download.lst                                                              |    
8 -
 emfio/source/reader/mtftools.cxx                                          |    
2 
 extras/Package_gallbullets.mk                                             |   
36 +++---
 extras/source/gallery/bullets/cross-red.png                               
|binary
 extras/source/gallery/bullets/cross-red.svg                               |   
42 +++++++
 extras/source/gallery/gallery_system/bullets.sdg                          
|binary
 extras/source/gallery/gallery_system/bullets.thm                          
|binary
 filter/source/config/fragments/types/writer_MS_Word_2007_XML_Template.xcu |    
2 
 oox/source/export/shapes.cxx                                              |    
2 
 sd/qa/unit/data/odp/tdf170166.odp                                         
|binary
 sd/qa/unit/data/tdf169813_prevent_unintended_dashed_line.svg              |    
1 
 sd/qa/unit/export-tests-ooxml4.cxx                                        |   
21 +++
 sd/qa/unit/uiimpress.cxx                                                  |   
28 +++++
 sd/source/filter/eppt/pptx-epptooxml.cxx                                  |   
22 +---
 svx/source/svdraw/svdfmtf.cxx                                             |    
8 -
 sw/inc/doc.hxx                                                            |    
2 
 sw/qa/extras/ooxmlexport/ooxmlexport4.cxx                                 |   
20 ---
 sw/qa/extras/uiwriter/data/tdf131124_Extruded_Shape_Selection.odt         
|binary
 sw/qa/extras/uiwriter/data/tdf131124_Fontwork_Selection.odt               
|binary
 sw/qa/extras/uiwriter/uiwriter11.cxx                                      |   
28 +++++
 sw/qa/extras/uiwriter/uiwriter9.cxx                                       |    
2 
 sw/source/core/crsr/crsrsh.cxx                                            |    
1 
 sw/source/core/doc/doctxm.cxx                                             |   
14 +-
 sw/source/core/text/itrform2.cxx                                          |    
6 -
 sw/source/core/unocore/unoidx.cxx                                         |   
13 +-
 sw/source/filter/ww8/docxattributeoutput.cxx                              |   
20 +--
 sw/source/uibase/uno/unotxvw.cxx                                          |    
2 
 sw/source/uibase/utlui/content.cxx                                        |   
12 +-
 sw/uiconfig/swriter/ui/textgridpage.ui                                    |    
5 
 vcl/inc/unx/gtk/gtkframe.hxx                                              |    
1 
 vcl/source/gdi/metaact.cxx                                                |    
3 
 vcl/unx/gtk3/gtkframe.cxx                                                 |   
53 +++++-----
 vcl/unx/gtk3/gtkinst.cxx                                                  |    
4 
 33 files changed, 240 insertions(+), 118 deletions(-)

New commits:
commit ff03a9602aca295adc6e6cd523b6e1f8ca467456
Author:     Noel Grandin <[email protected]>
AuthorDate: Wed Jan 7 19:33:42 2026 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jan 10 14:02:39 2026 +0100

    officeotron: w:pPrChange is incomplete
    
    the schema says w:pPr is required under w:pPrChange.
    
    I dont understand the unit test I changed here, it was
    added with:
    
      commit c2c08b7d0e87f8cd1c97028c9363826f4bd22dcb
      Author: Adam Co <[email protected]>
      Date:   Mon Jan 13 13:55:05 2014 +0200
      Add unit-test for 'track changes - paragraph properties changed' 
preservation
    
    But seems to be asserting that we __dont__ preserve w:pPr,
    which makes no sense.
    
    So fix that.
    
    Change-Id: I536992bd3aec232f8dffda4f753c887148a877f2
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196786
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit a520104c86703c9a697166c1b8d703060435b59c)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196943
    Reviewed-by: Xisco Fauli <[email protected]>

diff --git a/sw/qa/extras/ooxmlexport/ooxmlexport4.cxx 
b/sw/qa/extras/ooxmlexport/ooxmlexport4.cxx
index c5aeb4d1342d..1be442124c76 100644
--- a/sw/qa/extras/ooxmlexport/ooxmlexport4.cxx
+++ b/sw/qa/extras/ooxmlexport/ooxmlexport4.cxx
@@ -190,12 +190,9 @@ CPPUNIT_TEST_FIXTURE(Test, 
testTrackChangesParagraphProperties)
 {
     createSwDoc("testTrackChangesParagraphProperties.docx");
 
-    //FIXME: validation error in OOXML export: Errors: 1
-    skipValidation();
-
     save(TestFilter::DOCX);
     xmlDocUniquePtr pXmlDoc = parseExport(u"word/document.xml"_ustr);
-    assertXPathChildren(pXmlDoc, 
"/w:document/w:body/w:p[1]/w:pPr/w:pPrChange", 0);
+    assertXPathChildren(pXmlDoc, 
"/w:document/w:body/w:p[1]/w:pPr/w:pPrChange", 1);
 }
 
 CPPUNIT_TEST_FIXTURE(Test, testMsoSpt180)
diff --git a/sw/source/filter/ww8/docxattributeoutput.cxx 
b/sw/source/filter/ww8/docxattributeoutput.cxx
index 6988c75210cb..0c329ca663b3 100644
--- a/sw/source/filter/ww8/docxattributeoutput.cxx
+++ b/sw/source/filter/ww8/docxattributeoutput.cxx
@@ -4282,6 +4282,8 @@ void DocxAttributeOutput::Redline( const SwRedlineData* 
pRedlineData)
         if (!bNoDate)
             pAttributeList->add(FSNS( XML_w, XML_date ), DateTimeToOString( 
aDateTime ));
         m_pSerializer->startElementNS( XML_w, XML_pPrChange, pAttributeList );
+        m_pSerializer->startElementNS(XML_w, XML_pPr);
+        m_pSerializer->mark(Tag_Redline_2, 
comphelper::containerToSequence(aParagraphPropertiesOrder));
 
         // Check if there is any extra data stored in the redline object
         if (pRedlineData->GetExtraData())
@@ -4297,10 +4299,6 @@ void DocxAttributeOutput::Redline( const SwRedlineData* 
pRedlineData)
                 const UIName & sParaStyleName = 
pFormattingChanges->GetFormatName();
                 if (pChangesSet || !sParaStyleName.isEmpty())
                 {
-                    m_pSerializer->startElementNS(XML_w, XML_pPr);
-
-                    m_pSerializer->mark(Tag_Redline_2, 
comphelper::containerToSequence(aParagraphPropertiesOrder));
-
                     if (!sParaStyleName.isEmpty())
                     {
                         OString sStyleName;
@@ -4336,13 +4334,11 @@ void DocxAttributeOutput::Redline( const SwRedlineData* 
pRedlineData)
                     m_rExport.SdrExporter().getFlyAttrList() = 
std::move(pFlyAttrList_Original);
                     m_pLRSpaceAttrList = std::move(pLRSpaceAttrList_Original);
                     m_pParagraphSpacingAttrList = 
std::move(pParagraphSpacingAttrList_Original);
-
-                    m_pSerializer->mergeTopMarks(Tag_Redline_2);
-
-                    m_pSerializer->endElementNS( XML_w, XML_pPr );
                 }
             }
         }
+        m_pSerializer->mergeTopMarks(Tag_Redline_2);
+        m_pSerializer->endElementNS( XML_w, XML_pPr );
         m_pSerializer->endElementNS( XML_w, XML_pPrChange );
         break;
     }
commit 3b777f8094c3c5422a0944b0056326e67c308abb
Author:     Justin Luth <[email protected]>
AuthorDate: Wed Jan 7 21:21:50 2026 -0500
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jan 10 14:02:38 2026 +0100

    tdf#170261: dotx 2007 is no longer the preferred template.
    
    filter/source/config/fragments/types/writer_OOXML_Template.xcu
    is also marked as Preferred = true
    Word 2010–365 Template
    
    Change-Id: If77cdfc3502d7efbc8a93a7d4ef74976488bdf0b
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196790
    Tested-by: Jenkins
    Reviewed-by: Justin Luth <[email protected]>
    (cherry picked from commit e145133093c2f550dd592a5702c819698d87c4a1)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196936

diff --git 
a/filter/source/config/fragments/types/writer_MS_Word_2007_XML_Template.xcu 
b/filter/source/config/fragments/types/writer_MS_Word_2007_XML_Template.xcu
index 059e7078a40e..b08cf7d936f2 100644
--- a/filter/source/config/fragments/types/writer_MS_Word_2007_XML_Template.xcu
+++ b/filter/source/config/fragments/types/writer_MS_Word_2007_XML_Template.xcu
@@ -20,7 +20,7 @@
         <prop oor:name="URLPattern"/>
         <prop oor:name="Extensions"><value>dotx dotm</value></prop>
         <prop oor:name="MediaType"><value>application/msword</value></prop>
-        <prop oor:name="Preferred"><value>true</value></prop>
+        <prop oor:name="Preferred"><value>false</value></prop>
         <prop oor:name="PreferredFilter"><value>MS Word 2007 XML 
Template</value></prop>
         <prop oor:name="UIName"><value xml:lang="en-US">Word 2007 
Template</value></prop>
         <prop oor:name="ClipboardFormat"><value>MSWordDoc</value></prop>
commit d457bbcc6835671de987db358c98903d054cc77b
Author:     Regina Henschel <[email protected]>
AuthorDate: Sat Jan 3 16:19:51 2026 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jan 10 14:02:38 2026 +0100

    tdf#131124 Handle ExtrudedCustomShape and FontWork
    
    ShellMode::ExtrudedCustomShape and ShellMode::FontWork were missing in
    the switch. Thus mxShapes and mxShape in the Export dialog were empty
    and maSize was zero.
    
    Change-Id: If4c2137ce85a0aef0613d9d79979cc9a58b5c115
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196456
    Tested-by: Jenkins
    Reviewed-by: Regina Henschel <[email protected]>
    (cherry picked from commit a8babea4ce7f07f969e58594ab5a5afc2d190e69)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196881
    Reviewed-by: Xisco Fauli <[email protected]>

diff --git a/sw/qa/extras/uiwriter/data/tdf131124_Extruded_Shape_Selection.odt 
b/sw/qa/extras/uiwriter/data/tdf131124_Extruded_Shape_Selection.odt
new file mode 100644
index 000000000000..5d2d0ef7bd1a
Binary files /dev/null and 
b/sw/qa/extras/uiwriter/data/tdf131124_Extruded_Shape_Selection.odt differ
diff --git a/sw/qa/extras/uiwriter/data/tdf131124_Fontwork_Selection.odt 
b/sw/qa/extras/uiwriter/data/tdf131124_Fontwork_Selection.odt
new file mode 100644
index 000000000000..8b3090d1ae65
Binary files /dev/null and 
b/sw/qa/extras/uiwriter/data/tdf131124_Fontwork_Selection.odt differ
diff --git a/sw/qa/extras/uiwriter/uiwriter11.cxx 
b/sw/qa/extras/uiwriter/uiwriter11.cxx
index cc642e56d600..dfe2c60ffee5 100644
--- a/sw/qa/extras/uiwriter/uiwriter11.cxx
+++ b/sw/qa/extras/uiwriter/uiwriter11.cxx
@@ -397,6 +397,34 @@ CPPUNIT_TEST_FIXTURE(SwUiWriterTest11, 
testTdf162120AutoRTL)
                          getProperty<short>(getRun(getParagraph(1), 1), 
u"WritingMode"_ustr));
 }
 
+CPPUNIT_TEST_FIXTURE(SwUiWriterTest11, testFontworkSelection)
+{
+    // Load a document with a Fontwork shape and select the shape
+    createSwDoc("tdf131124_Fontwork_Selection.odt");
+    dispatchCommand(mxComponent, u".uno:JumpToNextFrame"_ustr, {});
+
+    // Make sure the CurrentSelection of the document is not empty.
+    uno::Reference<frame::XModel> xModel(mxComponent, uno::UNO_QUERY);
+    uno::Reference<container::XIndexAccess> 
xSelections(xModel->getCurrentSelection(),
+                                                        uno::UNO_QUERY);
+    // Without fix, this test would have failed here
+    CPPUNIT_ASSERT(xSelections.is());
+}
+
+CPPUNIT_TEST_FIXTURE(SwUiWriterTest11, testExtrudedShapeSelection)
+{
+    // Load a document with an extruded custom shape and select the shape
+    createSwDoc("tdf131124_Extruded_Shape_Selection.odt");
+    dispatchCommand(mxComponent, u".uno:JumpToNextFrame"_ustr, {});
+
+    // Make sure the CurrentSelection of the document is not empty.
+    uno::Reference<frame::XModel> xModel(mxComponent, uno::UNO_QUERY);
+    uno::Reference<container::XIndexAccess> 
xSelections(xModel->getCurrentSelection(),
+                                                        uno::UNO_QUERY);
+    // Without fix, this test would have failed here
+    CPPUNIT_ASSERT(xSelections.is());
+}
+
 } // end of anonymous namespace
 CPPUNIT_PLUGIN_IMPLEMENT();
 
diff --git a/sw/source/uibase/uno/unotxvw.cxx b/sw/source/uibase/uno/unotxvw.cxx
index e8577548ac34..12e6f0c562dc 100644
--- a/sw/source/uibase/uno/unotxvw.cxx
+++ b/sw/source/uibase/uno/unotxvw.cxx
@@ -321,6 +321,8 @@ uno::Any SwXTextView::getSelection()
             case ShellMode::DrawForm        :
             case ShellMode::DrawText        :
             case ShellMode::Bezier          :
+            case ShellMode::ExtrudedCustomShape:
+            case ShellMode::FontWork:
             {
                 uno::Reference< drawing::XShapes >  xShCol = 
drawing::ShapeCollection::create(
                         comphelper::getProcessComponentContext());
commit 735faa16f6d2f4df8d2e1ac036613c954f5452f2
Author:     Caolán McNamara <[email protected]>
AuthorDate: Tue Jan 6 21:13:03 2026 +0000
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jan 10 14:02:38 2026 +0100

    add a11y name to preview widget
    
    Change-Id: Ie1d4ffa6453336760e7af922e42f3c701344bc99
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196672
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <[email protected]>
    (cherry picked from commit d8451e3a33c0b851c3cd8b0dd48a92dd7d178624)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196846
    Reviewed-by: Xisco Fauli <[email protected]>

diff --git a/sw/uiconfig/swriter/ui/textgridpage.ui 
b/sw/uiconfig/swriter/ui/textgridpage.ui
index aa2a3c6b001e..5db73401fcc0 100644
--- a/sw/uiconfig/swriter/ui/textgridpage.ui
+++ b/sw/uiconfig/swriter/ui/textgridpage.ui
@@ -150,6 +150,11 @@
                 <property name="can-focus">False</property>
                 <property name="halign">center</property>
                 <property name="valign">center</property>
+                <child internal-child="accessible">
+                  <object class="AtkObject" 
id="drawingareaWN_EXAMPLE-atkobject">
+                    <property name="AtkObject::accessible-name" 
translatable="yes" 
context="textgridpage|drawingareaWN_EXAMPLE-atkobject">Preview</property>
+                  </object>
+                </child>
               </object>
               <packing>
                 <property name="expand">True</property>
commit 62a0e6247f72b3fa29b138f2ef2df8045964a845
Author:     Andreas Heinisch <[email protected]>
AuthorDate: Sun Jan 4 14:01:32 2026 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jan 10 14:02:38 2026 +0100

    tdf#169813 - Reset default dash option during GDIMetaFileImport
    
    Change-Id: Ibb85a649594c8edbce1b624bed1a6c7942a3d183
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196519
    Tested-by: Jenkins
    Reviewed-by: Andreas Heinisch <[email protected]>
    Signed-off-by: Xisco Fauli <[email protected]>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196563

diff --git a/svx/source/svdraw/svdfmtf.cxx b/svx/source/svdraw/svdfmtf.cxx
index 69a7dfcd36dd..fa77ec8898d1 100644
--- a/svx/source/svdraw/svdfmtf.cxx
+++ b/svx/source/svdraw/svdfmtf.cxx
@@ -88,6 +88,7 @@ ImpSdrGDIMetaFileImport::ImpSdrGDIMetaFileImport(
     mnLineWidth(0),
     maLineJoin(basegfx::B2DLineJoin::NONE),
     maLineCap(css::drawing::LineCap_BUTT),
+    maDash(css::drawing::DashStyle_RECT, 0, 0, 0, 0, 0),
     mbMov(false),
     mbSize(false),
     maOfs(0, 0),
commit 314ecaa36f312b95bc9913bbe9d746530ed38d65
Author:     Caolán McNamara <[email protected]>
AuthorDate: Wed Dec 17 21:30:20 2025 +0000
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jan 10 14:02:37 2026 +0100

    Resolves: tdf#151849 use convoluted find-latin keygroup for accelerators
    
    for native gtk widget keyevent handlers, same as the toplevel widget
    uses, so Ctrl+יworks like Ctrl+h. None of this is portable to gtk4
    I think.
    
    Change-Id: Ia4f350c1b726abf8ba98fbb66177f27c0f988a30
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/195814
    Reviewed-by: Caolán McNamara <[email protected]>
    Tested-by: Jenkins
    (cherry picked from commit d40fb8ade1380fc34844e7bda7a6e335807ee5c6)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/195851

diff --git a/vcl/inc/unx/gtk/gtkframe.hxx b/vcl/inc/unx/gtk/gtkframe.hxx
index 5acb24f85a8a..9f3901547635 100644
--- a/vcl/inc/unx/gtk/gtkframe.hxx
+++ b/vcl/inc/unx/gtk/gtkframe.hxx
@@ -641,6 +641,7 @@ public:
     static sal_uInt16           GetKeyCode(guint nKeyVal);
 #if !GTK_CHECK_VERSION(4, 0, 0)
     static guint                GetKeyValFor(GdkKeymap* pKeyMap, guint16 
hardware_keycode, guint8 group);
+    static guint8               GetBestAccelKeyGroup(GdkKeymap* keymap, guint8 
group);
 #endif
     static sal_uInt16           GetKeyModCode(guint nState);
     static GdkEvent*            makeFakeKeyPress(GtkWidget* pWidget);
diff --git a/vcl/unx/gtk3/gtkframe.cxx b/vcl/unx/gtk3/gtkframe.cxx
index a1583a07269d..9a3fd6b9f125 100644
--- a/vcl/unx/gtk3/gtkframe.cxx
+++ b/vcl/unx/gtk3/gtkframe.cxx
@@ -330,6 +330,36 @@ guint GtkSalFrame::GetKeyValFor(GdkKeymap* pKeyMap, 
guint16 hardware_keycode, gu
         GdkModifierType(0), group, &updated_keyval, nullptr, nullptr, nullptr);
     return updated_keyval;
 }
+
+
+guint8 GtkSalFrame::GetBestAccelKeyGroup(GdkKeymap* keymap, guint8 group)
+{
+    gint best_group = SAL_MAX_INT32;
+
+    // Try and find Latin layout
+    GdkKeymapKey *keys;
+    gint n_keys;
+    if (gdk_keymap_get_entries_for_keyval(keymap, GDK_KEY_A, &keys, &n_keys))
+    {
+        // Find the lowest group that supports Latin layout
+        for (gint i = 0; i < n_keys; ++i)
+        {
+            if (keys[i].level != 0 && keys[i].level != 1)
+                continue;
+            best_group = std::min(best_group, keys[i].group);
+            if (best_group == 0)
+                break;
+        }
+        g_free(keys);
+    }
+
+    //Unavailable, go with original group then I suppose
+    if (best_group == SAL_MAX_INT32)
+        best_group = group;
+
+    return best_group;
+}
+
 #endif
 
 namespace {
@@ -425,30 +455,9 @@ bool GtkSalFrame::doKeyCallback( guint state,
 #if !GTK_CHECK_VERSION(4, 0, 0)
     if( aEvent.mnCode == 0 )
     {
-        gint best_group = SAL_MAX_INT32;
-
         // Try and find Latin layout
         GdkKeymap* keymap = gdk_keymap_get_default();
-        GdkKeymapKey *keys;
-        gint n_keys;
-        if (gdk_keymap_get_entries_for_keyval(keymap, GDK_KEY_A, &keys, 
&n_keys))
-        {
-            // Find the lowest group that supports Latin layout
-            for (gint i = 0; i < n_keys; ++i)
-            {
-                if (keys[i].level != 0 && keys[i].level != 1)
-                    continue;
-                best_group = std::min(best_group, keys[i].group);
-                if (best_group == 0)
-                    break;
-            }
-            g_free(keys);
-        }
-
-        //Unavailable, go with original group then I suppose
-        if (best_group == SAL_MAX_INT32)
-            best_group = group;
-
+        guint8 best_group = GetBestAccelKeyGroup(keymap, group);
         guint updated_keyval = GetKeyValFor(keymap, hardware_keycode, 
best_group);
         aEvent.mnCode = GetKeyCode(updated_keyval);
     }
diff --git a/vcl/unx/gtk3/gtkinst.cxx b/vcl/unx/gtk3/gtkinst.cxx
index 10aa23fe425d..ab75d0451608 100644
--- a/vcl/unx/gtk3/gtkinst.cxx
+++ b/vcl/unx/gtk3/gtkinst.cxx
@@ -2094,7 +2094,9 @@ class GtkInstanceBuilder;
 #if !GTK_CHECK_VERSION(4, 0, 0)
         if (nKeyCode == 0)
         {
-            guint updated_keyval = 
GtkSalFrame::GetKeyValFor(gdk_keymap_get_default(), hardware_keycode, group);
+            GdkKeymap* keymap = gdk_keymap_get_default();
+            guint8 best_group = GtkSalFrame::GetBestAccelKeyGroup(keymap, 
group);
+            guint updated_keyval = GtkSalFrame::GetKeyValFor(keymap, 
hardware_keycode, best_group);
             nKeyCode = GtkSalFrame::GetKeyCode(updated_keyval);
         }
 #else
commit a8902df51b9a56d37247d7b72936d6ebdd354294
Author:     Jim Raykowski <[email protected]>
AuthorDate: Sat Dec 20 00:01:50 2025 -0900
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jan 10 14:02:37 2026 +0100

    tdf#170041 SwNavigator: Fix floating tables aren't highlighted fully
    
    Specifically, split frames holding floating tables aren't highlighted
    fully. This patch uses SwIterator<SwFrame, SwFormat> as observed in
    SwFrameFormat::DelFrames. Here it is used to visit all frames to
    highlight.
    
    Change-Id: I7d713cd9bca14acddcd5049b5cf81a34e403af72
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/195961
    Tested-by: Jenkins
    Reviewed-by: Jim Raykowski <[email protected]>
    (cherry picked from commit 8415e4a92b1ef047090679a70a9ff2e580c19071)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196090
    Reviewed-by: Adolfo Jayme Barrientos <[email protected]>

diff --git a/sw/source/uibase/utlui/content.cxx 
b/sw/source/uibase/utlui/content.cxx
index 5d10a4472c66..d33349144c0a 100644
--- a/sw/source/uibase/utlui/content.cxx
+++ b/sw/source/uibase/utlui/content.cxx
@@ -7688,10 +7688,14 @@ void SwContentTree::BringFramesToAttention(const 
std::vector<const SwFrameFormat
     {
         if (!pFrameFormat)
             continue;
-        SwRect aFrameRect = pFrameFormat->FindLayoutRect();
-        if (!aFrameRect.IsEmpty())
-            aRanges.emplace_back(aFrameRect.Left(), aFrameRect.Top(), 
aFrameRect.Right(),
-                                 aFrameRect.Bottom());
+        SwIterator<SwFrame, SwFormat> aIter(*pFrameFormat);
+        for (const SwFrame* pFrame = aIter.First(); pFrame; pFrame = 
aIter.Next())
+        {
+            const SwRect& rFrameRect = pFrame->getFrameArea();
+            if (!rFrameRect.IsEmpty())
+                aRanges.emplace_back(rFrameRect.Left(), rFrameRect.Top(), 
rFrameRect.Right(),
+                                     rFrameRect.Bottom());
+        }
     }
     OverlayObject(std::move(aRanges));
 }
commit c90fdc95725d3f67a23cad7719d80a7c1eb8ee08
Author:     Caolán McNamara <[email protected]>
AuthorDate: Fri Jan 2 11:01:22 2026 +0000
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jan 10 14:02:37 2026 +0100

    ofz#472735025 Integer-overflow
    
    Change-Id: If7b76626d43435d4e079a11080b87c76f8b5db81
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196420
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <[email protected]>
    (cherry picked from commit cd48c8431965df97e6d1b6b5a63d05587572a8af)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196433
    Reviewed-by: Xisco Fauli <[email protected]>

diff --git a/emfio/source/reader/mtftools.cxx b/emfio/source/reader/mtftools.cxx
index 5888d5f9de9f..a8380cb374fc 100644
--- a/emfio/source/reader/mtftools.cxx
+++ b/emfio/source/reader/mtftools.cxx
@@ -276,7 +276,7 @@ namespace emfio
             aFont.SetFontSize( aFontSize );
             pVDev->SetFont( aFont );
             FontMetric aMetric( pVDev->GetFontMetric() );
-            tools::Long nHeight = aMetric.GetAscent() + aMetric.GetDescent();
+            tools::Long nHeight = 
static_cast<tools::Long>(aMetric.GetAscent()) + aMetric.GetDescent();
             if (nHeight)
             {
                 double fHeight = (static_cast<double>(aFontSize.Height()) * 
rFont.lfHeight ) / nHeight;
commit 58b860c92e3cd517b84de6b0375d61473e0a6662
Author:     Xisco Fauli <[email protected]>
AuthorDate: Fri Jan 2 11:09:16 2026 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jan 10 14:02:37 2026 +0100

    glm: upgrade to 1.0.3
    
    Downloaded from https://github.com/g-truc/glm/archive/refs/tags/1.0.3.zip
    
    Change-Id: I1bd5d15a845f8842b7cf37368a600198e58da335
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196413
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <[email protected]>
    (cherry picked from commit e4d38da717fada1860b00ebe396705b1a001c711)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196428

diff --git a/download.lst b/download.lst
index 0d80e9868519..379bce4ffb5d 100644
--- a/download.lst
+++ b/download.lst
@@ -380,8 +380,8 @@ FROZEN_TARBALL := frozen-1.2.0.tar.gz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-GLM_SHA256SUM := 
be64032585415ca7dbea0d614915bb8eec012adf7b4d4fea7ff6b5bd3e0b906a
-GLM_TARBALL := glm-1.0.2.zip
+GLM_SHA256SUM := 
3aa4347b8f13cba882df1c7b61a6ca910c75a875c56ec3d75d7dc9ae8eac34df
+GLM_TARBALL := glm-1.0.3.zip
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
commit a20e130552d49ab3ed68180cb798eb06a96a04e9
Author:     Balazs Varga <[email protected]>
AuthorDate: Mon Dec 29 16:02:04 2025 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jan 10 14:02:36 2026 +0100

    tdf#170166: sd ooxml export: fix bullets in subtitle presobj
    
    Properly export of Subtitles as presObj was missed with
    this commit: 238cfa9efa21f08514703ea6cc181ce02d8feb12
    Such as missing '<a:buNone/>' attributes in slides/slide1.xml
    
    But still keep not to export subtitle presboj into masterslide.xml
    which still would cause corrupt xml when opening in mso.
    
    regression after: ef32ba978d7be844440ee0d9c78ad37128b35512
    
    Change-Id: I4f3e069ad1ade5bbcfa50f9096539c882c66e0b6
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196308
    Tested-by: Jenkins
    Reviewed-by: Aron Budea <[email protected]>
    (cherry picked from commit 415c7e04dc6a4a1638a63bf7195c8319b1cb8f85)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196362
    Reviewed-by: Xisco Fauli <[email protected]>

diff --git a/oox/source/export/shapes.cxx b/oox/source/export/shapes.cxx
index e07a72d9dcf5..30e08d2a9720 100644
--- a/oox/source/export/shapes.cxx
+++ b/oox/source/export/shapes.cxx
@@ -2208,7 +2208,7 @@ constexpr auto constMap = 
frozen::make_unordered_map<std::u16string_view, ShapeC
     { u"com.sun.star.presentation.OutlinerShape", &ShapeExport::WriteTextShape 
},
     { u"com.sun.star.presentation.SlideNumberShape", 
&ShapeExport::WriteTextShape },
     { u"com.sun.star.presentation.TitleTextShape", 
&ShapeExport::WriteTextShape },
-    //{ u"com.sun.star.presentation.SubtitleShape", 
&ShapeExport::WriteTextShape }, TODO: handle subtitle shape: see tdf#112557 
workaround
+    { u"com.sun.star.presentation.SubtitleShape", &ShapeExport::WriteTextShape 
}
 });
 
 } // end anonymous namespace
diff --git a/sd/qa/unit/data/odp/tdf170166.odp 
b/sd/qa/unit/data/odp/tdf170166.odp
new file mode 100644
index 000000000000..78d9412867f0
Binary files /dev/null and b/sd/qa/unit/data/odp/tdf170166.odp differ
diff --git a/sd/qa/unit/export-tests-ooxml4.cxx 
b/sd/qa/unit/export-tests-ooxml4.cxx
index c75cf916a411..721d78a721e1 100644
--- a/sd/qa/unit/export-tests-ooxml4.cxx
+++ b/sd/qa/unit/export-tests-ooxml4.cxx
@@ -1645,6 +1645,27 @@ CPPUNIT_TEST_FIXTURE(SdOOXMLExportTest4, 
testTextAlignLeft)
     assertXPath(pXmlDocRels, 
"/p:sld/p:cSld/p:spTree/p:sp[2]/p:txBody/a:p/a:pPr", "algn", u"l");
 }
 
+CPPUNIT_TEST_FIXTURE(SdOOXMLExportTest4, testSubtitleNoBullets)
+{
+    createSdImpressDoc("odp/tdf170166.odp");
+    saveAndReload(TestFilter::PPTX);
+
+    const SdrPage* pPage1 = GetPage(1);
+    {
+        // subtitle placeholder object
+        SdrTextObj* pTxtObj = DynCastSdrTextObj(pPage1->GetObj(0));
+        CPPUNIT_ASSERT_MESSAGE("no text object", pTxtObj != nullptr);
+        CPPUNIT_ASSERT_EQUAL_MESSAGE("Wrong object type!", SdrObjKind::Text,
+                                     pTxtObj->GetObjIdentifier());
+        const EditTextObject& aEdit = 
pTxtObj->GetOutlinerParaObject()->GetTextObject();
+        const SvxNumBulletItem* pNumFmt = 
aEdit.GetParaAttribs(0).GetItem(EE_PARA_NUMBULLET);
+        // Without a fix, it will fail with numbering type: 
SVX_NUM_CHAR_SPECIAL
+        CPPUNIT_ASSERT(pNumFmt);
+        CPPUNIT_ASSERT_EQUAL_MESSAGE("Bullet's numbering type is wrong!", 
SVX_NUM_NUMBER_NONE,
+                                     
pNumFmt->GetNumRule().GetLevel(0).GetNumberingType());
+    }
+}
+
 CPPUNIT_TEST_FIXTURE(SdOOXMLExportTest4, testOLEObjectAnimationTarget)
 {
     createSdImpressDoc("pptx/tdf169088.pptx");
diff --git a/sd/source/filter/eppt/pptx-epptooxml.cxx 
b/sd/source/filter/eppt/pptx-epptooxml.cxx
index d58db330beb7..1fe9e644b6fa 100644
--- a/sd/source/filter/eppt/pptx-epptooxml.cxx
+++ b/sd/source/filter/eppt/pptx-epptooxml.cxx
@@ -354,12 +354,16 @@ ShapeExport& PowerPointShapeExport::WriteTextShape(const 
Reference< XShape >& xS
         if (!WritePlaceholder(xShape, Title, mbMaster))
             ShapeExport::WriteTextShape(xShape);
     }
-    /*else if (sShapeType == "com.sun.star.presentation.SubtitleShape")
+    else if (sShapeType == "com.sun.star.presentation.SubtitleShape")
     {
-        TODO: handle subtitle shape: see tdf#112557 workaround
-        if (!WritePlaceholder(xShape, Subtitle, mbMaster))
-            ShapeExport::WriteTextShape(xShape);
-    }*/
+        // TODO: handle subtitle shape: see tdf#112557 workaround
+        // MSO does not like subtitles on master slides
+        if (mePageType != MASTER)
+        {
+            if (!WritePlaceholder(xShape, Subtitle, mbMaster))
+                ShapeExport::WriteTextShape(xShape);
+        }
+    }
     else
         SAL_WARN("sd.eppt", "PowerPointShapeExport::WriteTextShape: shape of 
type '" << sShapeType << "' is ignored");
 
@@ -376,14 +380,6 @@ ShapeExport& 
PowerPointShapeExport::WriteUnknownShape(const Reference< XShape >&
     {
         WritePageShape(xShape, mePageType, mrExport.GetPresObj());
     }
-    else if (sShapeType == "com.sun.star.presentation.SubtitleShape")
-    {
-        if(mePageType != MASTER)
-        {
-            if (!WritePlaceholder(xShape, Subtitle, mbMaster))
-                ShapeExport::WriteTextShape(xShape);
-        }
-    }
     else
         SAL_WARN("sd.eppt", "unknown shape not handled: " << 
sShapeType.toUtf8());
 
commit 381b255b02f120289c3d8e811568a9996b9f58bd
Author:     Andreas Heinisch <[email protected]>
AuthorDate: Sun Dec 28 12:36:01 2025 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jan 10 14:02:36 2026 +0100

    tdf#169813 - Reset default dash option during GDIMetaFileImport
    
    Prevent default constructor dash settings from affecting non-dashed
    line segements.
    
    Change-Id: I082f03a2a0fc92f8f319e6e82e496c6ee72386b6
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196264
    Tested-by: Jenkins
    Reviewed-by: Andreas Heinisch <[email protected]>
    Signed-off-by: Xisco Fauli <[email protected]>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196562

diff --git a/sd/qa/unit/data/tdf169813_prevent_unintended_dashed_line.svg 
b/sd/qa/unit/data/tdf169813_prevent_unintended_dashed_line.svg
new file mode 100644
index 000000000000..cfb8e90299a2
--- /dev/null
+++ b/sd/qa/unit/data/tdf169813_prevent_unintended_dashed_line.svg
@@ -0,0 +1 @@
+<svg viewBox="0 0 200 100" xmlns="http://www.w3.org/2000/svg";><polyline 
points="50,40 150,30" fill="none" stroke="#000" stroke-width="2.73" 
stroke-linejoin="bevel"/><path d="m100 40 8.835-1.78v11.5"/></svg>
diff --git a/sd/qa/unit/uiimpress.cxx b/sd/qa/unit/uiimpress.cxx
index 630ee0f87a4f..895c95352e1b 100644
--- a/sd/qa/unit/uiimpress.cxx
+++ b/sd/qa/unit/uiimpress.cxx
@@ -507,6 +507,34 @@ CPPUNIT_TEST_FIXTURE(SdUiImpressTest, 
testTdf155211_dashed_line)
     CPPUNIT_ASSERT_EQUAL(drawing::LineStyle_DASH, rStyleItem.GetValue());
 }
 
+CPPUNIT_TEST_FIXTURE(SdUiImpressTest, 
testTdf169813_prevent_unintended_dashed_line)
+{
+    createSdImpressDoc();
+
+    auto pXImpressDocument = 
dynamic_cast<SdXImpressDocument*>(mxComponent.get());
+    sd::ViewShell* pViewShell = 
pXImpressDocument->GetDocShell()->GetViewShell();
+
+    SdPage* pActualPage = pViewShell->GetActualPage();
+    CPPUNIT_ASSERT_EQUAL(static_cast<size_t>(2), pActualPage->GetObjCount());
+
+    OUString aImageURL = 
createFileURL(u"tdf169813_prevent_unintended_dashed_line.svg");
+    uno::Sequence<beans::PropertyValue> 
aArgs(comphelper::InitPropertySequence({
+        { "FileName", uno::Any(aImageURL) },
+    }));
+    dispatchCommand(mxComponent, u".uno:InsertGraphic"_ustr, aArgs);
+    CPPUNIT_ASSERT_EQUAL(static_cast<size_t>(3), pActualPage->GetObjCount());
+
+    // split the (auto-selected) svg
+    dispatchCommand(mxComponent, u".uno:Break"_ustr, {});
+
+    SdrObject* pObject = pActualPage->GetObj(3);
+    const XLineStyleItem& rStyleItem = pObject->GetMergedItem(XATTR_LINESTYLE);
+    // tdf#169813: Without the fix in place, this test would have failed with
+    // - Expected: 0 (LineStyle_NONE)
+    // - Actual  : 2 (LineStyle_DASH)
+    CPPUNIT_ASSERT_EQUAL(drawing::LineStyle_NONE, rStyleItem.GetValue());
+}
+
 CPPUNIT_TEST_FIXTURE(SdUiImpressTest, testTdf162455)
 {
     createSdImpressDoc();
diff --git a/svx/source/svdraw/svdfmtf.cxx b/svx/source/svdraw/svdfmtf.cxx
index 19a8cc8268d8..69a7dfcd36dd 100644
--- a/svx/source/svdraw/svdfmtf.cxx
+++ b/svx/source/svdraw/svdfmtf.cxx
@@ -88,7 +88,6 @@ ImpSdrGDIMetaFileImport::ImpSdrGDIMetaFileImport(
     mnLineWidth(0),
     maLineJoin(basegfx::B2DLineJoin::NONE),
     maLineCap(css::drawing::LineCap_BUTT),
-    maDash(css::drawing::DashStyle_RECT, 0, 0, 0, 0, 0),
     mbMov(false),
     mbSize(false),
     maOfs(0, 0),
@@ -367,7 +366,7 @@ void ImpSdrGDIMetaFileImport::SetAttributes(SdrObject* 
pObj, bool bForceTextAttr
         }
         else
         {
-            mpLineAttr->Put(XLineDashItem(OUString(), 
XDash(css::drawing::DashStyle_RECT)));
+            mpLineAttr->Put(XLineDashItem(OUString(), XDash()));
         }
     }
     else
@@ -695,7 +694,8 @@ void ImpSdrGDIMetaFileImport::DoAction(MetaLineAction const 
& rAct)
     SetAttributes(pPath.get());
     mnLineWidth = 0;
     maLineJoin = basegfx::B2DLineJoin::NONE;
-    maDash = XDash();
+    // tdf#169813 - reset default dash options
+    maDash = XDash(css::drawing::DashStyle_RECT, 0, 0, 0, 0, 0);
     InsertObj(pPath.get(), false);
 }
 
@@ -943,7 +943,8 @@ void ImpSdrGDIMetaFileImport::DoAction( MetaPolyLineAction 
const & rAct )
     SetAttributes(pPath.get());
     mnLineWidth = 0;
     maLineJoin = basegfx::B2DLineJoin::NONE;
-    maDash = XDash();
+    // tdf#169813 - reset default dash options
+    maDash = XDash(css::drawing::DashStyle_RECT, 0, 0, 0, 0, 0);
     InsertObj(pPath.get(), false);
 }
 
commit 6a8151a511cb7874ad1e7d2ed6625561e7ca5a29
Author:     Caolán McNamara <[email protected]>
AuthorDate: Fri Jan 2 16:22:59 2026 +0000
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jan 10 14:02:36 2026 +0100

    crashtesting: UaF in SwTextFormatter::InsertPortion
    
    for soffice --headless --convert-to pdf tdf103059-2.odt
    
    ==2656459==ERROR: AddressSanitizer: heap-use-after-free on address 
0x7c994604b938 at pc 0x7b2929cd73cd bp 0x7ffc818cc110 sp 0x7ffc818cc108
    READ of size 8 at 0x7c994604b938 thread T0
        #0 0x7b2929cd73cc in 
SwTextFormatter::NewFlyCntPortion(SwTextFormatInfo&, SwTextAttr*) const 
core-asan/sw/source/core/text/itrform2.cxx:3220
        #1 0x7b2929e02267 in 
SwTextFormatter::NewExtraPortion(SwTextFormatInfo&) 
core-asan/sw/source/core/text/txtfld.cxx:285
        #2 0x7b2929cccd9d in SwTextFormatter::NewPortion(SwTextFormatInfo&, 
std::optional<o3tl::strong_int<int, Tag_TextFrameIndex> >) 
core-asan/sw/source/core/text/itrform2.cxx:1886
        #3 0x7b2929cbf0a3 in SwTextFormatter::BuildPortions(SwTextFormatInfo&) 
core-asan/sw/source/core/text/itrform2.cxx:440
        #4 0x7b2929ccec48 in SwTextFormatter::FormatLine(o3tl::strong_int<int, 
Tag_TextFrameIndex>) core-asan/sw/source/core/text/itrform2.cxx:2102
        #5 0x7b2929c10fac in SwTextFrame::FormatLine(SwTextFormatter&, bool) 
core-asan/sw/source/core/text/frmform.cxx:1458
        #6 0x7b2929c14223 in SwTextFrame::Format_(SwTextFormatter&, 
SwTextFormatInfo&, bool) core-asan/sw/source/core/text/frmform.cxx:1822
        #7 0x7b2929e4755c in SwTestFormat::SwTestFormat(SwTextFrame*, SwFrame 
const*, long) core-asan/sw/source/core/text/txtfrm.cxx:3453
        #8 0x7b2929e47e1d in SwTextFrame::TestFormat(SwFrame const*, long&, 
bool&) core-asan/sw/source/core/text/txtfrm.cxx:3483
        #9 0x7b29297645a7 in SwContentFrame::WouldFit_(long, SwLayoutFrame*, 
bool, bool) core-asan/sw/source/core/layout/calcmove.cxx:2192
        #10 0x7b2929756a65 in SwContentFrame::ShouldBwdMoved(SwLayoutFrame*, 
bool&) core-asan/sw/source/core/layout/calcmove.cxx:199
        #11 0x7b292979f8bd in SwFlowFrame::MoveBwd(bool&) 
core-asan/sw/source/core/layout/flowfrm.cxx:2669
        #12 0x7b2929761592 in SwContentFrame::MakeAll(OutputDevice*) 
core-asan/sw/source/core/layout/calcmove.cxx:1654
        #13 0x7b29297578e2 in SwFrame::PrepareMake(OutputDevice*) 
core-asan/sw/source/core/layout/calcmove.cxx:396
        #14 0x7b2929a082af in SwFrame::Calc(OutputDevice*) const 
core-asan/sw/source/core/layout/trvlfrm.cxx:1858
        #15 0x7b29298c2bd0 in lcl_FormatContentOfLayoutFrame 
core-asan/sw/source/core/layout/objectformattertxtfrm.cxx:688
        #16 0x7b29298c2b26 in lcl_FormatContentOfLayoutFrame 
core-asan/sw/source/core/layout/objectformattertxtfrm.cxx:684
        #17 0x7b29298c2b26 in lcl_FormatContentOfLayoutFrame 
core-asan/sw/source/core/layout/objectformattertxtfrm.cxx:684
        #18 0x7b29298c33a4 in 
SwObjectFormatterTextFrame::FormatAnchorFrameAndItsPrevs(SwTextFrame&) 
core-asan/sw/source/core/layout/objectformattertxtfrm.cxx:774
        #19 0x7b29297c06dd in SwFlyAtContentFrame::MakeAll(OutputDevice*) 
core-asan/sw/source/core/layout/flycnt.cxx:440
        #20 0x7b29297578e2 in SwFrame::PrepareMake(OutputDevice*) 
core-asan/sw/source/core/layout/calcmove.cxx:396
        #21 0x7b2929a082af in SwFrame::Calc(OutputDevice*) const 
core-asan/sw/source/core/layout/trvlfrm.cxx:1858
        #22 0x7b29297bc028 in SwFlyFrame::Calc(OutputDevice*) const 
core-asan/sw/source/core/layout/fly.cxx:3436
        #23 0x7b292984693b in SwLayAction::FormatLayoutFly(SwFlyFrame*) 
core-asan/sw/source/core/layout/layact.cxx:1553
        #24 0x7b29298ba5f3 in SwObjectFormatter::FormatObj_(SwAnchoredObject&) 
core-asan/sw/source/core/layout/objectformatter.cxx:287
        #25 0x7b29298c05fb in 
SwObjectFormatterTextFrame::DoFormatObj(SwAnchoredObject&, bool) 
core-asan/sw/source/core/layout/objectformattertxtfrm.cxx:132
        #26 0x7b29298ba207 in SwObjectFormatter::FormatObj(SwAnchoredObject&, 
SwFrame*, SwPageFrame const*, SwLayAction*) 
core-asan/sw/source/core/layout/objectformatter.cxx:191
        #27 0x7b29297b0cc5 in CalcContent(SwLayoutFrame*, bool) 
core-asan/sw/source/core/layout/fly.cxx:1852
        #28 0x7b2929a2c3f0 in SwLayoutFrame::FormatWidthCols(SwBorderAttrs 
const&, long, long) core-asan/sw/source/core/layout/wsfrm.cxx:4024
        #29 0x7b292998a2b2 in SwSectionFrame::Format(OutputDevice*, 
SwBorderAttrs const*) core-asan/sw/source/core/layout/sectfrm.cxx:1563
        #30 0x7b292975d1b7 in SwLayoutFrame::MakeAll(OutputDevice*) 
core-asan/sw/source/core/layout/calcmove.cxx:1073
        #31 0x7b292998618a in SwSectionFrame::MakeAll(OutputDevice*) 
core-asan/sw/source/core/layout/sectfrm.cxx:932
        #32 0x7b29297578e2 in SwFrame::PrepareMake(OutputDevice*) 
core-asan/sw/source/core/layout/calcmove.cxx:396
        #33 0x7b2929a082af in SwFrame::Calc(OutputDevice*) const 
core-asan/sw/source/core/layout/trvlfrm.cxx:1858
        #34 0x7b2929844913 in SwLayAction::FormatLayout(OutputDevice*, 
SwLayoutFrame*, bool) core-asan/sw/source/core/layout/layact.cxx:1315
        #35 0x7b292984617e in SwLayAction::FormatLayout(OutputDevice*, 
SwLayoutFrame*, bool) core-asan/sw/source/core/layout/layact.cxx:1511
        #36 0x7b292984617e in SwLayAction::FormatLayout(OutputDevice*, 
SwLayoutFrame*, bool) core-asan/sw/source/core/layout/layact.cxx:1511
        #37 0x7b292983f951 in SwLayAction::InternalAction(OutputDevice*) 
core-asan/sw/source/core/layout/layact.cxx:629
        #38 0x7b292983d4b7 in SwLayAction::Action(OutputDevice*) 
core-asan/sw/source/core/layout/layact.cxx:404
        #39 0x7b292a7e2aad in SwViewShell::CalcLayout() 
core-asan/sw/source/core/view/viewsh.cxx:1248
        #40 0x7b2929504fd1 in SwEditShell::CalcLayout() 
core-asan/sw/source/core/edit/edws.cxx:89
        #41 0x7b292b84944f in 
SwXTextDocument::getRendererCount(com::sun::star::uno::Any const&, 
com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) 
core-asan/sw/source/uibase/uno/unotxdoc.cxx:2766
        #42 0x7b2918f8118b in PDFExport::Export(rtl::OUString const&, 
com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) 
(core-asan/instdir/program/../program/libpdffilterlo.so+0x16a18b) (BuildId: 
3e1e7d533e1cda134f16230425f07ece7cda2894)
        #43 0x7b2918fb7781 in 
PDFFilter::implExport(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue>
 const&) (core-asan/instdir/program/../program/libpdffilterlo.so+0x1a0781) 
(BuildId: 3e1e7d533e1cda134f16230425f07ece7cda2894)
        #44 0x7b2918fb8c26 in 
PDFFilter::filter(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue>
 const&) (core-asan/instdir/program/../program/libpdffilterlo.so+0x1a1c26) 
(BuildId: 3e1e7d533e1cda134f16230425f07ece7cda2894)
        #45 0x7f2966849fa0 in SfxObjectShell::ExportTo(SfxMedium&) 
(core-asan/instdir/program/libsfxlo.so+0x2649fa0) (BuildId: 
f20a99320ed1b1e19cb532dd5771162fe9df25d6)
        #46 0x7f296683c239 in SfxObjectShell::SaveTo_Impl(SfxMedium&, 
SfxItemSet const*) (core-asan/instdir/program/libsfxlo.so+0x263c239) (BuildId: 
f20a99320ed1b1e19cb532dd5771162fe9df25d6)
        #47 0x7f2966851353 in SfxObjectShell::PreDoSaveAs_Impl(rtl::OUString 
const&, rtl::OUString const&, SfxItemSet const&, 
com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) 
(core-asan/instdir/program/libsfxlo.so+0x2651353) (BuildId: 
f20a99320ed1b1e19cb532dd5771162fe9df25d6)
        #48 0x7f296684e6e2 in SfxObjectShell::CommonSaveAs_Impl(INetURLObject 
const&, rtl::OUString const&, SfxItemSet&, 
com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) 
(core-asan/instdir/program/libsfxlo.so+0x264e6e2) (BuildId: 
f20a99320ed1b1e19cb532dd5771162fe9df25d6)
        #49 0x7f29667f24ab in 
SfxObjectShell::APISaveAs_Impl(std::basic_string_view<char16_t, 
std::char_traits<char16_t> >, SfxItemSet&, 
com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) 
(core-asan/instdir/program/libsfxlo.so+0x25f24ab) (BuildId: 
f20a99320ed1b1e19cb532dd5771162fe9df25d6)
        #50 0x7f29669353f9 in SfxBaseModel::impl_store(rtl::OUString const&, 
com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, 
bool) (core-asan/instdir/program/libsfxlo.so+0x27353f9) (BuildId: 
f20a99320ed1b1e19cb532dd5771162fe9df25d6)
        #51 0x7f29669237ad in SfxBaseModel::storeToURL(rtl::OUString const&, 
com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) 
(core-asan/instdir/program/libsfxlo.so+0x27237ad) (BuildId: 
f20a99320ed1b1e19cb532dd5771162fe9df25d6)
        #52 0x7f296e59ea3d in 
desktop::DispatchWatcher::executeDispatchRequests(std::__debug::vector<desktop::DispatchWatcher::DispatchRequest,
 std::allocator<desktop::DispatchWatcher::DispatchRequest> > const&, bool, 
desktop::DispatchRequestFlags*) 
(core-asan/instdir/program/libsofficeapp.so+0x39ea3d) (BuildId: 
0d1c41096bed89bed335fa78947804c0924ce8ea)
        #53 0x7f296e5d9fae in 
desktop::RequestHandler::ExecuteCmdLineRequests(desktop::ProcessDocumentsRequest&,
 bool) (core-asan/instdir/program/libsofficeapp.so+0x3d9fae) (BuildId: 
0d1c41096bed89bed335fa78947804c0924ce8ea)
        #54 0x7f296e503193 in desktop::Desktop::OpenClients() 
(core-asan/instdir/program/libsofficeapp.so+0x303193) (BuildId: 
0d1c41096bed89bed335fa78947804c0924ce8ea)
        #55 0x7f296e50005c in desktop::Desktop::OpenClients_Impl(void*) 
(core-asan/instdir/program/libsofficeapp.so+0x30005c) (BuildId: 
0d1c41096bed89bed335fa78947804c0924ce8ea)
        #56 0x7f296e4ffc16 in desktop::Desktop::LinkStubOpenClients_Impl(void*, 
void*) (core-asan/instdir/program/libsofficeapp.so+0x2ffc16) (BuildId: 
0d1c41096bed89bed335fa78947804c0924ce8ea)
        #57 0x7f29552e3410 in Link<void*, void>::Call(void*) const 
(core-asan/instdir/program/libvcllo.so+0x42e3410) (BuildId: 
3cd155f3c9851c1c62b4d2b1959b9b1e4664c2fb)
        #58 0x7f29552db964 in ImplHandleUserEvent(ImplSVEvent*) 
(core-asan/instdir/program/libvcllo.so+0x42db964) (BuildId: 
3cd155f3c9851c1c62b4d2b1959b9b1e4664c2fb)
        #59 0x7f29552e0e3b in ImplWindowFrameProc(vcl::Window*, SalEvent, void 
const*) (core-asan/instdir/program/libvcllo.so+0x42e0e3b) (BuildId: 
3cd155f3c9851c1c62b4d2b1959b9b1e4664c2fb)
        #60 0x7f2956b44430 in SalFrame::CallCallback(SalEvent, void const*) 
const (core-asan/instdir/program/libvcllo.so+0x5b44430) (BuildId: 
3cd155f3c9851c1c62b4d2b1959b9b1e4664c2fb)
        #61 0x7f2956b8d114 in 
SvpSalInstance::ProcessEvent(SalUserEventList::SalUserEvent) 
(core-asan/instdir/program/libvcllo.so+0x5b8d114) (BuildId: 
3cd155f3c9851c1c62b4d2b1959b9b1e4664c2fb)
        #62 0x7f2955efea9f in 
SalUserEventList::DispatchUserEvents(bool)::{lambda()#1}::operator()() const 
(core-asan/instdir/program/libvcllo.so+0x4efea9f) (BuildId: 
3cd155f3c9851c1c62b4d2b1959b9b1e4664c2fb)
        #63 0x7f2955eff104 in SalUserEventList::DispatchUserEvents(bool) 
(core-asan/instdir/program/libvcllo.so+0x4eff104) (BuildId: 
3cd155f3c9851c1c62b4d2b1959b9b1e4664c2fb)
        #64 0x7f2956b8e540 in SvpSalInstance::ImplYield(bool, bool) 
(core-asan/instdir/program/libvcllo.so+0x5b8e540) (BuildId: 
3cd155f3c9851c1c62b4d2b1959b9b1e4664c2fb)
        #65 0x7f2956b8edd2 in SvpSalInstance::DoYield(bool, bool) 
(core-asan/instdir/program/libvcllo.so+0x5b8edd2) (BuildId: 
3cd155f3c9851c1c62b4d2b1959b9b1e4664c2fb)
        #66 0x7f2956096112 in ImplYield(bool, bool) 
(core-asan/instdir/program/libvcllo.so+0x5096112) (BuildId: 
3cd155f3c9851c1c62b4d2b1959b9b1e4664c2fb)
        #67 0x7f2956097f83 in Application::Yield() 
(core-asan/instdir/program/libvcllo.so+0x5097f83) (BuildId: 
3cd155f3c9851c1c62b4d2b1959b9b1e4664c2fb)
        #68 0x7f29560953b0 in Application::Execute() 
(core-asan/instdir/program/libvcllo.so+0x50953b0) (BuildId: 
3cd155f3c9851c1c62b4d2b1959b9b1e4664c2fb)
        #69 0x7f296e4fc9e9 in desktop::Desktop::Main() 
(core-asan/instdir/program/libsofficeapp.so+0x2fc9e9) (BuildId: 
0d1c41096bed89bed335fa78947804c0924ce8ea)
        #70 0x7f29560eb3c7 in ImplSVMain() 
(core-asan/instdir/program/libvcllo.so+0x50eb3c7) (BuildId: 
3cd155f3c9851c1c62b4d2b1959b9b1e4664c2fb)
        #71 0x7f29560eb590 in SVMain() 
(core-asan/instdir/program/libvcllo.so+0x50eb590) (BuildId: 
3cd155f3c9851c1c62b4d2b1959b9b1e4664c2fb)
        #72 0x7f296e5ee383 in soffice_main 
(core-asan/instdir/program/libsofficeapp.so+0x3ee383) (BuildId: 
0d1c41096bed89bed335fa78947804c0924ce8ea)
        #73 0x000000201cc6 in sal_main 
(core-asan/instdir/program/soffice.bin+0x201cc6) (BuildId: 
1edea05beb4bcc822dadbcc6f2b2a28fa5ad215b)
        #74 0x000000201cac in main 
(core-asan/instdir/program/soffice.bin+0x201cac) (BuildId: 
1edea05beb4bcc822dadbcc6f2b2a28fa5ad215b)
        #75 0x7f296e011574 in __libc_start_call_main (/lib64/libc.so.6+0x3574) 
(BuildId: 48c4b9b1efb1df15da8e787f489128bf31893317)
        #76 0x7f296e011627 in __libc_start_main@GLIBC_2.2.5 
(/lib64/libc.so.6+0x3627) (BuildId: 48c4b9b1efb1df15da8e787f489128bf31893317)
        #77 0x000000201b64 in _start 
(core-asan/instdir/program/soffice.bin+0x201b64) (BuildId: 
1edea05beb4bcc822dadbcc6f2b2a28fa5ad215b)
    
    0x7c994604b938 is located 56 bytes inside of 696-byte region 
[0x7c994604b900,0x7c994604bbb8)
    freed by thread T0 here:
        #0 0x7f296eae899b in operator delete(void*, unsigned long) 
(/lib64/libasan.so.8+0xe899b) (BuildId: 
0adabddcb77130fc2ea3840d060eb4e8a9ae0c85)
        #1 0x7b2929df5401 in 
std::__new_allocator<std::_Sp_counted_ptr_inplace<SwParaPortion, 
std::allocator<void>, (__gnu_cxx::_Lock_policy)2> 
>::deallocate(std::_Sp_counted_ptr_inplace<SwParaPortion, std::allocator<void>, 
(__gnu_cxx::_Lock_policy)2>*, unsigned long) 
/usr/include/c++/15/bits/new_allocator.h:172
        #2 0x7b2929df4edb in 
std::allocator<std::_Sp_counted_ptr_inplace<SwParaPortion, 
std::allocator<void>, (__gnu_cxx::_Lock_policy)2> 
>::deallocate(std::_Sp_counted_ptr_inplace<SwParaPortion, std::allocator<void>, 
(__gnu_cxx::_Lock_policy)2>*, unsigned long) 
/usr/include/c++/15/bits/allocator.h:215
        #3 0x7b2929df4edb in 
std::allocator_traits<std::allocator<std::_Sp_counted_ptr_inplace<SwParaPortion,
 std::allocator<void>, (__gnu_cxx::_Lock_policy)2> > 
>::deallocate(std::allocator<std::_Sp_counted_ptr_inplace<SwParaPortion, 
std::allocator<void>, (__gnu_cxx::_Lock_policy)2> >&, 
std::_Sp_counted_ptr_inplace<SwParaPortion, std::allocator<void>, 
(__gnu_cxx::_Lock_policy)2>*, unsigned long) 
/usr/include/c++/15/bits/alloc_traits.h:649
        #4 0x7b2929df4edb in 
std::__allocated_ptr<std::allocator<std::_Sp_counted_ptr_inplace<SwParaPortion, 
std::allocator<void>, (__gnu_cxx::_Lock_policy)2> > >::~__allocated_ptr() 
/usr/include/c++/15/bits/allocated_ptr.h:74
        #5 0x7b2929df5647 in std::_Sp_counted_ptr_inplace<SwParaPortion, 
std::allocator<void>, (__gnu_cxx::_Lock_policy)2>::_M_destroy() 
/usr/include/c++/15/bits/shared_ptr_base.h:625
        #6 0x7b29283b09bd in 
std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release() 
/usr/include/c++/15/bits/shared_ptr_base.h:346
        #7 0x7b29283b4dd1 in 
std::__shared_count<(__gnu_cxx::_Lock_policy)2>::~__shared_count() 
/usr/include/c++/15/bits/shared_ptr_base.h:1069
        #8 0x7b2929c05619 in std::__shared_ptr<SwParaPortion, 
(__gnu_cxx::_Lock_policy)2>::~__shared_ptr() 
/usr/include/c++/15/bits/shared_ptr_base.h:1531
        #9 0x7b2929df424e in std::__shared_ptr<SwParaPortion, 
(__gnu_cxx::_Lock_policy)2>::reset() 
/usr/include/c++/15/bits/shared_ptr_base.h:1649
        #10 0x7b2929df3f4f in SwTextFrame::ClearPara() 
core-asan/sw/source/core/text/txtcache.cxx:41
        #11 0x7b2929e2d129 in SwTextFrame::Init() 
core-asan/sw/source/core/text/txtfrm.cxx:754
        #12 0x7b2929e45d75 in SwTextFrame::Prepare(PrepareHint, void const*, 
bool) core-asan/sw/source/core/text/txtfrm.cxx:3358
        #13 0x7b29297e0987 in 
SwFlyInContentFrame::NotifyBackground(SwPageFrame*, SwRect const&, PrepareHint) 
core-asan/sw/source/core/layout/flyincnt.cxx:230
        #14 0x7b2929805046 in Notify(SwFlyFrame*, SwPageFrame*, SwRect const&, 
SwRect const*) core-asan/sw/source/core/layout/frmtool.cxx:3301
        #15 0x7b29297f0a5a in SwFlyNotify::ImplDestroy() 
core-asan/sw/source/core/layout/frmtool.cxx:696
        #16 0x7b29297f1083 in SwFlyNotify::~SwFlyNotify() 
core-asan/sw/source/core/layout/frmtool.cxx:798
        #17 0x7b29297e11f0 in SwFlyInContentFrame::MakeAll(OutputDevice*) 
core-asan/sw/source/core/layout/flyincnt.cxx:316
        #18 0x7b29297578e2 in SwFrame::PrepareMake(OutputDevice*) 
core-asan/sw/source/core/layout/calcmove.cxx:396
        #19 0x7b2929a082af in SwFrame::Calc(OutputDevice*) const 
core-asan/sw/source/core/layout/trvlfrm.cxx:1858
        #20 0x7b29297bc028 in SwFlyFrame::Calc(OutputDevice*) const 
core-asan/sw/source/core/layout/fly.cxx:3436
        #21 0x7b29297e09cf in SwFlyInContentFrame::GetRelPos() const 
core-asan/sw/source/core/layout/flyincnt.cxx:235
        #22 0x7b2929cd7309 in 
SwTextFormatter::NewFlyCntPortion(SwTextFormatInfo&, SwTextAttr*) const 
core-asan/sw/source/core/text/itrform2.cxx:3213
        #23 0x7b2929e02267 in 
SwTextFormatter::NewExtraPortion(SwTextFormatInfo&) 
core-asan/sw/source/core/text/txtfld.cxx:285
        #24 0x7b2929cccd9d in SwTextFormatter::NewPortion(SwTextFormatInfo&, 
std::optional<o3tl::strong_int<int, Tag_TextFrameIndex> >) 
core-asan/sw/source/core/text/itrform2.cxx:1886
        #25 0x7b2929cbf0a3 in SwTextFormatter::BuildPortions(SwTextFormatInfo&) 
core-asan/sw/source/core/text/itrform2.cxx:440
        #26 0x7b2929ccec48 in SwTextFormatter::FormatLine(o3tl::strong_int<int, 
Tag_TextFrameIndex>) core-asan/sw/source/core/text/itrform2.cxx:2102
        #27 0x7b2929c10fac in SwTextFrame::FormatLine(SwTextFormatter&, bool) 
core-asan/sw/source/core/text/frmform.cxx:1458
        #28 0x7b2929c14223 in SwTextFrame::Format_(SwTextFormatter&, 
SwTextFormatInfo&, bool) core-asan/sw/source/core/text/frmform.cxx:1822
        #29 0x7b2929e4755c in SwTestFormat::SwTestFormat(SwTextFrame*, SwFrame 
const*, long) core-asan/sw/source/core/text/txtfrm.cxx:3453
        #30 0x7b2929e47e1d in SwTextFrame::TestFormat(SwFrame const*, long&, 
bool&) core-asan/sw/source/core/text/txtfrm.cxx:3483
        #31 0x7b29297645a7 in SwContentFrame::WouldFit_(long, SwLayoutFrame*, 
bool, bool) core-asan/sw/source/core/layout/calcmove.cxx:2192
    
    Change-Id: I291348ddbaaf0e9e8255e2fca5842dc2d2bfe733
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196426
    Reviewed-by: Caolán McNamara <[email protected]>
    Tested-by: Jenkins
    Signed-off-by: Xisco Fauli <[email protected]>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196558

diff --git a/sw/source/core/text/itrform2.cxx b/sw/source/core/text/itrform2.cxx
index 8bcc6bf64959..551c52ad4564 100644
--- a/sw/source/core/text/itrform2.cxx
+++ b/sw/source/core/text/itrform2.cxx
@@ -3208,9 +3208,13 @@ SwFlyCntPortion *SwTextFormatter::NewFlyCntPortion( 
SwTextFormatInfo &rInf,
                                       pFly->GetRefPoint().Y() );
 
     if ( bUseFlyAscent )
-         nAscent = std::abs( int( bTextFrameVertical ?
+    {
+        // Lock m_pFrame to avoid m_pCurr getting deleted
+        TextFrameLockGuard aGuard(m_pFrame);
+        nAscent = std::abs( int( bTextFrameVertical ?
                                                   pFly->GetRelPos().X() :
                                                   pFly->GetRelPos().Y() ) );
+    }
 
     // Check if be prefer to use the ascent of the last portion:
     if ( IsQuick() ||
commit 56dee99cd603cec628e7ec3577a3f95d316e8ae0
Author:     Caolán McNamara <[email protected]>
AuthorDate: Fri Jan 2 20:31:22 2026 +0000
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jan 10 14:02:36 2026 +0100

    crashtesting: assert on loading docx converted from forum-mso-de-134677.doc
    
     #21 0x00007f64a908b9ca in SwDoc::GetTOXBaseAttrSet(SwTOXBase const&) 
(rTOXBase=...) at core/sw/source/core/doc/doctxm.cxx:496
     #22 0x00007f64a95deabc in SwXDocumentIndex::getPropertyValue(rtl::OUString 
const&) (this=0x7f648c268590, rPropertyName="TextColumns") at 
core/sw/source/core/unocore/unoidx.cxx:1198
     #23 0x00007f6498d3fb5d in 
writerfilter::dmapper::DomainMapper_Impl::handleIndex(tools::SvRef<writerfilter::dmapper::FieldContext>
 const&, rtl::OUString const&) (this=this@entry=0x7f648c00ede0, pContext=..., 
sTOCServiceName="com.sun.star.text.DocumentIndex") at 
core/sw/source/writerfilter/dmapper/DomainMapper_Impl.cxx:7833
    
    Change-Id: I81e9eee18b7acd5d8eddeaf16c6c0800deec7300
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196434
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <[email protected]>
    Signed-off-by: Xisco Fauli <[email protected]>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196557

diff --git a/sw/inc/doc.hxx b/sw/inc/doc.hxx
index aaaccc335651..07cc168fad7f 100644
--- a/sw/inc/doc.hxx
+++ b/sw/inc/doc.hxx
@@ -957,7 +957,7 @@ public:
                                             const SwTOXBase& rTOX,
                                             const SfxItemSet* pSet );
     SW_DLLPUBLIC static SwTOXBase* GetCurTOX( const SwPosition& rPos );
-    static const SwAttrSet& GetTOXBaseAttrSet(const SwTOXBase& rTOX);
+    static const SwAttrSet* GetTOXBaseAttrSet(const SwTOXBase& rTOX);
 
     bool DeleteTOX( const SwTOXBase& rTOXBase, bool bDelNodes );
     OUString GetUniqueTOXBaseName( const SwTOXType& rType,
diff --git a/sw/source/core/doc/doctxm.cxx b/sw/source/core/doc/doctxm.cxx
index 1c050d30f2ea..ee99815fa7ac 100644
--- a/sw/source/core/doc/doctxm.cxx
+++ b/sw/source/core/doc/doctxm.cxx
@@ -491,13 +491,17 @@ SwTOXBase* SwDoc::GetCurTOX( const SwPosition& rPos )
     return nullptr;
 }
 
-const SwAttrSet& SwDoc::GetTOXBaseAttrSet(const SwTOXBase& rTOXBase)
+const SwAttrSet* SwDoc::GetTOXBaseAttrSet(const SwTOXBase& rTOXBase)
 {
-    assert( dynamic_cast<const SwTOXBaseSection*>( &rTOXBase) && "no 
TOXBaseSection!" );
-    const SwTOXBaseSection& rTOXSect = static_cast<const 
SwTOXBaseSection&>(rTOXBase);
-    SwSectionFormat const * pFormat = rTOXSect.GetFormat();
+    const SwTOXBaseSection* pTOXSect = dynamic_cast<const 
SwTOXBaseSection*>(&rTOXBase);
+    if (!pTOXSect)
+    {
+        SAL_WARN("sw", "TOXBase is not a SwTOXBaseSection");
+        return nullptr;
+    }
+    SwSectionFormat const * pFormat = pTOXSect->GetFormat();
     assert(pFormat && "invalid TOXBaseSection!");
-    return pFormat->GetAttrSet();
+    return &pFormat->GetAttrSet();
 }
 
 const SwTOXBase* SwDoc::GetDefaultTOXBase( TOXTypes eTyp, bool bCreate )
diff --git a/sw/source/core/unocore/unoidx.cxx 
b/sw/source/core/unocore/unoidx.cxx
index c30f1aad145c..32360d331a36 100644
--- a/sw/source/core/unocore/unoidx.cxx
+++ b/sw/source/core/unocore/unoidx.cxx
@@ -828,9 +828,9 @@ SwXDocumentIndex::setPropertyValue(
             //this is for items only
             if (WID_PRIMARY_KEY > pEntry->nWID)
             {
-                const SwAttrSet& rSet =
+                const SwAttrSet* pSet =
                     SwDoc::GetTOXBaseAttrSet(rTOXBase);
-                SfxItemSet aAttrSet(rSet);
+                SfxItemSet aAttrSet(*pSet);
                 m_pImpl->m_rPropSet.setPropertyValue(
                         rPropertyName, rValue, aAttrSet);
 
@@ -1195,10 +1195,11 @@ SwXDocumentIndex::getPropertyValue(const OUString& 
rPropertyName)
                 //this is for items only
                 if(WID_PRIMARY_KEY > pEntry->nWID)
                 {
-                    const SwAttrSet& rSet =
-                        SwDoc::GetTOXBaseAttrSet(*pTOXBase);
-                    aRet = m_pImpl->m_rPropSet.getPropertyValue(
-                            rPropertyName, rSet);
+                    if (const SwAttrSet* pSet = 
SwDoc::GetTOXBaseAttrSet(*pTOXBase))
+                    {
+                        aRet = m_pImpl->m_rPropSet.getPropertyValue(
+                                rPropertyName, *pSet);
+                    }
                 }
         }
     }
commit cc60cd1017bc7c7500f25306dd9e3765bf4ef0ab
Author:     Xisco Fauli <[email protected]>
AuthorDate: Fri Jan 2 11:13:27 2026 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jan 10 14:02:35 2026 +0100

    fast_float: upgrade to 8.2.2
    
    Downloaded from 
https://github.com/fastfloat/fast_float/archive/refs/tags/v8.2.2.tar.gz
    
    Change-Id: I498ed7621524d79345236367ef90eea28f9ae120
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196415
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <[email protected]>
    Signed-off-by: Xisco Fauli <[email protected]>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196432

diff --git a/download.lst b/download.lst
index c0f7e8167527..0d80e9868519 100644
--- a/download.lst
+++ b/download.lst
@@ -60,8 +60,8 @@ DRAGONBOX_TARBALL := dragonbox-1.1.3.tar.gz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-FAST_FLOAT_SHA256SUM := 
4bfabb5979716995090ce68dce83f88f99629bc17ae280eae79311c5340143e1
-FAST_FLOAT_TARBALL := fast_float-8.1.0.tar.gz
+FAST_FLOAT_SHA256SUM := 
e64b5fff88e04959154adbd5fb83331d91f2e04ac06454671cdfcbdff172b158
+FAST_FLOAT_TARBALL := fast_float-8.2.2.tar.gz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
commit 4050ea3abf99ff75e0853b8aee655e4c39f4781b
Author:     Caolán McNamara <[email protected]>
AuthorDate: Sat Jan 3 11:12:22 2026 +0000
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jan 10 14:02:35 2026 +0100

    ofz#473050752 Integer-overflow
    
    Change-Id: I1b6ea0fcd434e91e63ce84ccbc46bc96f713216c
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196444
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <[email protected]>
    (cherry picked from commit e47f1192feacf6f1bf34e0c3a1303e034a0de7dc)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196560
    Reviewed-by: Xisco Fauli <[email protected]>

diff --git a/vcl/source/gdi/metaact.cxx b/vcl/source/gdi/metaact.cxx
index d5cee4f5f302..e726410cd269 100644
--- a/vcl/source/gdi/metaact.cxx
+++ b/vcl/source/gdi/metaact.cxx
@@ -315,6 +315,9 @@ MetaEllipseAction::MetaEllipseAction( const 
tools::Rectangle& rRect ) :
 
 void MetaEllipseAction::Execute( OutputDevice* pOut )
 {
+    if (!AllowRect(pOut->LogicToPixel(maRect)))
+        return;
+
     pOut->DrawEllipse( maRect );
 }
 
commit 42d593eceaadf994bd503e59ccf73467eefc5290
Author:     Justin Luth <[email protected]>
AuthorDate: Mon Jan 5 16:08:42 2026 -0500
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jan 10 14:02:35 2026 +0100

    tdf#166945 Revert "tdf#111969 sw: ... last half-character for context menu"
    
    This reverts 24.8 commit 242f6985556af7aac77b68c6dfea20d4b32c5f52.
    The problem is that the context menu simply cannot know
    which choice the user will choose.
    Some actions DEPEND on the cursor being 'closest to the mouse point'
    and some actions DEPEND on the cursor being
    'inside the character run properties or field'.
    
    That 'mouse point at right click' is completely lost
    as soon as the mouse moves to chose something from the context menu,
    so it is not available to be re-used by SID_PASTE etc
    to re-position the cursor before executing the paste.
    
    The benefits of the now-being-reverted-patch do not
    dwarf the already-discovered-downsides,
    so I'm just reverting to extract myself from this situation.
    
    Change-Id: I03943cf899e1d18fb3e736d4cccea159abe7332e
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196586
    Reviewed-by: Justin Luth <[email protected]>
    Tested-by: Jenkins
    (cherry picked from commit f656be88a35e1d4e51ddf131f1454acac4f03739)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196685

diff --git a/sw/qa/extras/uiwriter/uiwriter9.cxx 
b/sw/qa/extras/uiwriter/uiwriter9.cxx
index 79f707aff78e..b6ab384433b9 100644
--- a/sw/qa/extras/uiwriter/uiwriter9.cxx
+++ b/sw/qa/extras/uiwriter/uiwriter9.cxx
@@ -758,7 +758,7 @@ CPPUNIT_TEST_FIXTURE(SwUiWriterTest9, testTdf111969B)
     // the test: simulate a right-click of a mouse (at the end-edge of the 
second N-dash)
     // which sets the cursor and then acts on that pos.
     pWrtShell->SwCursorShell::SetCursor(aLogicL, false, /*Block=*/false, 
/*FieldInfo=*/true);
-    CPPUNIT_ASSERT(!pWrtShell->GetCurField(true));
+    //CPPUNIT_ASSERT(!pWrtShell->GetCurField(true));
 }
 
 CPPUNIT_TEST_FIXTURE(SwUiWriterTest9, testPDFExportCrash)
diff --git a/sw/source/core/crsr/crsrsh.cxx b/sw/source/core/crsr/crsrsh.cxx
index b84d6376fff1..e4ec668f68bc 100644
--- a/sw/source/core/crsr/crsrsh.cxx
+++ b/sw/source/core/crsr/crsrsh.cxx
@@ -1072,7 +1072,6 @@ int SwCursorShell::SetCursor(const Point& rLPt, bool 
bOnlyText, bool bBlock,
                                     bOnlyText ?  CursorMoveState::SetOnlyText 
: CursorMoveState::NONE );
     aTmpState.m_bSetInReadOnly = IsReadOnlyAvailable();
     aTmpState.m_bFieldInfo = bFieldInfo; // always set cursor at field-start 
if point is over field
-    aTmpState.m_bPosMatchesBounds = bFieldInfo; // always set cursor at 
character-start if over char
 
     SwTextNode const*const pTextNd = sw::GetParaPropsNode(*GetLayout(), 
pCursor->GetPoint()->GetNode());
 
commit 432ccbaceda83f158794ed8748afdfb0b73d4f3b
Author:     Heiko Tietze <[email protected]>
AuthorDate: Wed Dec 24 08:53:04 2025 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jan 10 14:02:35 2026 +0100

    Resolves tdf#170019 - Relative links in Bullets gallery
    
    * cross-red with red color
    * SVG images
    * correct Gallery
    
    Change-Id: I35c9635682344f4301b9310e1447094ad2bf0394
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196186
    Tested-by: Jenkins
    Reviewed-by: Heiko Tietze <[email protected]>
    Signed-off-by: Xisco Fauli <[email protected]>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196190

diff --git a/extras/Package_gallbullets.mk b/extras/Package_gallbullets.mk
index 9f2e9a631c23..6a8a2ae87bcd 100644
--- a/extras/Package_gallbullets.mk
+++ b/extras/Package_gallbullets.mk
@@ -10,31 +10,31 @@
 $(eval $(call 
gb_Package_Package,extras_gallbullets,$(SRCDIR)/extras/source/gallery/bullets))
 
 $(eval $(call 
gb_Package_add_files,extras_gallbullets,$(LIBO_SHARE_FOLDER)/gallery/bullets,\
-       circle.png \
-       circle-green.png \
-       triangle.png \
-       triangle-green.png \
-       pin.png \
-       pin-green.png \
-       flag.png \
-       flag-green.png \
-       stars-empty.png \
-       redo.png \
-       cross.png \
-       check.png \
-       cross.png \
-       circle-blue.png \
-       circle-yellow.png \
-       triangle-blue.png \
-       triangle-yellow.png \
-       pin-blue.png \
-       pin-yellow.png \
-       flag-blue.png \
-       flag-yellow.png \
-       undo.png \
-       stars.png \
-       info.png \
-       warning.png \
+       check.svg \
+       circle-blue.svg \
+       circle-green.svg \
+       circle-yellow.svg \
+       circle.svg \
+       cross-red.svg \
+       cross.svg \
+       flag-blue.svg \
+       flag-green.svg \
+       flag-yellow.svg \
+       flag.svg \
+       info.svg \
+       pin-blue.svg \
+       pin-green.svg \
+       pin-yellow.svg \
+       pin.svg \
+       redo.svg \
+       stars-empty.svg \
+       stars.svg \
+       triangle-blue.svg \
+       triangle-green.svg \
+       triangle-yellow.svg \
+       triangle.svg \
+       undo.svg \
+       warning.svg \
 ))
 
 # vim: set noet sw=4 ts=4:
diff --git a/extras/source/gallery/bullets/cross-red.png 
b/extras/source/gallery/bullets/cross-red.png
index 4be7f0f9fcf4..9fe9367cc13b 100644
Binary files a/extras/source/gallery/bullets/cross-red.png and 
b/extras/source/gallery/bullets/cross-red.png differ
diff --git a/extras/source/gallery/bullets/cross-red.svg 
b/extras/source/gallery/bullets/cross-red.svg
index 3f23db4fd10c..dc38fe79b33b 100644
--- a/extras/source/gallery/bullets/cross-red.svg
+++ b/extras/source/gallery/bullets/cross-red.svg
@@ -1,5 +1,39 @@
-<svg height="16" width="16" xmlns="http://www.w3.org/2000/svg"; 
xmlns:xlink="http://www.w3.org/1999/xlink";>
-  <defs>
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg
+   height="16"
+   width="16"
+   version="1.1"
+   id="svg1"
+   sodipodi:docname="cross-red.svg"
+   inkscape:export-filename="cross-red.png"
+   inkscape:export-xdpi="96"
+   inkscape:export-ydpi="96"
+   inkscape:version="1.4.2 (ebf0e940d0, 2025-05-08)"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape";
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd";
+   xmlns:xlink="http://www.w3.org/1999/xlink";
+   xmlns="http://www.w3.org/2000/svg";
+   xmlns:svg="http://www.w3.org/2000/svg";>
+  <sodipodi:namedview
+     id="namedview1"
+     pagecolor="#505050"
+     bordercolor="#ffffff"
+     borderopacity="1"
+     inkscape:showpageshadow="0"
+     inkscape:pageopacity="0"
+     inkscape:pagecheckerboard="1"
+     inkscape:deskcolor="#505050"
+     inkscape:zoom="8.2306545"
+     inkscape:cx="-21.261979"
+     inkscape:cy="7.7758093"
+     inkscape:window-width="1717"
+     inkscape:window-height="1236"
+     inkscape:window-x="619"
+     inkscape:window-y="40"
+     inkscape:window-maximized="0"
+     inkscape:current-layer="svg1" />
+  <defs
+     id="defs1">
     <linearGradient
        id="a"
        gradientUnits="userSpaceOnUse"
@@ -67,11 +101,11 @@
      d="M 11.748632,11.217381 10.688359,12.277654 4.3267177,5.9160136 
5.3869911,4.85574 Z"
      id="path19" />
   <path
-     style="fill:#ffffff;stroke-width:0.7"
+     style="fill:#ff0000;stroke-width:0.7;fill-opacity:1"
      d="M 10.650683,4.2890427 11.710956,5.3493162 5.3493159,11.710957 
4.2890423,10.650683 Z"
      id="path21" />
   <path
-     style="fill:#ffffff;stroke-width:0.7"
+     style="fill:#ff0000;stroke-width:0.7;fill-opacity:1"
      d="M 11.710956,10.650683 10.650683,11.710957 4.2890423,5.3493162 
5.3493159,4.2890427 Z"
      id="path23" />
 </svg>
diff --git a/extras/source/gallery/gallery_system/bullets.sdg 
b/extras/source/gallery/gallery_system/bullets.sdg
index 4f699c06bad6..6c7f58be7a1e 100644
Binary files a/extras/source/gallery/gallery_system/bullets.sdg and 
b/extras/source/gallery/gallery_system/bullets.sdg differ
diff --git a/extras/source/gallery/gallery_system/bullets.thm 
b/extras/source/gallery/gallery_system/bullets.thm
index c20af3e4fa56..ed74a8da1208 100644
Binary files a/extras/source/gallery/gallery_system/bullets.thm and 
b/extras/source/gallery/gallery_system/bullets.thm differ
commit ccabbb5133328e8152620938b99b2827d0d748a5
Author:     Xisco Fauli <[email protected]>
AuthorDate: Wed Jan 7 10:06:51 2026 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jan 10 14:02:34 2026 +0100

    Revert "Revert "Resolves tdf#170019 - Relative links in Bullets gallery""
    
    This reverts commit 10b92128a330412694c67c62e93fa606813605fa.
    
    Change-Id: Ie5c8d34aebb1ca68adc4ce59aeccb1c86441781b
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196659
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <[email protected]>

diff --git a/extras/Package_gallbullets.mk b/extras/Package_gallbullets.mk
index 9b9b8e17491f..9f2e9a631c23 100644
--- a/extras/Package_gallbullets.mk
+++ b/extras/Package_gallbullets.mk
@@ -10,31 +10,31 @@
 $(eval $(call 
gb_Package_Package,extras_gallbullets,$(SRCDIR)/extras/source/gallery/bullets))
 
 $(eval $(call 
gb_Package_add_files,extras_gallbullets,$(LIBO_SHARE_FOLDER)/gallery/bullets,\
-       circle.svg \
-       circle-green.svg \
-       triangle.svg \
-       triangle-green.svg \
-       pin.svg \
-       pin-green.svg \
-       flag.svg \
-       flag-green.svg \
-       stars-empty.svg \
-       redo.svg \
-       cross.svg \
-       check.svg \
-       cross.svg \
-       circle-blue.svg \
-       circle-yellow.svg \
-       triangle-blue.svg \
-       triangle-yellow.svg \
-       pin-blue.svg \
-       pin-yellow.svg \
-       flag-blue.svg \
-       flag-yellow.svg \
-       undo.svg \
-       stars.svg \
-       info.svg \
-       warning.svg \
+       circle.png \
+       circle-green.png \
+       triangle.png \
+       triangle-green.png \
+       pin.png \
+       pin-green.png \
+       flag.png \
+       flag-green.png \
+       stars-empty.png \
+       redo.png \
+       cross.png \
+       check.png \
+       cross.png \
+       circle-blue.png \
+       circle-yellow.png \
+       triangle-blue.png \
+       triangle-yellow.png \
+       pin-blue.png \
+       pin-yellow.png \
+       flag-blue.png \
+       flag-yellow.png \
+       undo.png \
+       stars.png \
+       info.png \
+       warning.png \
 ))
 
 # vim: set noet sw=4 ts=4:
diff --git a/extras/source/gallery/gallery_system/bullets.sdg 
b/extras/source/gallery/gallery_system/bullets.sdg
index 5933048e4df7..4f699c06bad6 100644
Binary files a/extras/source/gallery/gallery_system/bullets.sdg and 
b/extras/source/gallery/gallery_system/bullets.sdg differ
diff --git a/extras/source/gallery/gallery_system/bullets.thm 
b/extras/source/gallery/gallery_system/bullets.thm
index 78240bd17731..c20af3e4fa56 100644
Binary files a/extras/source/gallery/gallery_system/bullets.thm and 
b/extras/source/gallery/gallery_system/bullets.thm differ
commit 32202d28fc46b546e5d83ee541b1a804ec31bba9
Author:     Noel Grandin <[email protected]>
AuthorDate: Tue Jan 6 20:03:52 2026 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jan 10 14:02:34 2026 +0100

    officeotron: w:del in wrong order
    
    under the w:rPr element, w:del needs to come before w:lang
    
    Change-Id: I0bf6ddc554c44ef978b62565d5be664af406a693
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196624
    Tested-by: Jenkins
    Reviewed-by: Noel Grandin <[email protected]>
    (cherry picked from commit 40a68f926079cbe3082cacdabffac4846f342139)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196657
    Reviewed-by: Xisco Fauli <[email protected]>

diff --git a/sw/qa/extras/ooxmlexport/ooxmlexport4.cxx 
b/sw/qa/extras/ooxmlexport/ooxmlexport4.cxx
index 00cefa910c2d..c5aeb4d1342d 100644
--- a/sw/qa/extras/ooxmlexport/ooxmlexport4.cxx
+++ b/sw/qa/extras/ooxmlexport/ooxmlexport4.cxx
@@ -106,9 +106,6 @@ CPPUNIT_TEST_FIXTURE(Test, 
testTrackChangesDeletedParagraphMark)
 {
     createSwDoc("testTrackChangesDeletedParagraphMark.docx");
 
-    //FIXME: validation error in OOXML export: Errors: 1
-    skipValidation();
-
     save(TestFilter::DOCX);
     xmlDocUniquePtr pXmlDoc = parseExport(u"word/document.xml"_ustr);
     assertXPath(pXmlDoc, "/w:document/w:body/w:p[1]/w:pPr/w:rPr/w:del");
@@ -118,9 +115,6 @@ CPPUNIT_TEST_FIXTURE(Test, 
testTrackChangesInsertedParagraphMark)
 {
     createSwDoc("testTrackChangesInsertedParagraphMark.docx");
 
-    //FIXME: validation error in OOXML export: Errors: 1
-    skipValidation();
-
     save(TestFilter::DOCX);
     xmlDocUniquePtr pXmlDoc = parseExport(u"word/document.xml"_ustr);
     assertXPath(pXmlDoc, "/w:document/w:body/w:p[1]/w:pPr/w:rPr/w:ins");
@@ -146,9 +140,6 @@ CPPUNIT_TEST_FIXTURE(Test, testTrackChangesDeletedTableCell)
 {
     createSwDoc("testTrackChangesDeletedTableCell.docx");
 
-    //FIXME: validation error in OOXML export: Errors: 1
-    skipValidation();
-
     save(TestFilter::DOCX);
     xmlDocUniquePtr pXmlDoc = parseExport(u"word/document.xml"_ustr);
     assertXPath(pXmlDoc, 
"/w:document/w:body/w:tbl/w:tr[3]/w:tc/w:tcPr/w:cellDel");
@@ -158,9 +149,6 @@ CPPUNIT_TEST_FIXTURE(Test, 
testTrackChangesInsertedTableCell)
 {
     createSwDoc("testTrackChangesInsertedTableCell.docx");
 
-    //FIXME: validation error in OOXML export: Errors: 1
-    skipValidation();
-
     save(TestFilter::DOCX);
     xmlDocUniquePtr pXmlDoc = parseExport(u"word/document.xml"_ustr);
     assertXPath(pXmlDoc, 
"/w:document/w:body/w:tbl/w:tr[3]/w:tc/w:tcPr/w:cellIns");
@@ -185,9 +173,6 @@ CPPUNIT_TEST_FIXTURE(Test, testFDO73034)
 {
     createSwDoc("FDO73034.docx");
 
-    //FIXME: validation error in OOXML export: Errors: 1
-    skipValidation();
-
     save(TestFilter::DOCX);
     xmlDocUniquePtr pXmlDoc = parseExport(u"word/document.xml"_ustr);
     CPPUNIT_ASSERT(getXPath(pXmlDoc, 
"/w:document/w:body/w:p[1]/w:pPr/w:rPr/w:u", "val").match("single"));
diff --git a/sw/source/filter/ww8/docxattributeoutput.cxx 
b/sw/source/filter/ww8/docxattributeoutput.cxx
index cb80dddf479c..6988c75210cb 100644
--- a/sw/source/filter/ww8/docxattributeoutput.cxx
+++ b/sw/source/filter/ww8/docxattributeoutput.cxx
@@ -3366,6 +3366,10 @@ void DocxAttributeOutput::InitCollectedRunProperties()
     // Write the elements in the spec order
     static const sal_Int32 aOrder[] =
     {
+        FSNS( XML_w, XML_del ),
+        FSNS( XML_w, XML_ins ),
+        FSNS( XML_w, XML_moveFrom ),
+        FSNS( XML_w, XML_moveTo ),
         FSNS( XML_w, XML_rStyle ),
         FSNS( XML_w, XML_rFonts ),
         FSNS( XML_w, XML_b ),
@@ -3406,10 +3410,6 @@ void DocxAttributeOutput::InitCollectedRunProperties()
         FSNS( XML_w, XML_specVanish ),
         FSNS( XML_w, XML_oMath ),
         FSNS( XML_w, XML_rPrChange ),
-        FSNS( XML_w, XML_del ),
-        FSNS( XML_w, XML_ins ),
-        FSNS( XML_w, XML_moveFrom ),
-        FSNS( XML_w, XML_moveTo ),
         FSNS( XML_w14, XML_glow ),
         FSNS( XML_w14, XML_shadow ),
         FSNS( XML_w14, XML_reflection ),

Reply via email to