredObj( pObj );
+        SwAnchoredObject* pAnchoredObj = pContact->GetAnchoredObj( pObj );
 
         // Invalidate/recalc LastCharRect which can contain invalid frame 
offset because
         // of later frame changes
@@ -360,7 +364,8 @@ void SwDrawView::MoveRepeatedObjs( const SwAnchoredObject& 
_rMovedAnchoredObj,
     {
         const SwContact* pContact = ::GetUserCall( 
_rMovedAnchoredObj.GetDrawObj() );
         assert(pContact && "SwDrawView::MoveRepeatedObjs(..) - missing contact 
object -> crash.");
-        pContact->GetAnchoredObjs( aAnchoredObjs );
+        if (pContact)
+            pContact->GetAnchoredObjs( aAnchoredObjs );
     }
 
     // check, if 'repeated' objects exists.
@@ -402,7 +407,8 @@ void SwDrawView::MoveRepeatedObjs( const SwAnchoredObject& 
_rMovedAnchoredObj,
         {
             const SwContact* pContact = ::GetUserCall( pChildObj );
             assert(pContact && "SwDrawView::MoveRepeatedObjs(..) - missing 
contact object -> crash.");
-            pContact->GetAnchoredObjs( aAnchoredObjs );
+            if (pContact)
+                pContact->GetAnchoredObjs( aAnchoredObjs );
         }
         // move 'repeated' ones to the same order number as the already moved 
one.
         const size_t nTmpNewPos = pChildObj->GetOrdNum();
@@ -449,8 +455,11 @@ void SwDrawView::ObjOrderChanged( SdrObject* pObj, size_t 
nOldPos,
         pDrawPage->RecalcObjOrdNums();
     const size_t nObjCount = pDrawPage->GetObjCount();
 
-    SwAnchoredObject* pMovedAnchoredObj =
-                                ::GetUserCall( pObj )->GetAnchoredObj( pObj );
+    SwContact* pContact = ::GetUserCall( pObj );
+    if (!pContact)
+        return;
+
+    SwAnchoredObject* pMovedAnchoredObj = pContact->GetAnchoredObj( pObj );
     const SwFlyFrame* pParentAnchoredObj =
                                 
pMovedAnchoredObj->GetAnchorFrame()->FindFlyFrame();
 
@@ -493,21 +502,22 @@ void SwDrawView::ObjOrderChanged( SdrObject* pObj, size_t 
nOldPos,
         if ( pTmpObj )
         {
             size_t nTmpNewPos( nNewPos );
-            if ( bMovedForward )
-            {
-                // move before the top 'repeated' object
-                const sal_uInt32 nTmpMaxOrdNum =
-                                    ::GetUserCall( pTmpObj )->GetMaxOrdNum();
-                if ( nTmpMaxOrdNum > nNewPos )
-                    nTmpNewPos = nTmpMaxOrdNum;
-            }
-            else
+            if (const SwContact* pContact2 = ::GetUserCall( pTmpObj ))
             {
-                // move behind the bottom 'repeated' object
-                const sal_uInt32 nTmpMinOrdNum =
-                                    ::GetUserCall( pTmpObj )->GetMinOrdNum();
-                if ( nTmpMinOrdNum < nNewPos )
-                    nTmpNewPos = nTmpMinOrdNum;
+                if ( bMovedForward )
+                {
+                    // move before the top 'repeated' object
+                    const sal_uInt32 nTmpMaxOrdNum = pContact2->GetMaxOrdNum();
+                    if ( nTmpMaxOrdNum > nNewPos )
+                        nTmpNewPos = nTmpMaxOrdNum;
+                }
+                else
+                {
+                    // move behind the bottom 'repeated' object
+                    const sal_uInt32 nTmpMinOrdNum = pContact2->GetMinOrdNum();
+                    if ( nTmpMinOrdNum < nNewPos )
+                        nTmpNewPos = nTmpMinOrdNum;
+                }
             }
             if ( nTmpNewPos != nNewPos )
             {
@@ -529,18 +539,25 @@ void SwDrawView::ObjOrderChanged( SdrObject* pObj, size_t 
nOldPos,
         {
             // determine position before the object before its top 'child' 
object
             const SdrObject* pTmpObj = pDrawPage->GetObj( nMaxChildOrdNum );
-            size_t nTmpNewPos = ::GetUserCall( pTmpObj )->GetMaxOrdNum() + 1;
-            if ( nTmpNewPos >= nObjCount )
+            if (SwContact* pContact2 = ::GetUserCall( pTmpObj ))
             {
-                --nTmpNewPos;
+                size_t nTmpNewPos = pContact2->GetMaxOrdNum() + 1;
+                if ( nTmpNewPos >= nObjCount )
+                {
+                    --nTmpNewPos;
+                }
+                // assure, that determined position isn't between 'repeated' 
objects
+                pTmpObj = pDrawPage->GetObj( nTmpNewPos );
+                pContact2 = ::GetUserCall( pTmpObj );
+                if (pContact2)
+                {
+                    nTmpNewPos = pContact2->GetMaxOrdNum();
+                    // apply new position
+                    pDrawPage->SetObjectOrdNum( nNewPos, nTmpNewPos );
+                    nNewPos = nTmpNewPos;
+                    pDrawPage->RecalcObjOrdNums();
+                }
             }
-            // assure, that determined position isn't between 'repeated' 
objects
-            pTmpObj = pDrawPage->GetObj( nTmpNewPos );
-            nTmpNewPos = ::GetUserCall( pTmpObj )->GetMaxOrdNum();
-            // apply new position
-            pDrawPage->SetObjectOrdNum( nNewPos, nTmpNewPos );
-            nNewPos = nTmpNewPos;
-            pDrawPage->RecalcObjOrdNums();
         }
     }
 
@@ -564,16 +581,18 @@ void SwDrawView::ObjOrderChanged( SdrObject* pObj, size_t 
nOldPos,
             if ( pTmpParentObj &&
                  pTmpParentObj->GetFrameFormat() != pParentFrameFormat )
             {
-                if ( bMovedForward )
+                if (const SwContact* pContact2 = ::GetUserCall( pTmpObj ))
                 {
-                    nTmpNewPos = ::GetUserCall( pTmpObj )->GetMaxOrdNum();
-                    pTmpObj = pDrawPage->GetObj( nTmpNewPos + 1 );
-                }
-                else
-                {
-                    nTmpNewPos = ::GetUserCall( pTmpParentObj->GetDrawObj() )
-                                                            ->GetMinOrdNum();
-                    pTmpObj = pTmpParentObj->GetDrawObj();
+                    if ( bMovedForward )
+                    {
+                        nTmpNewPos = pContact2->GetMaxOrdNum();
+                        pTmpObj = pDrawPage->GetObj( nTmpNewPos + 1 );
+                    }
+                    else
+                    {
+                        nTmpNewPos = pContact2->GetMinOrdNum();
+                        pTmpObj = pTmpParentObj->GetDrawObj();
+                    }
                 }
             }
             else
@@ -687,6 +706,9 @@ const SwFrame* SwDrawView::CalcAnchor()
         return nullptr;
 
     SdrObject* pObj = rMrkList.GetMark( 0 )->GetMarkedSdrObj();
+    SwDrawContact* pContact = static_cast<SwDrawContact*>(GetUserCall(pObj));
+    if (!pContact)
+        return nullptr;
 
     //Search for paragraph bound objects, otherwise only the
     //current anchor. Search only if we currently drag.
@@ -700,16 +722,15 @@ const SwFrame* SwDrawView::CalcAnchor()
     }
     else
     {
-        SwDrawContact *pC = static_cast<SwDrawContact*>(GetUserCall(pObj));
         // determine correct anchor position for 'virtual' drawing objects.
         // #i26791#
-        pAnch = pC->GetAnchorFrame( pObj );
+        pAnch = pContact->GetAnchorFrame( pObj );
         if( !pAnch )
         {
-            pC->ConnectToLayout();
+            pContact->ConnectToLayout();
             // determine correct anchor position for 'virtual' drawing objects.
             // #i26791#
-            pAnch = pC->GetAnchorFrame( pObj );
+            pAnch = pContact->GetAnchorFrame( pObj );
         }
         aMyRect = pObj->GetSnapRect();
     }
@@ -744,7 +765,6 @@ const SwFrame* SwDrawView::CalcAnchor()
         {
             const SwRect aRect( aPt.getX(), aPt.getY(), 1, 1 );
 
-            SwDrawContact* pContact = 
static_cast<SwDrawContact*>(GetUserCall(pObj));
             if ( pContact->GetAnchorFrame( pObj ) &&
                  pContact->GetAnchorFrame( pObj )->IsPageFrame() )
                 pAnch = pContact->GetPageFrame();
diff --git a/sw/source/core/frmedt/fecopy.cxx b/sw/source/core/frmedt/fecopy.cxx
index 69fae8bf0ae0..01eee5072fb6 100644
--- a/sw/source/core/frmedt/fecopy.cxx
+++ b/sw/source/core/frmedt/fecopy.cxx
@@ -195,18 +195,20 @@ void SwFEShell::Copy( SwDoc& rClpDoc, const OUString* 
pNewClpText )
             }
             else
             {
-                SwDrawContact *pContact = 
static_cast<SwDrawContact*>(GetUserCall( pObj ));
-                SwFrameFormat *pFormat = pContact->GetFormat();
-                SwFormatAnchor aAnchor( pFormat->GetAnchor() );
-                if ((RndStdIds::FLY_AT_PARA == aAnchor.GetAnchorId()) ||
-                    (RndStdIds::FLY_AT_CHAR == aAnchor.GetAnchorId()) ||
-                    (RndStdIds::FLY_AT_FLY  == aAnchor.GetAnchorId()) ||
-                    (RndStdIds::FLY_AS_CHAR == aAnchor.GetAnchorId()))
+                if (SwDrawContact *pContact = 
static_cast<SwDrawContact*>(GetUserCall( pObj )))
                 {
-                    aAnchor.SetAnchor( &aPos );
-                }
+                    SwFrameFormat *pFormat = pContact->GetFormat();
+                    SwFormatAnchor aAnchor( pFormat->GetAnchor() );
+                    if ((RndStdIds::FLY_AT_PARA == aAnchor.GetAnchorId()) ||
+                        (RndStdIds::FLY_AT_CHAR == aAnchor.GetAnchorId()) ||
+                        (RndStdIds::FLY_AT_FLY  == aAnchor.GetAnchorId()) ||
+                        (RndStdIds::FLY_AS_CHAR == aAnchor.GetAnchorId()))
+                    {
+                        aAnchor.SetAnchor( &aPos );
+                    }
 
-                rClpDoc.getIDocumentLayoutAccess().CopyLayoutFormat( *pFormat, 
aAnchor, true, true );
+                    rClpDoc.getIDocumentLayoutAccess().CopyLayoutFormat( 
*pFormat, aAnchor, true, true );
+                }
             }
         }
     }
@@ -297,6 +299,9 @@ bool SwFEShell::CopyDrawSel( SwFEShell& rDestShell, const 
Point& rSttPt,
         SdrObject *pObj = aMrkList.GetMark( i )->GetMarkedSdrObj();
 
         SwDrawContact *pContact = static_cast<SwDrawContact*>(GetUserCall( 
pObj ));
+        if (!pContact)
+            continue;
+
         SwFrameFormat *pFormat = pContact->GetFormat();
         const SwFormatAnchor& rAnchor = pFormat->GetAnchor();
 
diff --git a/sw/source/core/frmedt/fefly1.cxx b/sw/source/core/frmedt/fefly1.cxx
index 2e5b8bf53d15..644c5ccf0e40 100644
--- a/sw/source/core/frmedt/fefly1.cxx
+++ b/sw/source/core/frmedt/fefly1.cxx
@@ -382,11 +382,13 @@ const SwFrameFormat* SwFEShell::IsFlyInFly()
             return nullptr;
         return pFly->GetFormat();
     }
-    else if ( rMrkList.GetMarkCount() != 1 ||
-         !GetUserCall(rMrkList.GetMark( 0 )->GetMarkedSdrObj()) )
+    else if ( rMrkList.GetMarkCount() != 1 )
         return nullptr;
 
     SdrObject *pObj = rMrkList.GetMark( 0 )->GetMarkedSdrObj();
+    SwDrawContact *pContact = static_cast<SwDrawContact*>(GetUserCall(pObj));
+    if (!pContact)
+        return nullptr;
 
     SwFrameFormat *pFormat = FindFrameFormat( pObj );
     if( pFormat && RndStdIds::FLY_AT_FLY == pFormat->GetAnchor().GetAnchorId() 
)
@@ -398,7 +400,7 @@ const SwFrameFormat* SwFEShell::IsFlyInFly()
         }
         else
         {
-            pFly = 
static_cast<SwDrawContact*>(GetUserCall(pObj))->GetAnchorFrame(pObj);
+            pFly = pContact->GetAnchorFrame(pObj);
         }
 
         OSL_ENSURE( pFly, "IsFlyInFly: Where's my anchor?" );
@@ -491,11 +493,12 @@ Point SwFEShell::FindAnchorPos( const Point& rAbsPos, 
bool bMoveIt )
 
     SdrObject* pObj = rMrkList.GetMark(0)->GetMarkedSdrObj();
 
-    if (!GetUserCall(pObj))
+    SwContact* pContact = ::GetUserCall( pObj );
+    if (!pContact)
         return aRet;
 
     // #i28701#
-    SwAnchoredObject* pAnchoredObj = ::GetUserCall( pObj )->GetAnchoredObj( 
pObj );
+    SwAnchoredObject* pAnchoredObj = pContact->GetAnchoredObj( pObj );
     SwFrameFormat* pFormat = pAnchoredObj->GetFrameFormat();
     const RndStdIds nAnchorId = pFormat->GetAnchor().GetAnchorId();
 
diff --git a/sw/source/core/frmedt/feshview.cxx 
b/sw/source/core/frmedt/feshview.cxx
index 4ad0747619ee..353cb5214ea8 100644
--- a/sw/source/core/frmedt/feshview.cxx
+++ b/sw/source/core/frmedt/feshview.cxx
@@ -377,22 +377,27 @@ bool SwFEShell::MoveAnchor( SwMove nDir )
     const SdrMarkList& pMrkList = Imp()->GetDrawView()->GetMarkedObjectList();
     if (1 != pMrkList.GetMarkCount())
         return false;
+
+    SdrObject *pObj = pMrkList.GetMark( 0 )->GetMarkedSdrObj();
+    SwDrawContact* pContact = static_cast<SwDrawContact*>(GetUserCall(pObj));
+    if (!pContact)
+        return false;
+
     SwFrame* pOld;
     SwFlyFrame* pFly = nullptr;
-    SdrObject *pObj = pMrkList.GetMark( 0 )->GetMarkedSdrObj();
     if (SwVirtFlyDrawObj* pVirtO = dynamic_cast<SwVirtFlyDrawObj*>(pObj))
     {
         pFly = pVirtO->GetFlyFrame();
         pOld = pFly->AnchorFrame();
     }
     else
-        pOld = static_cast<SwDrawContact*>(GetUserCall(pObj))->GetAnchorFrame( 
pObj );
+        pOld = pContact->GetAnchorFrame( pObj );
     bool bRet = false;
     if( pOld )
     {
         SwFrame* pNew = pOld;
         // #i28701#
-        SwAnchoredObject* pAnchoredObj = ::GetUserCall( pObj 
)->GetAnchoredObj( pObj );
+        SwAnchoredObject* pAnchoredObj = pContact->GetAnchoredObj( pObj );
         SwFrameFormat* pFormat = pAnchoredObj->GetFrameFormat();
         SwFormatAnchor aAnch( pFormat->GetAnchor() );
         RndStdIds nAnchorId = aAnch.GetAnchorId();
@@ -875,7 +880,11 @@ static void lcl_NotifyNeighbours( const SdrMarkList *pLst )
         }
         else
         {
-            SwFrame* pAnch = static_cast<SwDrawContact*>( GetUserCall(pO) 
)->GetAnchorFrame( pO );
+            SwDrawContact* pContact = 
static_cast<SwDrawContact*>(GetUserCall(pO));
+            if (!pContact)
+                continue;
+
+            SwFrame* pAnch = pContact->GetAnchorFrame( pO );
             if( !pAnch )
                 continue;
             pPage = pAnch->FindPageFrame();
@@ -1317,12 +1326,15 @@ bool SwFEShell::ShouldObjectBeSelected(const Point& rPt)
             {
                 if ( pObj->GetLayer() == rIDDMA.GetHellId() )
                 {
-                    const SwAnchoredObject* pAnchoredObj = ::GetUserCall( pObj 
)->GetAnchoredObj( pObj );
-                    const SwFrameFormat* pFormat = 
pAnchoredObj->GetFrameFormat();
-                    const SwFormatSurround& rSurround = pFormat->GetSurround();
-                    if ( rSurround.GetSurround() == 
css::text::WrapTextMode_THROUGH )
+                    if (const SwContact* pContact = ::GetUserCall( pObj ))
                     {
-                        bObjInBackground = true;
+                        const SwAnchoredObject* pAnchoredObj = 
pContact->GetAnchoredObj( pObj );
+                        const SwFrameFormat* pFormat = 
pAnchoredObj->GetFrameFormat();
+                        const SwFormatSurround& rSurround = 
pFormat->GetSurround();
+                        if ( rSurround.GetSurround() == 
css::text::WrapTextMode_THROUGH )
+                        {
+                            bObjInBackground = true;
+                        }
                     }
                 }
             }
@@ -2352,7 +2364,7 @@ bool SwFEShell::IsGroupSelected(bool bAllowDiagams)
             // Thus, use corresponding method instead of checking type.
             if ( pObj->IsGroupObject() &&
                  // --> #i38505# No ungroup allowed for 3d objects
-                 !pObj->Is3DObj() &&
+                 !pObj->Is3DObj() && GetUserCall(pObj) &&
                  RndStdIds::FLY_AS_CHAR != 
static_cast<SwDrawContact*>(GetUserCall(pObj))->
                                       GetFormat()->GetAnchor().GetAnchorId() )
             {
@@ -2681,7 +2693,6 @@ bool SwFEShell::GetObjAttr( SfxItemSet &rSet ) const
     {
         SdrObject *pObj = rMrkList.GetMark( i )->GetMarkedSdrObj();
         SwDrawContact *pContact = 
static_cast<SwDrawContact*>(GetUserCall(pObj));
-        // --> make code robust
         OSL_ENSURE( pContact, "<SwFEShell::GetObjAttr(..)> - missing 
<pContact>." );
         if ( pContact )
         {
@@ -2711,8 +2722,8 @@ void SwFEShell::SetObjAttr( const SfxItemSet& rSet )
     for ( size_t i = 0; i < rMrkList.GetMarkCount(); ++i )
     {
         SdrObject *pObj = rMrkList.GetMark( i )->GetMarkedSdrObj();
-        SwDrawContact *pContact = 
static_cast<SwDrawContact*>(GetUserCall(pObj));
-        GetDoc()->SetAttr( rSet, *pContact->GetFormat() );
+        if (SwDrawContact *pContact = 
static_cast<SwDrawContact*>(GetUserCall(pObj)))
+            GetDoc()->SetAttr( rSet, *pContact->GetFormat() );
     }
 
     EndUndo( SwUndoId::INSATTR );
diff --git a/sw/source/core/layout/anchoreddrawobject.cxx 
b/sw/source/core/layout/anchoreddrawobject.cxx
index 5a9e1245afd8..fe01bbc3b395 100644
--- a/sw/source/core/layout/anchoreddrawobject.cxx
+++ b/sw/source/core/layout/anchoreddrawobject.cxx
@@ -266,6 +266,8 @@ void SwAnchoredDrawObject::MakeObjPos()
 
     SwDrawContact* pDrawContact =
                         static_cast<SwDrawContact*>(::GetUserCall( 
GetDrawObj() ));
+    if (!pDrawContact)
+        return;
 
     // --> #i28749# - if anchored drawing object hasn't been yet
     // positioned, convert its positioning attributes, if its positioning
@@ -849,6 +851,8 @@ void SwAnchoredDrawObject::SetPositioningAttr()
 {
     SwDrawContact* pDrawContact =
                         static_cast<SwDrawContact*>(GetUserCall( GetDrawObj() 
));
+    if (!pDrawContact)
+        return;
 
     SwFrameFormat* pObjFormat = GetFrameFormat();
     if ( !pDrawContact->ObjAnchoredAsChar() )
diff --git a/sw/source/core/layout/anchoredobject.cxx 
b/sw/source/core/layout/anchoredobject.cxx
index a74438afb361..43c5baa396c5 100644
--- a/sw/source/core/layout/anchoredobject.cxx
+++ b/sw/source/core/layout/anchoredobject.cxx
@@ -44,10 +44,13 @@ SwObjPositioningInProgress::SwObjPositioningInProgress( 
SdrObject& _rSdrObj ) :
     // --> #i52904#
     mbOldObjPositioningInProgress( false )
 {
-    mpAnchoredObj = ::GetUserCall( &_rSdrObj )->GetAnchoredObj( &_rSdrObj );
-    // --> #i52904#
-    mbOldObjPositioningInProgress = mpAnchoredObj->IsPositioningInProgress();
-    mpAnchoredObj->SetPositioningInProgress( true );
+    if (SwContact* pContact = ::GetUserCall( &_rSdrObj ))
+    {
+        mpAnchoredObj = pContact->GetAnchoredObj( &_rSdrObj );
+        // --> #i52904#
+        mbOldObjPositioningInProgress = 
mpAnchoredObj->IsPositioningInProgress();
+        mpAnchoredObj->SetPositioningInProgress( true );
+    }
 }
 SwObjPositioningInProgress::SwObjPositioningInProgress( SwAnchoredObject& 
_rAnchoredObj ) :
     mpAnchoredObj( &_rAnchoredObj ),
diff --git a/sw/source/core/layout/fly.cxx b/sw/source/core/layout/fly.cxx
index db50a42de053..b454bd95917f 100644
--- a/sw/source/core/layout/fly.cxx
+++ b/sw/source/core/layout/fly.cxx
@@ -2528,8 +2528,8 @@ void SwFrame::AppendDrawObj( SwAnchoredObject& _rNewObj )
         assert(!m_pDrawObjs || m_pDrawObjs->is_sorted());
         // perform disconnect from layout, if 'master' drawing object is 
appended
         // to a new frame.
-        static_cast<SwDrawContact*>(::GetUserCall( _rNewObj.GetDrawObj() ))->
-                                                DisconnectFromLayout( false );
+        if (SwDrawContact* pContact = 
static_cast<SwDrawContact*>(::GetUserCall( _rNewObj.GetDrawObj() )))
+            pContact->DisconnectFromLayout( false );
         assert(!m_pDrawObjs || m_pDrawObjs->is_sorted());
     }
 
diff --git a/sw/source/core/layout/flylay.cxx b/sw/source/core/layout/flylay.cxx
index 7ac95d65e0d8..b0ef08a01f75 100644
--- a/sw/source/core/layout/flylay.cxx
+++ b/sw/source/core/layout/flylay.cxx
@@ -1430,27 +1430,30 @@ bool CalcClipRect( const SdrObject *pSdrObj, SwRect 
&rRect, bool bMove )
             }
             tools::Long nHeight = (9*aRectFnSet.GetHeight(rRect))/10;
             tools::Long nTop;
-            const SwFormat *pFormat = GetUserCall(pSdrObj)->GetFormat();
-            const SvxULSpaceItem &rUL = pFormat->GetULSpace();
-            if( bMove )
+            if (const SwContact* pContact = ::GetUserCall( pSdrObj ))
             {
-                nTop = aRectFnSet.IsVert() ? static_cast<const 
SwFlyInContentFrame*>(pFly)->GetRefPoint().X() :
-                               static_cast<const 
SwFlyInContentFrame*>(pFly)->GetRefPoint().Y();
-                nTop = aRectFnSet.YInc( nTop, -nHeight );
-                tools::Long nWidth = aRectFnSet.GetWidth(pFly->getFrameArea());
-                aRectFnSet.SetLeftAndWidth( rRect, aRectFnSet.IsVert() ?
-                            static_cast<const 
SwFlyInContentFrame*>(pFly)->GetRefPoint().Y() :
-                            static_cast<const 
SwFlyInContentFrame*>(pFly)->GetRefPoint().X(), nWidth );
-                nHeight = 2*nHeight - rUL.GetLower() - rUL.GetUpper();
-            }
-            else
-            {
-                nTop = aRectFnSet.YInc( 
aRectFnSet.GetBottom(pFly->getFrameArea()),
-                                           rUL.GetLower() - nHeight );
-                nHeight = 2*nHeight - 
aRectFnSet.GetHeight(pFly->getFrameArea())
-                          - rUL.GetLower() - rUL.GetUpper();
+                const SwFormat *pFormat = pContact->GetFormat();
+                const SvxULSpaceItem &rUL = pFormat->GetULSpace();
+                if( bMove )
+                {
+                    nTop = aRectFnSet.IsVert() ? static_cast<const 
SwFlyInContentFrame*>(pFly)->GetRefPoint().X() :
+                                   static_cast<const 
SwFlyInContentFrame*>(pFly)->GetRefPoint().Y();
+                    nTop = aRectFnSet.YInc( nTop, -nHeight );
+                    tools::Long nWidth = 
aRectFnSet.GetWidth(pFly->getFrameArea());
+                    aRectFnSet.SetLeftAndWidth( rRect, aRectFnSet.IsVert() ?
+                                static_cast<const 
SwFlyInContentFrame*>(pFly)->GetRefPoint().Y() :
+                                static_cast<const 
SwFlyInContentFrame*>(pFly)->GetRefPoint().X(), nWidth );
+                    nHeight = 2*nHeight - rUL.GetLower() - rUL.GetUpper();
+                }
+                else
+                {
+                    nTop = aRectFnSet.YInc( 
aRectFnSet.GetBottom(pFly->getFrameArea()),
+                                               rUL.GetLower() - nHeight );
+                    nHeight = 2*nHeight - 
aRectFnSet.GetHeight(pFly->getFrameArea())
+                              - rUL.GetLower() - rUL.GetUpper();
+                }
+                aRectFnSet.SetTopAndHeight( rRect, nTop, nHeight );
             }
-            aRectFnSet.SetTopAndHeight( rRect, nTop, nHeight );
         }
     }
     else
diff --git a/sw/source/core/layout/frmtool.cxx 
b/sw/source/core/layout/frmtool.cxx
index baf632d6ebff..38667bd5c428 100644
--- a/sw/source/core/layout/frmtool.cxx
+++ b/sw/source/core/layout/frmtool.cxx
@@ -297,6 +297,8 @@ void SwFrameNotify::ImplDestroy()
                 bool bNotify = false;
                 bool bNotifySize = false;
                 SwContact* pContact = ::GetUserCall( pObj->GetDrawObj() );
+                if (!pContact)
+                    continue;
                 const bool bAnchoredAsChar = pContact->ObjAnchoredAsChar();
                 if ( !bAnchoredAsChar )
                 {
@@ -1067,22 +1069,23 @@ void AppendObj(SwFrame *const pFrame, SwPageFrame 
*const pPage, SwFrameFormat *c
                             InsertObject(pSdrObj, pSdrObj->GetOrdNumDirect());
                 }
 
-                SwDrawContact* pNew =
-                    static_cast<SwDrawContact*>(GetUserCall( pSdrObj ));
-                if ( !pNew->GetAnchorFrame() )
-                {
-                    pFrame->AppendDrawObj( *(pNew->GetAnchoredObj( nullptr )) 
);
-                }
-                // OD 19.06.2003 #108784# - add 'virtual' drawing object,
-                // if necessary. But control objects have to be excluded.
-                else if ( !::CheckControlLayer( pSdrObj ) &&
-                          pNew->GetAnchorFrame() != pFrame &&
-                          !pNew->GetDrawObjectByAnchorFrame( *pFrame ) )
+                if (SwDrawContact* pNew = 
static_cast<SwDrawContact*>(GetUserCall( pSdrObj )))
                 {
-                    SwDrawVirtObj* pDrawVirtObj = pNew->AddVirtObj(*pFrame);
-                    pFrame->AppendDrawObj( *(pNew->GetAnchoredObj( 
pDrawVirtObj )) );
+                    if ( !pNew->GetAnchorFrame() )
+                    {
+                        pFrame->AppendDrawObj( *(pNew->GetAnchoredObj( nullptr 
)) );
+                    }
+                    // OD 19.06.2003 #108784# - add 'virtual' drawing object,
+                    // if necessary. But control objects have to be excluded.
+                    else if ( !::CheckControlLayer( pSdrObj ) &&
+                              pNew->GetAnchorFrame() != pFrame &&
+                              !pNew->GetDrawObjectByAnchorFrame( *pFrame ) )
+                    {
+                        SwDrawVirtObj* pDrawVirtObj = 
pNew->AddVirtObj(*pFrame);
+                        pFrame->AppendDrawObj( *(pNew->GetAnchoredObj( 
pDrawVirtObj )) );
 
-                    pDrawVirtObj->ActionChanged();
+                        pDrawVirtObj->ActionChanged();
+                    }
                 }
             }
             else
@@ -3598,8 +3601,13 @@ bool Is_Lower_Of(const SwFrame *pCurrFrame, const 
SdrObject* pObj)
     }
     else
     {
-        pFrame = 
static_cast<SwDrawContact*>(GetUserCall(pObj))->GetAnchorFrame(pObj);
-        aPos = pObj->GetCurrentBoundRect().TopLeft();
+        if (SwDrawContact* pC = static_cast<SwDrawContact*>(GetUserCall(pObj)))
+        {
+            pFrame = pC->GetAnchorFrame(pObj);
+            aPos = pObj->GetCurrentBoundRect().TopLeft();
+        }
+        else
+            return false;
     }
     OSL_ENSURE( pFrame, "8-( Fly is lost in Space." );
     pFrame = GetVirtualUpper( pFrame, aPos );
diff --git a/sw/source/core/layout/pagechg.cxx 
b/sw/source/core/layout/pagechg.cxx
index 6aad283273fc..2575c9827886 100644
--- a/sw/source/core/layout/pagechg.cxx
+++ b/sw/source/core/layout/pagechg.cxx
@@ -446,22 +446,21 @@ static void lcl_MakeObjs(const 
sw::FrameFormats<sw::SpzFrameFormat*>& rSpzs, SwP
             if ( bSdrObj )
             {
                 // OD 23.06.2003 #108784# - consider 'virtual' drawing objects
-                SwDrawContact *pContact =
-                            
static_cast<SwDrawContact*>(::GetUserCall(pSdrObj));
-                if ( auto pDrawVirtObj = dynamic_cast<SwDrawVirtObj *>( 
pSdrObj ) )
+                if (SwDrawContact *pContact =
+                            
static_cast<SwDrawContact*>(::GetUserCall(pSdrObj)))
                 {
-                    if ( pContact )
+                    if ( auto pDrawVirtObj = dynamic_cast<SwDrawVirtObj *>( 
pSdrObj ) )
                     {
                         pDrawVirtObj->RemoveFromWriterLayout();
                         pDrawVirtObj->RemoveFromDrawingPage();
                         pPg->AppendDrawObj( *(pContact->GetAnchoredObj( 
pDrawVirtObj )) );
                     }
-                }
-                else
-                {
-                    if ( pContact->GetAnchorFrame() )
-                        pContact->DisconnectFromLayout( false );
-                    pPg->AppendDrawObj( *(pContact->GetAnchoredObj( pSdrObj )) 
);
+                    else
+                    {
+                        if ( pContact->GetAnchorFrame() )
+                            pContact->DisconnectFromLayout( false );
+                        pPg->AppendDrawObj( *(pContact->GetAnchoredObj( 
pSdrObj )) );
+                    }
                 }
             }
             else
diff --git a/sw/source/core/layout/trvlfrm.cxx 
b/sw/source/core/layout/trvlfrm.cxx
index 89a5f03302ac..0e3d13570678 100644
--- a/sw/source/core/layout/trvlfrm.cxx
+++ b/sw/source/core/layout/trvlfrm.cxx
@@ -70,26 +70,29 @@ namespace {
         {
             const SwVirtFlyDrawObj* pObj =
                                 static_cast<const SwVirtFlyDrawObj*>(aIter());
-            const SwAnchoredObject* pAnchoredObj = GetUserCall( aIter() 
)->GetAnchoredObj( aIter() );
-            const SwFrameFormat* pObjFormat = pAnchoredObj->GetFrameFormat();
-            const SwFormatSurround& rSurround = pObjFormat->GetSurround();
-            const SvxOpaqueItem& rOpaque = pObjFormat->GetOpaque();
-            bool bInBackground = ( rSurround.GetSurround() == 
css::text::WrapTextMode_THROUGH ) && !rOpaque.GetValue();
-
-            bool bBackgroundMatches = bInBackground == bSearchBackground;
-
-            const SwFlyFrame* pFly = pObj ? pObj->GetFlyFrame() : nullptr;
-            if ( pFly && bBackgroundMatches &&
-                 ( ( pCMS && pCMS->m_bSetInReadOnly ) ||
-                   !pFly->IsProtected() ) &&
-                 pFly->GetModelPositionForViewPoint( pPos, aPoint, pCMS ) )
+            if (const SwContact* pContact = ::GetUserCall( aIter() ))
             {
-                bRet = true;
-                break;
-            }
+                const SwAnchoredObject* pAnchoredObj = 
pContact->GetAnchoredObj( aIter() );
+                const SwFrameFormat* pObjFormat = 
pAnchoredObj->GetFrameFormat();
+                const SwFormatSurround& rSurround = pObjFormat->GetSurround();
+                const SvxOpaqueItem& rOpaque = pObjFormat->GetOpaque();
+                bool bInBackground = ( rSurround.GetSurround() == 
css::text::WrapTextMode_THROUGH ) && !rOpaque.GetValue();
+
+                bool bBackgroundMatches = bInBackground == bSearchBackground;
+
+                const SwFlyFrame* pFly = pObj ? pObj->GetFlyFrame() : nullptr;
+                if ( pFly && bBackgroundMatches &&
+                     ( ( pCMS && pCMS->m_bSetInReadOnly ) ||
+                       !pFly->IsProtected() ) &&
+                     pFly->GetModelPositionForViewPoint( pPos, aPoint, pCMS ) )
+                {
+                    bRet = true;
+                    break;
+                }
 
-            if ( pCMS && pCMS->m_bStop )
-                return false;
+                if ( pCMS && pCMS->m_bStop )
+                    return false;
+            }
             aIter.Prev();
         }
         return bRet;
diff --git a/sw/source/core/txtnode/atrflyin.cxx 
b/sw/source/core/txtnode/atrflyin.cxx
index 28eb7b38e530..fbefb76fa851 100644
--- a/sw/source/core/txtnode/atrflyin.cxx
+++ b/sw/source/core/txtnode/atrflyin.cxx
@@ -197,7 +197,8 @@ void SwTextFlyCnt::SetAnchor( const SwTextNode *pNode )
         {
             if (SdrObject const*const pObj = pFormat->FindSdrObject())
             {   // tdf#123259 disconnect with *old* anchor position
-                
static_cast<SwDrawContact*>(::GetUserCall(pObj))->DisconnectFromLayout(false);
+                if (SwDrawContact* pContact = 
static_cast<SwDrawContact*>(::GetUserCall( pObj )))
+                    pContact->DisconnectFromLayout(false);
             }
         }
         pFormat->SetFormatAttr( aAnchor );  // only set the anchor
diff --git a/sw/source/core/undo/undraw.cxx b/sw/source/core/undo/undraw.cxx
index 134c6862971e..73a58a0f52e5 100644
--- a/sw/source/core/undo/undraw.cxx
+++ b/sw/source/core/undo/undraw.cxx
@@ -274,6 +274,8 @@ void SwUndoDrawGroup::RedoImpl(::sw::UndoRedoContext &)
         SdrObject* pObj = rSave.pObj;
 
         SwDrawContact *pContact = 
static_cast<SwDrawContact*>(GetUserCall(pObj));
+        if (!pContact)
+            continue;
 
         // Save the textboxes
         if (auto pOldTextBoxNode = rSave.pFormat->GetOtherTextBoxFormats())
@@ -350,23 +352,25 @@ SwUndoDrawUnGroup::SwUndoDrawUnGroup( SdrObjGroup* pObj, 
const SwDoc& rDoc )
     m_nSize = o3tl::narrowing<sal_uInt16>(pObj->GetSubList()->GetObjCount()) + 
1;
     m_pObjArray.reset( new SwUndoGroupObjImpl[ m_nSize ] );
 
-    SwDrawContact *pContact = static_cast<SwDrawContact*>(GetUserCall(pObj));
-    SwDrawFrameFormat* pFormat = 
static_cast<SwDrawFrameFormat*>(pContact->GetFormat());
+    if (SwDrawContact *pContact = 
static_cast<SwDrawContact*>(GetUserCall(pObj)))
+    {
+        SwDrawFrameFormat* pFormat = 
static_cast<SwDrawFrameFormat*>(pContact->GetFormat());
 
-    m_pObjArray[0].pObj = pObj;
-    m_pObjArray[0].pFormat = pFormat;
+        m_pObjArray[0].pObj = pObj;
+        m_pObjArray[0].pFormat = pFormat;
 
-    // object will destroy itself
-    pContact->Changed( *pObj, SdrUserCallType::Delete, 
pObj->GetLastBoundRect() );
-    pObj->SetUserCall( nullptr );
+        // object will destroy itself
+        pContact->Changed( *pObj, SdrUserCallType::Delete, 
pObj->GetLastBoundRect() );
+        pObj->SetUserCall( nullptr );
 
-    ::lcl_SaveAnchor( pFormat, m_pObjArray[0].nNodeIdx );
+        ::lcl_SaveAnchor( pFormat, m_pObjArray[0].nNodeIdx );
 
-    pFormat->RemoveAllUnos();
+        pFormat->RemoveAllUnos();
 
-    // remove from array
-    sw::SpzFrameFormats& rFlyFormats = 
*pFormat->GetDoc()->GetSpzFrameFormats();
-    rFlyFormats.erase( std::find( rFlyFormats.begin(), rFlyFormats.end(), 
pFormat ));
+        // remove from array
+        sw::SpzFrameFormats& rFlyFormats = 
*pFormat->GetDoc()->GetSpzFrameFormats();
+        rFlyFormats.erase( std::find( rFlyFormats.begin(), rFlyFormats.end(), 
pFormat ));
+    }
 }
 
 SwUndoDrawUnGroup::~SwUndoDrawUnGroup()
@@ -622,6 +626,9 @@ void SwUndoDrawDelete::RedoImpl(::sw::UndoRedoContext & 
rContext)
         SwUndoGroupObjImpl& rSave = m_pObjArray[n];
         SdrObject *pObj = rSave.pObj;
         SwDrawContact *pContact = 
static_cast<SwDrawContact*>(GetUserCall(pObj));
+        if (!pContact)
+            continue;
+
         SwDrawFrameFormat *pFormat = 
static_cast<SwDrawFrameFormat*>(pContact->GetFormat());
 
         // object will destroy itself
commit 528f74855bf2d7c772106900f66414d7116bb640
Author:     Patrick Luby <guibmac...@gmail.com>
AuthorDate: Fri Apr 26 20:25:03 2024 -0400
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Fri May 17 19:57:45 2024 +0200

    tdf#153306 prevent subpixel shifting of X coordinate
    
    HACK: for some unknown reason, if the X coordinate of the
    path's bounds is more than 1024, SkBlendMode::kExclusion will
    shift by about a half a pixel to the right with Skia/Metal on
    a Retina display. Weirdly, if the same polygon is repeatedly
    drawn, the total shift is cumulative so if the drawn polygon
    is more than a few pixels wide, the blinking cursor in Writer
    will exhibit this bug but only for one thin vertical slice at
    a time. Apparently, shifting drawing a very tiny amount to
    the left seems to be enough to quell this runaway cumulative
    X coordinate shift.
    
    Change-Id: Ic1ac8a390df51c4aa1cc3183590dce72059af6b6
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/166766
    Reviewed-by: Patrick Luby <guibomac...@gmail.com>
    Tested-by: Jenkins
    (cherry picked from commit 05d3a99aa687ee4e1706f9403651379b7ebdad89)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/166722
    Reviewed-by: Christian Lohmaier <lohmaier+libreoff...@googlemail.com>

diff --git a/vcl/skia/gdiimpl.cxx b/vcl/skia/gdiimpl.cxx
index f4ad57f715b0..5a04a08b6438 100644
--- a/vcl/skia/gdiimpl.cxx
+++ b/vcl/skia/gdiimpl.cxx
@@ -1490,6 +1490,26 @@ void SkiaSalGraphicsImpl::invert(basegfx::B2DPolygon 
const& rPoly, SalInvert eFl
             aPaint.setShader(
                 aBitmap.makeShader(SkTileMode::kRepeat, SkTileMode::kRepeat, 
SkSamplingOptions()));
         }
+
+#ifdef SK_METAL
+        // tdf#153306 prevent subpixel shifting of X coordinate
+        // HACK: for some unknown reason, if the X coordinate of the
+        // path's bounds is more than 1024, SkBlendMode::kExclusion will
+        // shift by about a half a pixel to the right with Skia/Metal on
+        // a Retina display. Weirdly, if the same polygon is repeatedly
+        // drawn, the total shift is cumulative so if the drawn polygon
+        // is more than a few pixels wide, the blinking cursor in Writer
+        // will exhibit this bug but only for one thin vertical slice at
+        // a time. Apparently, shifting drawing a very tiny amount to
+        // the left seems to be enough to quell this runaway cumulative
+        // X coordinate shift.
+        if (isGPU())
+        {
+            SkMatrix aMatrix;
+            aMatrix.set(SkMatrix::kMTransX, -0.001);
+            getDrawCanvas()->concat(aMatrix);
+        }
+#endif
     }
     getDrawCanvas()->drawPath(aPath, aPaint);
     postDraw();
commit 8b6112e3455987413672f86dabf167767f477dfa
Author:     Armin Le Grand (allotropia) <armin.le.grand.ext...@allotropia.de>
AuthorDate: Tue May 7 13:59:18 2024 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Fri May 17 19:57:44 2024 +0200

    tdf#160906 use SfxPoolItemHolder
    
    to avoid handling already deleted SfxPoolItems.
    
    Change-Id: I1f1f8f93cae8db7f7c8df66c2c7f3c02b59a39c3
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167274
    Reviewed-by: Armin Le Grand <armin.le.gr...@me.com>
    Tested-by: Jenkins
    Signed-off-by: Xisco Fauli <xiscofa...@libreoffice.org>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167376
    Reviewed-by: Adolfo Jayme Barrientos <fit...@ubuntu.com>

diff --git a/forms/source/richtext/parametrizedattributedispatcher.cxx 
b/forms/source/richtext/parametrizedattributedispatcher.cxx
index d6666e2b0262..bc226decd83e 100644
--- a/forms/source/richtext/parametrizedattributedispatcher.cxx
+++ b/forms/source/richtext/parametrizedattributedispatcher.cxx
@@ -89,7 +89,7 @@ namespace frm
     }
 
 
-    const SfxPoolItem* 
OParametrizedAttributeDispatcher::convertDispatchArgsToItem( const Sequence< 
PropertyValue >& _rArguments )
+    SfxPoolItemHolder 
OParametrizedAttributeDispatcher::convertDispatchArgsToItem( const Sequence< 
PropertyValue >& _rArguments )
     {
         // get the real slot id. This may differ from our attribute id: for 
instance, both
         // SID_ATTR_CHAR_HEIGHT and SID_ATTR_CHAR_LATIN_HEIGHT are mapped to 
the same which id
@@ -98,16 +98,16 @@ namespace frm
         SfxAllItemSet aParameterSet( getEditView()->GetEmptyItemSet() );
         TransformParameters( nSlotId, _rArguments, aParameterSet );
 
-        const SfxPoolItem* pArgument = nullptr;
         if ( aParameterSet.Count() )
         {
             OSL_ENSURE( aParameterSet.Count() == 1, 
"OParametrizedAttributeDispatcher::convertDispatchArgsToItem: Arguments which 
form more than 1 item? How this?" );
             WhichId nAttributeWhich = aParameterSet.GetPool()->GetWhich( 
nSlotId );
-            pArgument = aParameterSet.GetItem( nAttributeWhich );
-            OSL_ENSURE( pArgument, 
"OParametrizedAttributeDispatcher::convertDispatchArgsToItem: suspicious: there 
were arguments, but they're not for my slot!" );
+            SfxPoolItemHolder aArgument(*aParameterSet.GetPool(), 
aParameterSet.GetItem(nAttributeWhich));
+            OSL_ENSURE( aArgument.getItem(), 
"OParametrizedAttributeDispatcher::convertDispatchArgsToItem: suspicious: there 
were arguments, but they're not for my slot!" );
+            return aArgument;
         }
 
-        return pArgument;
+        return SfxPoolItemHolder();
     }
 
 
@@ -117,8 +117,8 @@ namespace frm
         OSL_ENSURE( _rURL.Complete == getFeatureURL().Complete, 
"OParametrizedAttributeDispatcher::dispatch: invalid URL!" );
         if ( m_pMasterDispatcher )
         {
-            const SfxPoolItem* pConvertedArgument = convertDispatchArgsToItem( 
_rArguments );
-            m_pMasterDispatcher->executeAttribute( m_nAttributeId, 
pConvertedArgument );
+            const SfxPoolItemHolder 
aConvertedArgument(convertDispatchArgsToItem(_rArguments));
+            m_pMasterDispatcher->executeAttribute(m_nAttributeId, 
aConvertedArgument.getItem());
         }
     }
 
diff --git a/forms/source/richtext/parametrizedattributedispatcher.hxx 
b/forms/source/richtext/parametrizedattributedispatcher.hxx
index 69844731612e..8a68486c131b 100644
--- a/forms/source/richtext/parametrizedattributedispatcher.hxx
+++ b/forms/source/richtext/parametrizedattributedispatcher.hxx
@@ -21,7 +21,7 @@
 
 #include "attributedispatcher.hxx"
 
-class SfxPoolItem;
+class SfxPoolItemHolder;
 
 namespace frm
 {
@@ -47,10 +47,10 @@ namespace frm
 
     protected:
         // own overridables
-        /** convert the arguments as got in a XDispatch::dispatch call into an 
SfxPoolItem, which can
+        /** convert the arguments as got in a XDispatch::dispatch call into an 
SfxPoolItemHolder, which can
             be used with a IMultiAttributeDispatcher::executeAttribute
         */
-        virtual const SfxPoolItem* convertDispatchArgsToItem(
+        virtual SfxPoolItemHolder convertDispatchArgsToItem(
             const css::uno::Sequence< css::beans::PropertyValue >& _rArguments 
);
     };
 
diff --git a/forms/source/richtext/specialdispatchers.cxx 
b/forms/source/richtext/specialdispatchers.cxx
index d75e06590fc2..ab01cd9eb608 100644
--- a/forms/source/richtext/specialdispatchers.cxx
+++ b/forms/source/richtext/specialdispatchers.cxx
@@ -23,6 +23,7 @@
 #include <editeng/editview.hxx>
 #include <editeng/scriptspaceitem.hxx>
 #include <osl/diagnose.h>
+#include <svl/itemset.hxx>
 
 
 namespace frm
@@ -140,7 +141,7 @@ namespace frm
     }
 
 
-    const SfxPoolItem* OAsianFontLayoutDispatcher::convertDispatchArgsToItem( 
const Sequence< PropertyValue >& _rArguments )
+    SfxPoolItemHolder OAsianFontLayoutDispatcher::convertDispatchArgsToItem( 
const Sequence< PropertyValue >& _rArguments )
     {
         // look for the "Enable" parameter
         const PropertyValue* pLookup = _rArguments.getConstArray();
@@ -155,13 +156,18 @@ namespace frm
         {
             bool bEnable = true;
             OSL_VERIFY( pLookup->Value >>= bEnable );
+
             if ( m_nAttributeId == sal_uInt16(SID_ATTR_PARA_SCRIPTSPACE) )
-                return new SvxScriptSpaceItem( bEnable, 
static_cast<WhichId>(m_nAttributeId) );
-            return new SfxBoolItem( static_cast<WhichId>(m_nAttributeId), 
bEnable );
+                return SfxPoolItemHolder(
+                    *getEditView()->GetEmptyItemSet().GetPool(),
+                    new SvxScriptSpaceItem(bEnable, 
static_cast<WhichId>(m_nAttributeId)));
+            return SfxPoolItemHolder(
+                *getEditView()->GetEmptyItemSet().GetPool(),
+                new SfxBoolItem(static_cast<WhichId>(m_nAttributeId), 
bEnable));
         }
 
         OSL_FAIL( "OAsianFontLayoutDispatcher::convertDispatchArgsToItem: did 
not find the one and only argument!" );
-        return nullptr;
+        return SfxPoolItemHolder();
     }
 
 
diff --git a/forms/source/richtext/specialdispatchers.hxx 
b/forms/source/richtext/specialdispatchers.hxx
index 9b4bfa1b7939..cca2b75ccac6 100644
--- a/forms/source/richtext/specialdispatchers.hxx
+++ b/forms/source/richtext/specialdispatchers.hxx
@@ -80,7 +80,7 @@ namespace frm
 
     protected:
         // OParametrizedAttributeDispatcher
-        virtual const SfxPoolItem* convertDispatchArgsToItem(
+        virtual SfxPoolItemHolder convertDispatchArgsToItem(
             const css::uno::Sequence< css::beans::PropertyValue >& _rArguments 
) override;
     };
 
commit 1eac6c0c024e477e24c4c60da772090f148e2ad6
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Wed May 15 08:55:06 2024 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Fri May 17 19:57:44 2024 +0200

    tdf#161073 handle is supposed to be freed automatically on failure
    
    and is since:
    
https://gitlab.gnome.org/GNOME/glib/-/commit/747e3af9987b37847d7d5acbf882d1ee4a6bd91b
    
    Change-Id: Ibb648ccf69ff892fc1e2a3c3dc4da1fffd577c92
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167468
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    Tested-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>

diff --git a/vcl/unx/gtk3/hudawareness.cxx b/vcl/unx/gtk3/hudawareness.cxx
index ebcbaf747fca..749e3d5c0d0a 100644
--- a/vcl/unx/gtk3/hudawareness.cxx
+++ b/vcl/unx/gtk3/hudawareness.cxx
@@ -88,7 +88,7 @@ hud_awareness_register (GDBusConnection       *connection,
 
   if (object_id == 0)
   {
-      g_free (handle);
+      // note: tdf#161073 handle is expected to be freed by 
g_dbus_connection_register_object on failure
       return 0;
   }
 
commit 14e89d9f3fb2dfc46cc40595391c55f708fdac52
Author:     Eike Rathke <er...@redhat.com>
AuthorDate: Tue May 14 22:59:28 2024 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Fri May 17 19:57:44 2024 +0200

    Resolves: tdf#160985 Max integer representation for rtl_math_StringFormat_G
    
    Same as for rtl_math_StringFormat_Automatic we want to preserve
    the highest accuracy of integer values also with
    rtl_math_StringFormat_G if nDecPlaces is large enough, instead of
    possibly rounding into 15 digits. This occurred with
    FastSaxSerializer::write(double) but rtl::OString::number(double)
    and rtl::OUString::number(double) and rtl_math_doubleToString()
    and rtl::str::valueOfFP() and rtl_str_valueOfDouble() and all
    places calling with rtl_math_StringFormat_G are similar affected.
    
    Question might remain why those places use
    rtl_math_StringFormat_G with fixed nDecimalPlaces calculated from
    RTL_STR_MAX_VALUEOFDOUBLE - SAL_N_ELEMENTS("-x.E-xxx") + 1
    instead of rtl_math_StringFormat_Automatic with
    rtl_math_DecimalPlaces_Max.
    
    Change-Id: Ib388b119faed441c9020dca803649a4089da5b07
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167647
    Tested-by: Jenkins
    Reviewed-by: Eike Rathke <er...@redhat.com>
    (cherry picked from commit 1ea85e8f2d815e6c0834215714ed3dad1101b971)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167673
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/sal/rtl/strtmpl.hxx b/sal/rtl/strtmpl.hxx
index 6414115d4174..8c63f1081f9c 100644
--- a/sal/rtl/strtmpl.hxx
+++ b/sal/rtl/strtmpl.hxx
@@ -1527,6 +1527,11 @@ void doubleToString(rtl_tString** pResult, sal_Int32* 
pResultCapacity, sal_Int32
             }
             else
             {
+                if (nOrigDigits <= nDecPlaces && aParts.exponent >= 0 && 
fValue < 0x1p53)
+                {
+                    // Use integer representation with highest accuracy.
+                    nRoundDigits = nOrigDigits; // no rounding
+                }
                 nDecPlaces = std::max<sal_Int32>(0, nDecPlaces - nExp - 1);
                 eFormat = rtl_math_StringFormat_F;
             }
commit 91ef48ca9d30bf134719a28bfc4a6b23ec9e27d9
Author:     Patrick Luby <guibmac...@gmail.com>
AuthorDate: Sun May 12 14:04:30 2024 -0400
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Fri May 17 19:57:44 2024 +0200

    tdf#160690 set an opaque alpha mask for non-transparent frames
    
    Due to the switch from transparency to alpha in commit
    81994cb2b8b32453a92bcb011830fcb884f22ff3, an empty alpha mask
    is treated as a completely transparent bitmap. So revert all
    of the previous commits for tdf#157576, tdf#157635, and tdf#157793
    and create a completely opaque bitmap instead.
    
    Note: this fix also fixes tdf#157576, tdf#157635, and tdf#157793.
    
    Change-Id: Ic2ccad6ab94e4d43b1b66013f85955d474dc0151
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167563
    Reviewed-by: Patrick Luby <guibomac...@gmail.com>
    Tested-by: Jenkins
    (cherry picked from commit 2a9eb581f0edfae8123018006df5cc9de1e1fd45)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167674
    Reviewed-by: Noel Grandin <noel.gran...@collabora.co.uk>

diff --git a/sd/qa/unit/PNGExportTests.cxx b/sd/qa/unit/PNGExportTests.cxx
index 855c3becfd47..69343b8b208d 100644
--- a/sd/qa/unit/PNGExportTests.cxx
+++ b/sd/qa/unit/PNGExportTests.cxx
@@ -483,21 +483,21 @@ CPPUNIT_TEST_FIXTURE(SdPNGExportTest, testTdf157793)
     CPPUNIT_ASSERT_EQUAL(Size(100, 100), aSize);
     Bitmap aBMP = aBMPEx.GetBitmap();
     BitmapScopedReadAccess pReadAccess(aBMP);
-    int nLightGrayCount = 0;
+    int nWhiteCount = 0;
     for (tools::Long nX = 1; nX < aSize.Width() - 1; ++nX)
     {
         for (tools::Long nY = 1; nY < aSize.Height() - 1; ++nY)
         {
             const Color aColor = pReadAccess->GetColor(nY, nX);
-            if (aColor == 0xfefefe)
-                ++nLightGrayCount;
+            if (aColor == 0xffffff)
+                ++nWhiteCount;
         }
     }
 
     // Without the fix in place, this test would have failed with
     // - Expected greater than: 7800
     // - Actual  : 0
-    CPPUNIT_ASSERT_GREATER(7800, nLightGrayCount);
+    CPPUNIT_ASSERT_GREATER(7800, nWhiteCount);
 }
 
 CPPUNIT_TEST_FIXTURE(SdPNGExportTest, testTdf157635)
diff --git a/vcl/source/filter/igif/gifread.cxx 
b/vcl/source/filter/igif/gifread.cxx
index 8f56edaee77f..95b70568d9c7 100644
--- a/vcl/source/filter/igif/gifread.cxx
+++ b/vcl/source/filter/igif/gifread.cxx
@@ -99,7 +99,7 @@ class GIFReader : public GraphicReader
     sal_uInt8           nGCDisposalMethod;      // 'Disposal Method' (see GIF 
docs)
     sal_uInt8           cTransIndex1;
     sal_uInt8           cNonTransIndex1;
-    bool                bEnhance;
+    sal_uLong           nPaletteSize;
 
     void                ReadPaletteEntries( BitmapPalette* pPal, sal_uLong 
nCount );
     void                ClearImageExtensions();
@@ -157,7 +157,7 @@ GIFReader::GIFReader( SvStream& rStm )
     , nGCTransparentIndex ( 0 )
     , cTransIndex1 ( 0 )
     , cNonTransIndex1 ( 0 )
-    , bEnhance( false )
+    , nPaletteSize( 0 )
 {
     maUpperName = "SVIGIF";
     aSrcBuf.resize(256);    // Memory buffer for ReadNextBlock
@@ -328,12 +328,7 @@ void GIFReader::ReadPaletteEntries( BitmapPalette* pPal, 
sal_uLong nCount )
             (*pPal)[ 254UL ] = COL_BLACK;
     }
 
-    // tdf#157793 limit tdf#157635 fix to only larger palettes
-    // I don't know why, but the fix for tdf#157635 causes
-    // images with a palette of 16 entries to be inverted.
-    // Also, fix tdf#158047 by allowing the tdf#157635 fix for
-    // palettes with 64 entries.
-    bEnhance = (nCount > 16);
+    nPaletteSize = nCount;
 }
 
 bool GIFReader::ReadExtension()
@@ -674,16 +669,25 @@ void GIFReader::CreateNewBitmaps()
         aAlphaMask.Invert(); // convert from transparency to alpha
         aAnimationFrame.maBitmapEx = BitmapEx( aBmp8, aAlphaMask );
     }
-    else
+    else if( nPaletteSize > 2 )
     {
-        // tdf#157576 and tdf#157635 mask out black pixels
+        // tdf#160690 set an opaque alpha mask for non-transparent frames
         // Due to the switch from transparency to alpha in commit
-        // 81994cb2b8b32453a92bcb011830fcb884f22ff3, mask out black
-        // pixels in bitmap.
-        if (bEnhance)
-            aAnimationFrame.maBitmapEx = BitmapEx( aBmp8, aBmp8 );
-        else
-            aAnimationFrame.maBitmapEx = BitmapEx( aBmp8 );
+        // 81994cb2b8b32453a92bcb011830fcb884f22ff3, an empty alpha mask
+        // is treated as a completely transparent bitmap. So revert all
+        // of the previous commits for tdf#157576, tdf#157635, and tdf#157793
+        // and create a completely opaque bitmap instead.
+        // Note: this fix also fixes tdf#157576, tdf#157635, and tdf#157793.
+        AlphaMask aAlphaMask(aBmp8.GetSizePixel());
+        aAnimationFrame.maBitmapEx = BitmapEx( aBmp8, aAlphaMask );
+    }
+    else
+    {
+        // Don't apply the fix for tdf#160690 as it will cause 1 bit bitmaps
+        // in Word documents like the following test document to fail to be
+        // parsed correctly:
+        // sw/qa/extras/tiledrendering/data/tdf159626_yellowPatternFill.docx
+        aAnimationFrame.maBitmapEx = BitmapEx( aBmp8 );
     }
 
     aAnimationFrame.maPositionPixel = Point( nImagePosX, nImagePosY );
commit 1aa90b5a2d10e77e88782de85facf447b6e09697
Author:     László Németh <nem...@numbertext.org>
AuthorDate: Mon Apr 29 21:39:41 2024 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Fri May 17 19:57:44 2024 +0200

    tdf#160836 sw: fix narrow selection area of cell border
    
    Remove ShouldObjectBeSelected() condition to fix the
    selection area around the horizontal border. (Its purpose
    was to avoid of selection of the border, when covered by
    an image: but that would be !ShouldObjectBeSelected(), with
    the same problem: halved selection area.)
    
    Clean-up commit commit 30de13743f144aced83bc43d310592f82788c910
    "tdf#160836 sw: resize rows at images cropped by row height".
    
    Change-Id: I6c812a150b67431c7ea3131f29489bda919c1724
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/166877
    Tested-by: Jenkins
    Reviewed-by: László Németh <nem...@numbertext.org>
    (cherry picked from commit 38b6e89c9483fdfe3d26bef3b25f890528aef84e)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167211
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>

diff --git a/sw/source/uibase/docvw/edtwin.cxx 
b/sw/source/uibase/docvw/edtwin.cxx
index 01ca2a6faf6b..178e4d631806 100644
--- a/sw/source/uibase/docvw/edtwin.cxx
+++ b/sw/source/uibase/docvw/edtwin.cxx
@@ -3117,8 +3117,7 @@ void SwEditWin::MouseButtonDown(const MouseEvent& _rMEvt)
          SwTab::COL_NONE != (nMouseTabCol = rSh.WhichMouseTabCol( aDocPos ) ) 
&&
          ( !rSh.IsObjSelectable( aDocPos ) ||
              // allow resizing row height, if the image is anchored as 
character in the cell
-             ( rSh.ShouldObjectBeSelected(aDocPos) &&
-                 !( SwTab::COL_VERT == nMouseTabCol || SwTab::COL_HORI == 
nMouseTabCol ) ) ) )
+             !( SwTab::COL_VERT == nMouseTabCol || SwTab::COL_HORI == 
nMouseTabCol ) ) )
     {
         // Enhanced table selection
         if ( SwTab::SEL_HORI <= nMouseTabCol && SwTab::COLSEL_VERT >= 
nMouseTabCol )
@@ -3991,8 +3990,7 @@ bool SwEditWin::changeMousePointer(Point const & 
rDocPoint)
     if ( SwTab::COL_NONE != (nMouseTabCol = rShell.WhichMouseTabCol( rDocPoint 
) ) &&
          ( !rShell.IsObjSelectable( rDocPoint ) ||
              // allow resizing row height, if the image is anchored as 
character in the cell
-             ( rShell.ShouldObjectBeSelected(rDocPoint) &&
-                 !( SwTab::COL_VERT == nMouseTabCol || SwTab::COL_HORI == 
nMouseTabCol ) ) ) )
+             !( SwTab::COL_VERT == nMouseTabCol || SwTab::COL_HORI == 
nMouseTabCol ) ) )
     {
         PointerStyle nPointer = PointerStyle::Null;
         bool bChkTableSel = false;
commit 9a81bdda903a54a725d9fef2cede82f157cab5b9
Author:     László Németh <nem...@numbertext.org>
AuthorDate: Fri Apr 26 22:03:53 2024 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Fri May 17 19:57:43 2024 +0200

    tdf#160836 sw: resize rows at images cropped by row height
    
    Fixed row height can crop cell content, including images
    anchored as character. Resizing the row height with mouse
    was not possible there, because selection of the cropped
    image avoided to drag & drop the horizontal cell border.
    
    Change-Id: I6dde79e77563468059794548b6c058cad61586a0
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/166795
    Reviewed-by: László Németh <nem...@numbertext.org>
    Tested-by: Jenkins
    (cherry picked from commit 30de13743f144aced83bc43d310592f82788c910)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167210
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>

diff --git a/sw/qa/extras/uiwriter/uiwriter6.cxx 
b/sw/qa/extras/uiwriter/uiwriter6.cxx
index db0c8f6929c7..8e67d26e4652 100644
--- a/sw/qa/extras/uiwriter/uiwriter6.cxx
+++ b/sw/qa/extras/uiwriter/uiwriter6.cxx
@@ -1513,6 +1513,56 @@ CPPUNIT_TEST_FIXTURE(SwUiWriterTest6, testTdf160842)
     CPPUNIT_ASSERT(pWrtShell->IsCursorInTable());
 }
 
+CPPUNIT_TEST_FIXTURE(SwUiWriterTest6, testTdf160836)
+{
+    createSwDoc("tdf160842.fodt");
+    SwDoc* pDoc = getSwDoc();
+    CPPUNIT_ASSERT(pDoc);
+    SwWrtShell* pWrtShell = pDoc->GetDocShell()->GetWrtShell();
+    CPPUNIT_ASSERT(pWrtShell);
+
+    // set table row height by drag & drop at images cropped by the fixed row 
height
+    SwRootFrame* pLayout = pDoc->getIDocumentLayoutAccess().GetCurrentLayout();
+    auto pPage = dynamic_cast<SwPageFrame*>(pLayout->Lower());
+    CPPUNIT_ASSERT(pPage);
+    const SwSortedObjs& rPageObjs = *pPage->GetSortedObjs();
+    CPPUNIT_ASSERT_EQUAL(static_cast<size_t>(1), rPageObjs.size());
+    auto pPageFly = dynamic_cast<SwFlyAtContentFrame*>(rPageObjs[0]);
+    CPPUNIT_ASSERT(pPageFly);
+    auto pTable = dynamic_cast<SwTabFrame*>(pPageFly->GetLower());
+    CPPUNIT_ASSERT(pTable);
+    auto pRow1 = pTable->GetLower();
+    CPPUNIT_ASSERT(pRow1->IsRowFrame());
+    auto pCellA1 = pRow1->GetLower();
+    CPPUNIT_ASSERT(pCellA1);
+    const SwRect& rCellA1Rect = pCellA1->getFrameArea();
+    auto nRowHeight = rCellA1Rect.Height();
+    // select center of the bottom border of the first table cell
+    Point ptFrom(rCellA1Rect.Left() + rCellA1Rect.Width() / 2, 
rCellA1Rect.Top() + nRowHeight);
+    // halve the row height
+    Point ptTo(rCellA1Rect.Left() + rCellA1Rect.Width() / 2, rCellA1Rect.Top() 
+ 0.5 * nRowHeight);
+    vcl::Window& rEditWin = pDoc->GetDocShell()->GetView()->GetEditWin();
+    Point aFrom = rEditWin.LogicToPixel(ptFrom);
+    MouseEvent aClickEvent(aFrom, 1, MouseEventModifiers::SIMPLECLICK | 
MouseEventModifiers::SELECT,
+                           MOUSE_LEFT);
+    rEditWin.MouseButtonDown(aClickEvent);
+    Point aTo = rEditWin.LogicToPixel(ptTo);
+    MouseEvent aMoveEvent(aTo, 1, MouseEventModifiers::SIMPLECLICK | 
MouseEventModifiers::SELECT,
+                          MOUSE_LEFT);
+    TrackingEvent aTEvt(aMoveEvent, TrackingEventFlags::Repeat);
+    // drag & drop of cell border inside the document (and outside the table)
+    // still based on the ruler code, use that to simulate dragging
+    pDoc->GetDocShell()->GetView()->GetVRuler().Tracking(aTEvt);
+    TrackingEvent aTEvt2(aMoveEvent, TrackingEventFlags::End);
+    pDoc->GetDocShell()->GetView()->GetVRuler().Tracking(aTEvt2);
+    Scheduler::ProcessEventsToIdle();
+    rEditWin.CaptureMouse();
+    rEditWin.ReleaseMouse();
+
+    // this was 3910 (not modified row height previously)
+    CPPUNIT_ASSERT_EQUAL(tools::Long(1980), pCellA1->getFrameArea().Height());
+}
+
 CPPUNIT_TEST_FIXTURE(SwUiWriterTest6, testTdf115132)
 {
     createSwDoc();
diff --git a/sw/source/uibase/docvw/edtwin.cxx 
b/sw/source/uibase/docvw/edtwin.cxx
index 24358cf5505a..01ca2a6faf6b 100644
--- a/sw/source/uibase/docvw/edtwin.cxx
+++ b/sw/source/uibase/docvw/edtwin.cxx
@@ -3112,9 +3112,13 @@ void SwEditWin::MouseButtonDown(const MouseEvent& _rMEvt)
     SwTab nMouseTabCol = SwTab::COL_NONE;
     const bool bTmp = !rSh.IsDrawCreate() && !m_pApplyTempl && 
!rSh.IsInSelect()
                       && aMEvt.GetClicks() == 1 && MOUSE_LEFT == 
aMEvt.GetButtons();
+
     if (  bTmp &&
          SwTab::COL_NONE != (nMouseTabCol = rSh.WhichMouseTabCol( aDocPos ) ) 
&&
-         !rSh.IsObjSelectable( aDocPos ) )
+         ( !rSh.IsObjSelectable( aDocPos ) ||
+             // allow resizing row height, if the image is anchored as 
character in the cell
+             ( rSh.ShouldObjectBeSelected(aDocPos) &&
+                 !( SwTab::COL_VERT == nMouseTabCol || SwTab::COL_HORI == 
nMouseTabCol ) ) ) )
     {
         // Enhanced table selection
         if ( SwTab::SEL_HORI <= nMouseTabCol && SwTab::COLSEL_VERT >= 
nMouseTabCol )
@@ -3983,8 +3987,12 @@ bool SwEditWin::changeMousePointer(Point const & 
rDocPoint)
     SwWrtShell & rShell = m_rView.GetWrtShell();
 
     SwTab nMouseTabCol;
+
     if ( SwTab::COL_NONE != (nMouseTabCol = rShell.WhichMouseTabCol( rDocPoint 
) ) &&
-         !rShell.IsObjSelectable( rDocPoint ) )
+         ( !rShell.IsObjSelectable( rDocPoint ) ||
+             // allow resizing row height, if the image is anchored as 
character in the cell
+             ( rShell.ShouldObjectBeSelected(rDocPoint) &&
+                 !( SwTab::COL_VERT == nMouseTabCol || SwTab::COL_HORI == 
nMouseTabCol ) ) ) )
     {
         PointerStyle nPointer = PointerStyle::Null;
         bool bChkTableSel = false;
commit 66da0b7dee41f0dcd630ac568ff54e6dc4c05992
Author:     Xisco Fauli <xiscofa...@libreoffice.org>
AuthorDate: Wed May 8 12:15:59 2024 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Fri May 17 19:57:43 2024 +0200

    Update language-subtag-registry to 2024-03-07
    
    How the file was created:
    mkdir data
    cd data
    wget
    
https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry
    cd ..
    tar -cvjSf language-subtag-registry-2024-03-07.tar.bz2 data
    
    Change-Id: If1bdeab0ee5853855949dcbbfb00170e897c80e1
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167341
    Tested-by: Jenkins
    Reviewed-by: Eike Rathke <er...@redhat.com>
    (cherry picked from commit 96698d3a72d8496358786ffedc7b6eb22af3648c)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167461
    Reviewed-by: Adolfo Jayme Barrientos <fit...@ubuntu.com>

diff --git a/download.lst b/download.lst
index 41d7b6db8ee9..99755cbc20d3 100644
--- a/download.lst
+++ b/download.lst
@@ -422,8 +422,8 @@ LIBJPEG_TURBO_TARBALL := libjpeg-turbo-2.1.5.1.tar.gz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LANGTAGREG_SHA256SUM := 
59fdc026b5088e7947e1e6add482d2a40e1f7e25c50f198b456954216462c2eb
-LANGTAGREG_TARBALL := language-subtag-registry-2023-08-02.tar.bz2
+LANGTAGREG_SHA256SUM := 
642c1c8e08aa79884f3d0fe15c0f5866e6fb6828af22c3c9c1fe3827f99e58cc
+LANGTAGREG_TARBALL := language-subtag-registry-2024-03-07.tar.bz2
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
commit 11614498c189beb8b32cb226a1dad0d33151fadf
Author:     Patrick Luby <guibmac...@gmail.com>
AuthorDate: Tue May 7 17:41:10 2024 -0400
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Fri May 17 19:57:43 2024 +0200

    tdf#160767 skip fix for tdf#155266 when the event hasn't changed
    
    When scrolling in Writer with automatic spellchecking enabled,
    the current event never changes because the fix for tdf#155266
    causes Writer to get stuck in a loop. So, if the current event
    has not changed since the last pass through this code, skip
    the fix for tdf#155266.
    
    Change-Id: I97265a7698756c5fb65b6686f6bb77c1caa08862
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167229
    Reviewed-by: Patrick Luby <guibomac...@gmail.com>
    Reviewed-by: Adolfo Jayme Barrientos <fit...@ubuntu.com>
    Tested-by: Jenkins

diff --git a/vcl/osx/salinst.cxx b/vcl/osx/salinst.cxx
index 7f755bb618b3..33101c8d1b11 100644
--- a/vcl/osx/salinst.cxx
+++ b/vcl/osx/salinst.cxx
@@ -750,7 +750,22 @@ bool AquaSalInstance::AnyInput( VclInputFlags nType )
         // not NSEventTypeScrollWheel.
         NSEvent* pCurrentEvent = [NSApp currentEvent];
         if( pCurrentEvent && [pCurrentEvent type] == NSEventTypeScrollWheel )
-            nEventMask &= ~NSEventMaskScrollWheel;
+        {
+            // tdf#160767 skip fix for tdf#155266 when the event hasn't changed
+            // When scrolling in Writer with automatic spellchecking enabled,
+            // the current event never changes because the fix for tdf#155266
+            // causes Writer to get stuck in a loop. So, if the current event
+            // has not changed since the last pass through this code, skip
+            // the fix for tdf#155266.
+            static NSEvent *pLastCurrentEvent = nil;
+            if( pLastCurrentEvent != pCurrentEvent )
+            {
+                if( pLastCurrentEvent )
+                    [pLastCurrentEvent release];
+                pLastCurrentEvent = [pCurrentEvent retain];
+                nEventMask &= ~NSEventMaskScrollWheel;
+            }
+        }
     }
 
     if( nType & VclInputFlags::KEYBOARD)
commit 6f33df3f243d6012730fccd644f3c386526a3363
Author:     Xisco Fauli <xiscofa...@libreoffice.org>
AuthorDate: Mon May 13 12:45:05 2024 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Fri May 17 19:57:43 2024 +0200

    libxml2: upgrade to 2.12.7
    
    * Fixes CVE-2024-34459
    
    Downloaded from 
https://download.gnome.org/sources/libxml2/2.12/libxml2-2.12.7.tar.xz
    
    Change-Id: Ie45ad54b3f781a54a278e2542fccafb8d06542bb
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167585
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>
    (cherry picked from commit 02dc762466c655e9ca6fb7cef92b1495915b34ed)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167460
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>

diff --git a/download.lst b/download.lst
index aa689cff4342..41d7b6db8ee9 100644
--- a/download.lst
+++ b/download.lst
@@ -487,8 +487,8 @@ XMLSEC_TARBALL := xmlsec1-1.3.2.tar.gz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBXML_SHA256SUM := 
889c593a881a3db5fdd96cc9318c87df34eb648edfc458272ad46fd607353fbb
-LIBXML_VERSION_MICRO := 6
+LIBXML_SHA256SUM := 
24ae78ff1363a973e6d8beba941a7945da2ac056e19b53956aeb6927fd6cfb56
+LIBXML_VERSION_MICRO := 7
 LIBXML_TARBALL := libxml2-2.12.$(LIBXML_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
commit aec722dcc6427f65cc78fcb1239fd2591783e81b
Author:     László Németh <nem...@numbertext.org>
AuthorDate: Sat Apr 27 00:26:54 2024 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Fri May 17 19:57:43 2024 +0200

    tdf#160842 sw: select cell content instead of cropped part of image
    
    It was not possible to select and edit the content of the bottom
    cell, if an image cropped by the fixed row height "covered" it,
    i.e. the image was in the previous row, anchored as character.
    
    Note: table cells with fixed row height are usable to crop images
    easily, with a single drag & drop, according to the requirement of
    the text layout, while the cell above or bottom of the cell with
    image is for the caption of the image. This is very useful to
    adjust a book layout with sections with multiple columns and
    illustrations.
    
    Change-Id: I8683b4066db6ce43549ec3aa69b0e639a59e3681
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/166794
    Tested-by: Jenkins
    Reviewed-by: László Németh <nem...@numbertext.org>
    (cherry picked from commit f3b899655018397e71300dbb32cdf4f82940a68b)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167089
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>

diff --git a/sw/qa/extras/uiwriter/data/tdf160842.fodt 
b/sw/qa/extras/uiwriter/data/tdf160842.fodt
new file mode 100644
index 000000000000..217b9c1a9570
--- /dev/null
+++ b/sw/qa/extras/uiwriter/data/tdf160842.fodt
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<office:document xmlns:css3t="http://www.w3.org/TR/css3-text/"; 
xmlns:grddl="http://www.w3.org/2003/g/data-view#"; 
xmlns:xhtml="http://www.w3.org/1999/xhtml"; 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; 
xmlns:xsd="http://www.w3.org/2001/XMLSchema"; 
xmlns:xforms="http://www.w3.org/2002/xforms"; 
xmlns:dom="http://www.w3.org/2001/xml-events"; 
xmlns:script="urn:oasis:names:tc:opendocument:xmlns:script:1.0" 
xmlns:form="urn:oasis:names:tc:opendocument:xmlns:form:1.0" 
xmlns:math="http://www.w3.org/1998/Math/MathML"; 
xmlns:office="urn:oasis:names:tc:opendocument:xmlns:office:1.0" 
xmlns:ooo="http://openoffice.org/2004/office"; 
xmlns:fo="urn:oasis:names:tc:opendocument:xmlns:xsl-fo-compatible:1.0" 
xmlns:config="urn:oasis:names:tc:opendocument:xmlns:config:1.0" 
xmlns:ooow="http://openoffice.org/2004/writer"; 
xmlns:xlink="http://www.w3.org/1999/xlink"; 
xmlns:drawooo="http://openoffice.org/2010/draw"; 
xmlns:oooc="http://openoffice.org/2004/calc"; 
xmlns:dc="http://purl.org/dc/elements/1.1/"; xmlns:c
 alcext="urn:org:documentfoundation:names:experimental:calc:xmlns:calcext:1.0" 
xmlns:style="urn:oasis:names:tc:opendocument:xmlns:style:1.0" 
xmlns:text="urn:oasis:names:tc:opendocument:xmlns:text:1.0" 
xmlns:of="urn:oasis:names:tc:opendocument:xmlns:of:1.2" 
xmlns:tableooo="http://openoffice.org/2009/table"; 
xmlns:draw="urn:oasis:names:tc:opendocument:xmlns:drawing:1.0" 
xmlns:dr3d="urn:oasis:names:tc:opendocument:xmlns:dr3d:1.0" 
xmlns:rpt="http://openoffice.org/2005/report"; 
xmlns:formx="urn:openoffice:names:experimental:ooxml-odf-interop:xmlns:form:1.0"
 xmlns:svg="urn:oasis:names:tc:opendocument:xmlns:svg-compatible:1.0" 
xmlns:chart="urn:oasis:names:tc:opendocument:xmlns:chart:1.0" 
xmlns:officeooo="http://openoffice.org/2009/office"; 
xmlns:table="urn:oasis:names:tc:opendocument:xmlns:table:1.0" 
xmlns:field="urn:openoffice:names:experimental:ooo-ms-interop:xmlns:field:1.0" 
xmlns:number="urn:oasis:names:tc:opendocument:xmlns:datastyle:1.0" 
xmlns:meta="urn:oasis:names:tc:opendocument:xmlns:
 meta:1.0" 
xmlns:loext="urn:org:documentfoundation:names:experimental:office:xmlns:loext:1.0"
 office:version="1.3" office:mimetype="application/vnd.oasis.opendocument.text">
+ <office:styles>
+  <style:default-style style:family="graphic">
+   <style:graphic-properties svg:stroke-color="#3465a4" 
draw:fill-color="#729fcf" fo:wrap-option="no-wrap" draw:shadow-offset-x="0.3cm" 
draw:shadow-offset-y="0.3cm" draw:start-line-spacing-horizontal="0.283cm" 
draw:start-line-spacing-vertical="0.283cm" 
draw:end-line-spacing-horizontal="0.283cm" 
draw:end-line-spacing-vertical="0.283cm" style:writing-mode="lr-tb" 
style:flow-with-text="false"/>
+   <style:paragraph-properties style:text-autospace="ideograph-alpha" 
style:line-break="strict" loext:tab-stop-distance="0cm" 
style:writing-mode="lr-tb" style:font-independent-line-spacing="false">
+    <style:tab-stops/>
+   </style:paragraph-properties>
+   <style:text-properties style:use-window-font-color="true" 
loext:opacity="0%" style:font-name="DejaVu Sans" fo:font-size="12pt" 
fo:language="en" fo:country="US" style:letter-kerning="true" 
style:font-size-complex="12pt"/>
+  </style:default-style>
+  <style:style style:name="Frame_20_contents" style:display-name="Frame 
contents" style:family="paragraph" style:parent-style-name="Standard" 
style:class="extra"/>
+  <style:style style:name="Graphics" style:family="graphic">
+   <style:graphic-properties text:anchor-type="paragraph" svg:x="0cm" 
svg:y="0cm" style:wrap="dynamic" style:number-wrapped-paragraphs="no-limit" 
style:wrap-contour="false" style:vertical-pos="top" 
style:vertical-rel="paragraph" style:horizontal-pos="center" 
style:horizontal-rel="paragraph" fo:background-color="transparent" 
draw:fill="none" draw:fill-color="#729fcf"/>
+  </style:style>
+  <style:style style:name="Frame" style:family="graphic">
+   <style:graphic-properties text:anchor-type="paragraph" svg:x="0cm" 
svg:y="0cm" fo:margin-left="0.201cm" fo:margin-right="0.201cm" 
fo:margin-top="0.201cm" fo:margin-bottom="0.201cm" style:wrap="parallel" 
style:number-wrapped-paragraphs="no-limit" style:wrap-contour="false" 
style:vertical-pos="top" style:vertical-rel="paragraph-content" 
style:horizontal-pos="center" style:horizontal-rel="paragraph-content" 
fo:background-color="transparent" draw:fill="none" draw:fill-color="#729fcf" 
fo:padding="0.15cm" fo:border="0.06pt solid #000000"/>
+  </style:style>
+ </office:styles>
+ <office:automatic-styles>
+  <style:style style:name="Table1" style:family="table">
+   <style:table-properties style:width="8.707cm" table:align="margins" 
style:writing-mode="lr-tb"/>
+  </style:style>
+  <style:style style:name="Table1.A" style:family="table-column">
+   <style:table-column-properties style:column-width="8.707cm" 
style:rel-column-width="65535*"/>
+  </style:style>
+  <style:style style:name="Table1.1" style:family="table-row">
+   <style:table-row-properties style:row-height="6.897cm" 
fo:keep-together="always"/>
+  </style:style>
+  <style:style style:name="Table1.A1" style:family="table-cell">
+   <style:table-cell-properties style:vertical-align="top" fo:padding="0cm" 
fo:border="0.05pt solid #000000" style:writing-mode="lr-tb"/>
+  </style:style>
+  <style:style style:name="Table1.2" style:family="table-row">
+   <style:table-row-properties style:min-row-height="0.109cm" 
fo:keep-together="always"/>
+  </style:style>
+  <style:style style:name="Table1.A2" style:family="table-cell">
+   <style:table-cell-properties style:vertical-align="top" fo:padding="0cm" 
fo:border="none" style:writing-mode="lr-tb"/>
+  </style:style>
+  <style:style style:name="fr1" style:family="graphic" 
style:parent-style-name="Frame">
+   <style:graphic-properties fo:margin-left="0cm" fo:margin-right="0cm" 
fo:margin-top="0cm" fo:margin-bottom="0cm" style:vertical-pos="top" 
style:vertical-rel="paragraph" style:horizontal-pos="left" 
style:horizontal-rel="paragraph" fo:padding="0cm" fo:border="none" 
draw:wrap-influence-on-position="once-concurrent" loext:allow-overlap="true"/>
+  </style:style>
+  <style:style style:name="fr2" style:family="graphic" 
style:parent-style-name="Graphics">
+   <style:graphic-properties fo:margin-left="0cm" fo:margin-right="0cm" 
fo:margin-top="0cm" fo:margin-bottom="0cm" style:vertical-pos="from-top" 
style:horizontal-pos="center" style:horizontal-rel="paragraph" fo:padding="0cm" 
fo:border="none" style:mirror="none" fo:clip="rect(0cm, 0cm, 0cm, 0cm)" 
draw:luminance="0%" draw:contrast="0%" draw:red="0%" draw:green="0%" 
draw:blue="0%" draw:gamma="100%" draw:color-inversion="false" 
draw:image-opacity="100%" draw:color-mode="standard"/>
+  </style:style>
+ </office:automatic-styles>
+ <office:master-styles>
+  <style:master-page style:name="Standard" style:page-layout-name="pm1" 
draw:style-name="dp1"/>
+ </office:master-styles>
+ <office:body>
+  <office:text>
+   <text:p text:style-name="P3"><draw:frame draw:style-name="fr1" 
draw:name="Frame1" text:anchor-type="paragraph" svg:width="8.707cm" 
draw:z-index="0">
+     <draw:text-box fo:min-height="6.765cm">
+      <table:table table:name="Table1" table:style-name="Table1">
+       <table:table-column table:style-name="Table1.A"/>
+       <table:table-row table:style-name="Table1.1">
+        <table:table-cell table:style-name="Table1.A1" 
office:value-type="string">
+         <text:p text:style-name="P1"><draw:frame draw:style-name="fr2" 
draw:name="Image1" text:anchor-type="as-char" svg:y="-10.984cm" 
svg:width="11.234cm" svg:height="8.398cm" draw:z-index="1"><draw:image 
draw:mime-type="image/png">
+            
<office:binary-data>iVBORw0KGgoAAAANSUhEUgAAAAIAAAACCAIAAAD91JpzAAAAFklEQVQI12P2Ytilf46NeWX3
+             a804HgAg7QTAqXPBTwAAAABJRU5ErkJggg==
+            </office:binary-data>
+           </draw:image>
+          </draw:frame><text:span 
text:style-name="T1"><text:s/></text:span></text:p>
+        </table:table-cell>
+       </table:table-row>
+       <table:table-row table:style-name="Table1.2">
+        <table:table-cell table:style-name="Table1.A2" 
office:value-type="string">
+         <text:p text:style-name="P2">Lorem ipsum dolor sit amet, consectetur 
adipiscing.</text:p>
+        </table:table-cell>
+       </table:table-row>
+      </table:table>
+     </draw:text-box>
+    </draw:frame></text:p>
+  </office:text>
+ </office:body>
+</office:document>
diff --git a/sw/qa/extras/uiwriter/uiwriter6.cxx 
b/sw/qa/extras/uiwriter/uiwriter6.cxx
index 9b8ae0244efe..db0c8f6929c7 100644
--- a/sw/qa/extras/uiwriter/uiwriter6.cxx
+++ b/sw/qa/extras/uiwriter/uiwriter6.cxx
@@ -55,6 +55,10 @@
 #include <wrthtml.hxx>
 #include <dbmgr.hxx>
 #include <rootfrm.hxx>
+#include <pagefrm.hxx>
+#include <sortedobjs.hxx>
+#include <flyfrms.hxx>
+#include <tabfrm.hxx>
 #include <unotxdoc.hxx>
 #include <wrong.hxx>
 #include <com/sun/star/linguistic2/LinguServiceManager.hpp>
@@ -1472,6 +1476,43 @@ CPPUNIT_TEST_FIXTURE(SwUiWriterTest6, testTdf44773)
     CPPUNIT_ASSERT_EQUAL(tools::Long(810), pCellA1->getFrameArea().Height());
 }
 
+CPPUNIT_TEST_FIXTURE(SwUiWriterTest6, testTdf160842)
+{
+    createSwDoc("tdf160842.fodt");
+    SwDoc* pDoc = getSwDoc();
+    CPPUNIT_ASSERT(pDoc);
+    SwWrtShell* pWrtShell = pDoc->GetDocShell()->GetWrtShell();
+    CPPUNIT_ASSERT(pWrtShell);
+    // the cursor is not in the table
+    CPPUNIT_ASSERT(!pWrtShell->IsCursorInTable());
+
+    SwRootFrame* pLayout = pDoc->getIDocumentLayoutAccess().GetCurrentLayout();
+    auto pPage = dynamic_cast<SwPageFrame*>(pLayout->Lower());
+    CPPUNIT_ASSERT(pPage);
+    const SwSortedObjs& rPageObjs = *pPage->GetSortedObjs();
+    CPPUNIT_ASSERT_EQUAL(static_cast<size_t>(1), rPageObjs.size());
+    auto pPageFly = dynamic_cast<SwFlyAtContentFrame*>(rPageObjs[0]);
+    CPPUNIT_ASSERT(pPageFly);
+    auto pTable = dynamic_cast<SwTabFrame*>(pPageFly->GetLower());
+    CPPUNIT_ASSERT(pTable);
+    auto pRow2 = pTable->GetLower()->GetNext();
+    CPPUNIT_ASSERT(pRow2->IsRowFrame());
+    auto pCellA2 = pRow2->GetLower();
+    CPPUNIT_ASSERT(pCellA2);
+    const SwRect& rCellA2Rect = pCellA2->getFrameArea();
+    auto nRowHeight = rCellA2Rect.Height();
+    // select center of the bottom cell
+    Point ptFrom(rCellA2Rect.Left() + rCellA2Rect.Width() / 2, 
rCellA2Rect.Top() + nRowHeight / 2);
+    vcl::Window& rEditWin = pDoc->GetDocShell()->GetView()->GetEditWin();
+    Point aFrom = rEditWin.LogicToPixel(ptFrom);
+    MouseEvent aClickEvent(aFrom, 1, MouseEventModifiers::SIMPLECLICK, 
MOUSE_LEFT);
+    rEditWin.MouseButtonDown(aClickEvent);
+    rEditWin.MouseButtonUp(aClickEvent);
+
+    // the cursor is in the table
+    CPPUNIT_ASSERT(pWrtShell->IsCursorInTable());
+}
+
 CPPUNIT_TEST_FIXTURE(SwUiWriterTest6, testTdf115132)
 {
     createSwDoc();
diff --git a/sw/source/core/frmedt/feshview.cxx 
b/sw/source/core/frmedt/feshview.cxx
index 9154758364fb..4ad0747619ee 100644
--- a/sw/source/core/frmedt/feshview.cxx
+++ b/sw/source/core/frmedt/feshview.cxx
@@ -68,6 +68,7 @@
 #include <rootfrm.hxx>
 #include <pagefrm.hxx>
 #include <sectfrm.hxx>
+#include <rowfrm.hxx>
 #include <doc.hxx>
 #include <IDocumentUndoRedo.hxx>
 #include <dview.hxx>
@@ -1392,6 +1393,27 @@ bool SwFEShell::ShouldObjectBeSelected(const Point& rPt)
                     }
                 }
             }
+
+            // within table row, where image cropped by the fixed table row 
height,
+            // click position must be in the cell, where the image anchored as 
character
+            if ( bRet && pContact && pContact->ObjAnchoredAsChar() )
+            {
+                if ( const SwTableBox *pBox = 
pContact->GetAnchorNode().GetTableBox() )
+                {
+                    SwIterator<SwRowFrame, SwFormat> aIter( 
*pBox->GetUpper()->GetFrameFormat() );
+                    bool bContainsClickPosition = false;
+                    for (SwRowFrame* pFrame = aIter.First(); pFrame; pFrame = 
aIter.Next())
+                    {
+                        if ( pFrame->getFrameArea().Contains( rPt ) )
+                        {
+                            bContainsClickPosition = true;
+                            break;
+                        }
+                    }
+                    if ( !bContainsClickPosition )
+                        bRet = false;
+                }
+            }
         }
     }
 
commit 8e2887a2aaa41605e3378726c08872402a05e05a
Author:     László Németh <nem...@numbertext.org>
AuthorDate: Tue Apr 23 16:04:47 2024 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Fri May 17 19:57:42 2024 +0200

    tdf#44773 sw: allow resizing table rows, if cursor outside the table
    
    If the cursor wasn't in the table, only column width of text
    tables was resizeable by dragging the horizontal cell borders:
    It was possible to drag the horizontal border, showing its
    preview, but the drop cancelled the operation instead of
-e 
... etc. - the rest is truncated

Reply via email to