diff options
| author | Julien Nabet <serval2412@yahoo.fr> | 2018-01-18 08:37:04 +0100 |
|---|---|---|
| committer | Mike Kaganski <mike.kaganski@collabora.com> | 2018-01-20 07:36:47 +0100 |
| commit | daf1b10f4e266818b6e14f0f1dfddd66f0a3a2f0 (patch) | |
| tree | 7ff4c76fa7c3f51807b49a57f286a355387b6769 /sw | |
| parent | 4edc58af369244fb734d34fee027237624cca9e6 (diff) | |
tdf#115079: check that row frame belongs to table frame to avoid segfault
A row frame may not belong to a table frame, when it is being cut, e.g., in
lcl_PostprocessRowsInCells().
Its SwRowFrame::Cut() has been called; it in turn called SwLayoutFrame::Cut(),
which nullified row's upper in RemoveFromLayout(), and then called Shrink()
for its former upper.
Regardless of whether it will be pasted back, or destroyed, currently it's not
part of layout, and its height does not count.
See bt https://bugs.documentfoundation.org/attachment.cgi?id=139171
Change-Id: I4010e1f246a3ebb89b3f972a03619a2775146da4
Reviewed-on: https://gerrit.libreoffice.org/48089
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>
Diffstat (limited to 'sw')
| -rw-r--r-- | sw/qa/extras/odfimport/data/tdf115079.odt | bin | 0 -> 22717 bytes | |||
| -rw-r--r-- | sw/qa/extras/odfimport/odfimport.cxx | 5 | ||||
| -rw-r--r-- | sw/source/core/layout/tabfrm.cxx | 9 |
3 files changed, 13 insertions, 1 deletions
diff --git a/sw/qa/extras/odfimport/data/tdf115079.odt b/sw/qa/extras/odfimport/data/tdf115079.odt Binary files differnew file mode 100644 index 000000000000..6c1039e71ced --- /dev/null +++ b/sw/qa/extras/odfimport/data/tdf115079.odt diff --git a/sw/qa/extras/odfimport/odfimport.cxx b/sw/qa/extras/odfimport/odfimport.cxx index 032a4a5da574..a638dd818574 100644 --- a/sw/qa/extras/odfimport/odfimport.cxx +++ b/sw/qa/extras/odfimport/odfimport.cxx @@ -882,5 +882,10 @@ DECLARE_ODFIMPORT_TEST(testBlankBeforeFirstPage, "tdf94882.odt") ); } +DECLARE_ODFIMPORT_TEST(testTdf115079, "tdf115079.odt") +{ + // This document caused segfault when layouting +} + CPPUNIT_PLUGIN_IMPLEMENT(); /* vim:set shiftwidth=4 softtabstop=4 expandtab: */ diff --git a/sw/source/core/layout/tabfrm.cxx b/sw/source/core/layout/tabfrm.cxx index 9ff64c1aa162..f1e2e2e56fff 100644 --- a/sw/source/core/layout/tabfrm.cxx +++ b/sw/source/core/layout/tabfrm.cxx @@ -4083,7 +4083,14 @@ static SwTwips lcl_calcHeightOfRowBeforeThisFrame(const SwRowFrame& rRow) { // We've found another row frame that is part of the same table row const SwTabFrame* pCurTab = pCurRow->FindTabFrame(); - if (pCurTab->IsAnFollow(pTab)) + // A row frame may not belong to a table frame, when it is being cut, e.g., in + // lcl_PostprocessRowsInCells(). + // Its SwRowFrame::Cut() has been called; it in turn called SwLayoutFrame::Cut(), + // which nullified row's upper in RemoveFromLayout(), and then called Shrink() + // for its former upper. + // Regardless of whether it will be pasted back, or destroyed, currently it's not + // part of layout, and its height does not count + if (pCurTab && pCurTab->IsAnFollow(pTab)) { // The found row frame belongs to a table frame that precedes // (above) this one in chain. So, include it in the sum |