sw/source/uibase/utlui/navipi.cxx | 13 ++++++++----- vcl/source/app/salvtables.cxx | 2 ++ 2 files changed, 10 insertions(+), 5 deletions(-)
New commits: commit e6bf88086d798b7b7fb9bb6a9a00446fb3b8a7c7 Author: Andras Timar <[email protected]> AuthorDate: Thu Feb 26 14:46:45 2026 +0100 Commit: Miklos Vajna <[email protected]> CommitDate: Fri Feb 27 09:46:11 2026 +0100 Fix SIGSEGV in SalInstanceEntry::set_text() on disposed Edit widget Guard against calling SetText() on a disposed VCL Edit widget whose mpWindowImpl has been reset to null. This crash was observed in COOL multi-view scenarios where Navigator/QuickFind commands from multiple sessions caused the underlying VCL widget to be disposed while weld wrappers still held references to it. - Add isDisposed() check in SalInstanceEntry::set_text() - Move binding listener disposal before widget destruction in SwNavigationPI destructor to prevent NotifyItemUpdate() from firing on already-destroyed weld wrappers - Add null check on m_xGotoPageSpinButton in NotifyItemUpdate() Change-Id: Iff8d9f2d0d1a7fffdf99ddb21efb79e264bbae64 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/200434 Tested-by: Jenkins CollaboraOffice <[email protected]> Reviewed-by: Miklos Vajna <[email protected]> diff --git a/sw/source/uibase/utlui/navipi.cxx b/sw/source/uibase/utlui/navipi.cxx index 99022e66155e..11c9f50db4a7 100644 --- a/sw/source/uibase/utlui/navipi.cxx +++ b/sw/source/uibase/utlui/navipi.cxx @@ -849,6 +849,12 @@ SwNavigationPI::~SwNavigationPI() EndListening(*SfxGetpApp()); + // disconnect binding listeners before destroying widgets, so that + // NotifyItemUpdate() can't be called on already-destroyed weld wrappers + m_aDocFullName.dispose(); + m_aPageStats.dispose(); + m_aNavElement.dispose(); + if (m_oObjectShell) { if (m_oObjectShell->Is()) @@ -874,10 +880,6 @@ SwNavigationPI::~SwNavigationPI() m_xContent4ToolBox.reset(); m_xContent5ToolBox.reset(); m_xContent6ToolBox.reset(); - - m_aDocFullName.dispose(); - m_aPageStats.dispose(); - m_aNavElement.dispose(); } void SwNavigationPI::NotifyItemUpdate(sal_uInt16 nSID, SfxItemState /*eState*/, @@ -920,7 +922,8 @@ void SwNavigationPI::NotifyItemUpdate(sal_uInt16 nSID, SfxItemState /*eState*/, break; SwVisiblePageNumbers aVisiblePageNumbers; rSh.GetFirstLastVisPageNumbers(aVisiblePageNumbers, *pView); - m_xGotoPageSpinButton->set_text(OUString::number(aVisiblePageNumbers.nFirstPhy)); + if (m_xGotoPageSpinButton) + m_xGotoPageSpinButton->set_text(OUString::number(aVisiblePageNumbers.nFirstPhy)); } } } diff --git a/vcl/source/app/salvtables.cxx b/vcl/source/app/salvtables.cxx index 0b68dfc142b3..f435424ec179 100644 --- a/vcl/source/app/salvtables.cxx +++ b/vcl/source/app/salvtables.cxx @@ -3385,6 +3385,8 @@ SalInstanceEntry::SalInstanceEntry(Edit* pEntry, SalInstanceBuilder* pBuilder, b void SalInstanceEntry::set_text(const OUString& rText) { + if (m_xEntry->isDisposed()) + return; disable_notify_events(); m_xEntry->SetText(rText); enable_notify_events();
