diff options
| author | Noel Grandin <noel.grandin@collabora.co.uk> | 2020-08-20 11:27:29 +0200 |
|---|---|---|
| committer | Noel Grandin <noel.grandin@collabora.co.uk> | 2020-08-20 16:37:51 +0200 |
| commit | 445cf499666f21c2d480ce1df9ce6004b9450b64 (patch) | |
| tree | a9a085e5d8486176c6580261eaf686737927c4ac /sw | |
| parent | 901add54cd5191b5a41ec11baddd669954c34025 (diff) | |
tdf#132940 Crash in mergedlo!vcl::Region::operator=
We had a SdrPageWindow accessing a SdPaintWindow that had already been
freed.
Turns that SdrPageWindow can be "patched" more than once given enough
stuff going on in writer, so make the call sites restore the previous
state as the stack unwinds.
Change-Id: Ia1ef5c9b2f818b7873e8e739c9cdf257554e403a
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/101044
Tested-by: Jenkins
Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk>
Diffstat (limited to 'sw')
| -rw-r--r-- | sw/source/core/view/viewsh.cxx | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/sw/source/core/view/viewsh.cxx b/sw/source/core/view/viewsh.cxx index cd171c79ba06..7f2f6e4466bb 100644 --- a/sw/source/core/view/viewsh.cxx +++ b/sw/source/core/view/viewsh.cxx @@ -1716,6 +1716,7 @@ class RenderContextGuard { std::unique_ptr<SdrPaintWindow> m_TemporaryPaintWindow; SdrPageWindow* m_pPatchedPageWindow; + SdrPaintWindow* m_pPreviousPaintWindow = nullptr; public: RenderContextGuard(VclPtr<vcl::RenderContext>& pRef, vcl::RenderContext* pValue, SwViewShell* pShell) @@ -1740,7 +1741,7 @@ public: if (nullptr != m_pPatchedPageWindow) { m_TemporaryPaintWindow.reset(new SdrPaintWindow(*pDrawView, *pValue)); - m_pPatchedPageWindow->patchPaintWindow(*m_TemporaryPaintWindow); + m_pPreviousPaintWindow = m_pPatchedPageWindow->patchPaintWindow(*m_TemporaryPaintWindow); } } } @@ -1749,7 +1750,7 @@ public: { if(nullptr != m_pPatchedPageWindow) { - m_pPatchedPageWindow->unpatchPaintWindow(); + m_pPatchedPageWindow->unpatchPaintWindow(m_pPreviousPaintWindow); } } }; |