chart2/source/controller/dialogs/TitleDialogData.cxx | 3 +++ chart2/source/controller/main/ChartController_Insert.cxx | 7 +++++-- chart2/source/tools/TitleHelper.cxx | 4 +++- 3 files changed, 11 insertions(+), 3 deletions(-)
New commits: commit 211cc446ea7eb0d7aa23d08752aed5ae605842ce Author: Andras Timar <[email protected]> AuthorDate: Mon Mar 2 10:21:59 2026 +0100 Commit: Miklos Vajna <[email protected]> CommitDate: Tue Mar 3 09:24:54 2026 +0100 Fix SIGSEGV in chart InsertTitles async callback with null model When the chart model is detached while the InsertTitles dialog is open (e.g. during LOKit collaborative editing), the async callback calls getChartModel() which returns null. This null model is passed through writeDifferenceToModel into TitleHelper::createTitle, which dereferences it at xModel->getFirstChartDiagram() causing a SIGSEGV. Add null model check in the async callback, and defensive null checks in TitleDialogData::readFromModel and TitleHelper::createTitle. Change-Id: Ic5ed4d3392da4b38385e1c37e971b2e1844a40fe Reviewed-on: https://gerrit.libreoffice.org/c/core/+/200778 Reviewed-by: Miklos Vajna <[email protected]> Tested-by: Jenkins CollaboraOffice <[email protected]> diff --git a/chart2/source/controller/dialogs/TitleDialogData.cxx b/chart2/source/controller/dialogs/TitleDialogData.cxx index 75d59bbb43b4..8d1792fb4bc1 100644 --- a/chart2/source/controller/dialogs/TitleDialogData.cxx +++ b/chart2/source/controller/dialogs/TitleDialogData.cxx @@ -39,6 +39,9 @@ TitleDialogData::TitleDialogData( std::optional<ReferenceSizeProvider> pRefSizeP void TitleDialogData::readFromModel( const rtl::Reference<::chart::ChartModel>& xChartModel ) { + if (!xChartModel) + return; + rtl::Reference< Diagram > xDiagram = xChartModel->getFirstChartDiagram(); //get possibilities diff --git a/chart2/source/controller/main/ChartController_Insert.cxx b/chart2/source/controller/main/ChartController_Insert.cxx index cf95a24180f5..ff973bce49c6 100644 --- a/chart2/source/controller/main/ChartController_Insert.cxx +++ b/chart2/source/controller/main/ChartController_Insert.cxx @@ -291,11 +291,14 @@ void ChartController::executeDispatch_InsertTitles() xUndoGuard=std::move(xUndoGuard)](int nResult){ if ( nResult == RET_OK ) { + rtl::Reference<ChartModel> xModel = getChartModel(); + if (!xModel) + return; // lock controllers till end of block - ControllerLockGuardUNO aCLGuard( getChartModel() ); + ControllerLockGuardUNO aCLGuard( xModel ); TitleDialogData aDialogOutput( impl_createReferenceSizeProvider() ); aDlg->getResult( aDialogOutput ); - bool bChanged = aDialogOutput.writeDifferenceToModel( getChartModel(), m_xCC, xDialogInput.get() ); + bool bChanged = aDialogOutput.writeDifferenceToModel( xModel, m_xCC, xDialogInput.get() ); if( bChanged ) xUndoGuard->commit(); } diff --git a/chart2/source/tools/TitleHelper.cxx b/chart2/source/tools/TitleHelper.cxx index 56d6fcbf44c1..9e5b3ff82d69 100644 --- a/chart2/source/tools/TitleHelper.cxx +++ b/chart2/source/tools/TitleHelper.cxx @@ -206,6 +206,8 @@ rtl::Reference< Title > TitleHelper::createTitle( if( !xTitled.is() ) { + if( !xModel ) + return xTitle; rtl::Reference< Diagram > xDiagram( xModel->getFirstChartDiagram() ); rtl::Reference< Axis > xAxis; switch( eTitleType ) @@ -272,7 +274,7 @@ rtl::Reference< Title > TitleHelper::createTitle( try { bool bDummy = false; - bool bIsVertical = xDiagram->getVertical( bDummy, bDummy ); + bool bIsVertical = xDiagram && xDiagram->getVertical( bDummy, bDummy ); if( (!bIsVertical && eTitleType == TitleHelper::Y_AXIS_TITLE) || (bIsVertical && eTitleType == TitleHelper::X_AXIS_TITLE)
