diff options
author | Michael Stahl <michael.stahl@allotropia.de> | 2023-01-05 12:32:09 +0100 |
---|---|---|
committer | Michael Stahl <michael.stahl@allotropia.de> | 2024-03-06 20:39:47 +0100 |
commit | 126dd55667826f5d1268a570f7e2930b1b78fc43 (patch) | |
tree | 430763851af7e3543c20cf68aa62d0fa79421dd9 /unoidl | |
parent | 67679b3c8a1c550dbcc1f9d80b6b3e77a256ff10 (diff) |
tdf#152710 fixes squashed required by testTdf134250
tdf#152710 sw: invalidate SwUnoCursors properly in DeleteRangeImpl()
This crashes with:
list.cxx:44: corrupt document structure, bailing out of infinite loop
ndtxt.cxx:5437: void SwTextNode::TriggerNodeUpdate(const sw::LegacyModifyHint&): Assertion `dynamic_cast<SwTextFormatColl const*>(static_cast<const SwFormatChg*>(pOldValue)->pChangedFormat)' failed.
Because the redline from 7 to 9 is deleted, but then some cursor ends up
on node 10 which is invalid as it is an end node.
[ 6] 0x60666a0 StartNode ,
[ 7] 0x61195e0 StartNode ,
[ 8] 0x61197a8 TextNode "tainment",
[ 9] 0x6119670 EndNode ,
[ 10] 0x6066730 EndNode ,
The first problem is that DeleteRangeImpl() uses the point node as the
target position for PaMCorrAbs(), but in this case the point node will
be deleted.
PaMCorrAbs() has a check to invalidate SwUnoCursors that would be moved
out of their parent sections, but due to the first problem it can't
check it, and the second problem is that lcl_FindUnoCursorSection()
doesn't work on redline sections, as those have node type
SwNormalStartNode.
After fixing the invalidation, subsequent access to the SwXTextCursor
throws exceptions and importing the file fails.
(regression from commit 477e489e71b4a96ff10d9f2d2b802d91dec3e319)
Thanks to Dave Gilbert for identifying the problematic DeleteRange()
call.
Change-Id: I48a373cc122073b82bc47513fdae684f45b0efb8
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/145077
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
(cherry picked from commit 8e05bdd26f21fc304978ff3b454cf355841ec75f)
tdf#152710 sw: call and fix DeleteSection() instead
Turns out there's a function to delete a complete nodes array section -
and it has the same problem? Why does it move indexes only from
startnode + 1? Let's try to fix it to be more consistent.
Change-Id: Iedacc10e29c1646c4ccc85e53a479b0351f5cfcc
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/145078
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
(cherry picked from commit 475e59d29b7a6cc7f058af8ff863b3bb1a2a84a5)
Diffstat (limited to 'unoidl')
0 files changed, 0 insertions, 0 deletions