summaryrefslogtreecommitdiff
path: root/sw
AgeCommit message (Collapse)Author
2022-09-23forcepoint#108 sw: prevent creating SwRangeRedline anchored in itselfMichael Stahl
the SwRangeRedline in frame #8 triggers deleting itself at frame #0 which repeats the DeleteSection attempt which is already in progress #0 SwRangeRedline::~SwRangeRedline() (this=0x5335300) at sw/source/core/doc/docredln.cxx:1168 #1 0x00007fffc9b91aab in SwRedlineTable::DeleteAndDestroy(unsigned long) (this=0x4f388f8, nP=0) at sw/source/core/doc/docredln.cxx:669 #2 0x00007fffc9c8454a in sw::DocumentRedlineManager::DeleteRedline(SwPaM const&, bool, RedlineType) (this=0x4f388e0, rRange=SwPaM = {...}, bSaveInUndo=true, nDelType=RedlineType::Any) at sw/source/core/doc/DocumentRedlineManager.cxx:2578 #3 0x00007fffc9c84a2f in sw::DocumentRedlineManager::DeleteRedline(SwStartNode const&, bool, RedlineType) (this=0x4f388e0, rNode=..., bSaveInUndo=true, nDelType=RedlineType::Any) at sw/source/core/doc/DocumentRedlineManager.cxx:2676 #4 0x00007fffc9c1c57f in sw::DocumentContentOperationsManager::DeleteSection(SwNode*) (this=0x4f3b460, pNode=0x5331780) at sw/source/core/doc/DocumentContentOperationsManager.cxx:2092 #5 0x00007fffc9cbfea7 in sw::DocumentLayoutManager::DelLayoutFormat(SwFrameFormat*) (this=0x4edad40, pFormat=0x53318b0) at sw/source/core/doc/DocumentLayoutManager.cxx:285 #6 0x00007fffc9a9abd2 in DelFlyInRange(SwNode&, SwNode&, SwContentIndex const*, SwContentIndex const*) (rMkNd=..., rPtNd=..., pMkIdx=0x0, pPtIdx=0x0) at sw/source/core/doc/docedt.cxx:254 #7 0x00007fffc9c1c53d in sw::DocumentContentOperationsManager::DeleteSection(SwNode*) (this=0x4f3b460, pNode=0x532a1f0) at sw/source/core/doc/DocumentContentOperationsManager.cxx:2091 #8 0x00007fffc9b965f7 in SwRangeRedline::MoveFromSection(unsigned long) (this=0x5335300, nMyPos=0) at sw/source/core/doc/docredln.cxx:1834 #9 0x00007fffc9b951f8 in SwRangeRedline::Show(unsigned short, unsigned long, bool) (this=0x5335300, nLoop=1, nMyPos=0, bForced=false) at sw/source/core/doc/docredln.cxx:1277 #10 0x00007fffc9c7d64b in sw::DocumentRedlineManager::SetRedlineFlags(RedlineFlags) (this=0x4f388e0, eMode=RedlineFlags::ShowMask) at sw/source/core/doc/DocumentRedlineManager.cxx:1149 #11 0x00007fffcb129668 in SwXTextDocument::setPropertyValue(rtl::OUString const&, com::sun::star::uno::Any const&) (this=0x4f52730, rPropertyName="ShowChanges", aValue=uno::Any("boolean": 1 '\001')) at sw/source/uibase/uno/unotxdoc.cxx:1795 #12 0x00007fffcab7ce8d in XMLRedlineImportHelper::~XMLRedlineImportHelper() (this=0x52792f0) at sw/source/filter/xml/XMLRedlineImportHelper.cxx:341 #13 0x00007fffcac2366d in SwXMLTextImportHelper::~SwXMLTextImportHelper() (this=0x527cae0) at sw/source/filter/xml/xmltexti.cxx:157 #14 0x00007fffcac236a9 in SwXMLTextImportHelper::~SwXMLTextImportHelper() (this=0x527cae0) at sw/source/filter/xml/xmltexti.cxx:152 #15 0x00007fffea9d5ee2 in salhelper::SimpleReferenceObject::release() (this=0x527cae0) at include/salhelper/simplereferenceobject.hxx:76 #16 0x00007fffeabc2619 in rtl::Reference<XMLTextImportHelper>::clear() (this=0x525cd60) at include/rtl/ref.hxx:196 #17 0x00007fffeabb07e0 in SvXMLImport::cleanup() (this=0x525ccd0) at xmloff/source/core/xmlimp.cxx:458 #18 0x00007fffeabb08bf in SvXMLImport::~SvXMLImport() (this=0x525ccd0) at xmloff/source/core/xmlimp.cxx:464 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/138191 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit a8b3953531035bf93306ed90142c4172cc32ac43) forcepoint#108 sw: tweak a bit * the fly-at-fly case didn't work, iteration also skips it * delete the bad redline section in the nodes array Reviewed-on: https://gerrit.libreoffice.org/c/core/+/138434 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 477e489e71b4a96ff10d9f2d2b802d91dec3e319) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/138289 Tested-by: Jenkins Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de> (cherry picked from commit 2d16f0639b74bcc9328fbb77f774cf9141d1675b) Change-Id: I640874df3fd10af935cf05df707d45bea2c9fd6e
2022-09-23forcepoint#110 set PaMs to somewhere safe to parkCaolán McNamara
Change-Id: I4dbf27d67b74ff99583dad46a5448700f133c2f5 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/138371 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit d9655727ac688753ea12aaedc09a006134dd4a13) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/138292 Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de> (cherry picked from commit 6a26be4102e2e80bca4138fb0bdbb38cae90cbc8)
2022-09-02check IFrame "FrameURL" targetCaolán McNamara
similiar to commit b3edf85e0fe6ca03dc26e1bf531be82193bc9627 Date: Wed Aug 7 17:37:11 2019 +0100 warn on load when a document binds an event to a macro Change-Id: Iea888b1c083d2dc69ec322309ac9ae8c5e5eb315 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139059 Tested-by: Jenkins Reviewed-by: Stephan Bergmann <sbergman@redhat.com> Conflicts: sfx2/source/doc/iframe.cxx sw/source/filter/html/htmlplug.cxx sw/source/filter/xml/xmltexti.cxx
2022-07-14sw: fix spurious layout invalidation from ~SwCallLink()Michael Stahl
This code was added in commit 56b2cf0c10d9caa01ebae1d80465e342d046a85c "sw-collapse-empty-table-par-like-html.diff" and leaves us to guess what it should do. Apparently it's trying to replicate a Word feature where an empty paragraph at the end of a table cell and preceded by a nested table is effectively hidden, *unless* the user moves the cursor into it, at which point it grows to its ordinary height. The problem is that this is implemented by invalidating the position of any table once the cursor is moved into it, causing it to be reformatted, at potentially great expense, regardless if the cursor is actually on a paragraph that may be hidden. Also limit invalidations to when the cursor has actually moved to a different node. To fix tdf#105330, un-collapse a paragraph after Undo, requires additionally doing the same notification from SwUndoInsTable::UndoImpl() because the SwCallLink won't see the removed table any more. Mysteriously this causes the test SwLayoutWriter2 testTdf124261 to fail in Jenkins, but only on MacOSX so impossible to debug; tb86 fails with: layout2.cxx:2227:testTdf124261::TestBody equality assertion failed - Expected: 1721 - Actual : 5437 ... and tb84 with: layout2.cxx:2227:testTdf124261::TestBody equality assertion failed - Expected: 1721 - Actual : 3740 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136963 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit c605283ad6785dea762feab5fdffd9d27e75c292) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/137034 Reviewed-by: Miklos Vajna <vmiklos@collabora.com> (cherry picked from commit dadaf930d14283f96cc06741d2eec6d846e59f7f) (cherry picked from commit 158012bcd3ed56cd1c9c5b3472d42d94d5a437da) Change-Id: Ifd55097735d3675e6b82264f455baa44e9c9e30a
2022-07-14tdf#135682 sw: fix lost selection-all when doc starts with tableMiklos Vajna
Regression from commit c56bf1479cc71d1a2b0639f6383e90c1f7e3655b (tdf#105330 sw: fix lost cursor on undoing nested table insert, 2019-09-16), the problem was that the change reverted lcl_notifyRow() back to its original state, because it seemed the conditional notification is no longer needed. However, this broke the fix for tdf#37606 (ability to select-all when the doc starts with a table). Fix the problem by handling the starts-with-table case similar to a normal table selection, so there is still no need to restore the nested table visitor code but select-all works nicely with starts-with-table documents again. Reviewed-on: https://gerrit.libreoffice.org/c/core/+/102694 Tested-by: Jenkins Reviewed-by: Miklos Vajna <vmiklos@collabora.com> (cherry picked from commit 6f1e02c96b887750f974c187a82ecd6236e6a435) Change-Id: Icb823a39432d1774a63a0c633c172bba827ac76d
2022-07-14tdf#128567 sw: fix flicker of table selection highlightMiklos Vajna
Regression from commit c56bf1479cc71d1a2b0639f6383e90c1f7e3655b (tdf#105330 sw: fix lost cursor on undoing nested table insert, 2019-09-16), the problem was that in case lcl_notifyRow() invokes SwRowFrame::ModifyNotification(), then the table selection is re-created all the time, while in case it does not, then it may result in a cursor loss. The reason for the flicker is that normally sw::DocumentTimerManager::m_aDocIdle is not invoked between the SwEditWin mouse button down/move/up events, but in case the notification is done, then the idle kicks in once the page frame of the row is invalidated. Fix the problem by avoiding the notification in the table selection case: this makes the flicker go away and the original cursor loss problem remains fixed, too. [ It is not clear to me woh can I test if the flicker happens, would need some mechanism to ensure that the mouse button down/up/move chain happens without the idle kicking in, perhaps. ] Change-Id: I91e0af0d3b1b9824754c0bf0be8535d294601787 Reviewed-on: https://gerrit.libreoffice.org/85240 Tested-by: Jenkins Reviewed-by: Miklos Vajna <vmiklos@collabora.com> (cherry picked from commit d4ea54e18346a35590933dd1e8b83d1c12a741de)
2022-06-13tdf#131025 swtable: don't apply number format to non-number textJustin Luth
Applying a numbering style to text causes export to save that out as a number (valued as zero). That is not good because the ODF spec says that a number overrides a string. So don't accept a numbering format on non-number text. Why is this change good? -the cell previously had no direct formatting (by definition). -the cell's previous old format was text (tested). -any numbering format applied obviously isn't correct (by definition). -any previous formatting has already been overwritten with numformat. -the default numbering is appropriate for text. -empty cells still get the numbering format (tested). -odd human-designed formats are accepted as intentional (tested). What are the concerns? -the scope of this change is HUGE, way beyond this bug. -on both my dev box and patch box I saw occassional crashes. -the bug was "fixed" by a different import commit that ensured different languages were treated consistently. So this patch is no longer critical, just nice to have to avoid exporting out-of-spec content. Change-Id: Id3dc5f803c3cf4875bc0cab52d1019a18679da77 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/123904 Tested-by: Jenkins Reviewed-by: Justin Luth <justin_luth@sil.org> Reviewed-by: Eike Rathke <erack@redhat.com> (cherry picked from commit 546e7d14b397cfd1210b891c8dc4a195c25f3876) Conflicts: include/svl/numformat.hxx svl/source/numbers/zforlist.cxx sw/source/core/table/swtable.cxx Change-Id: I94db018babf0323d84809accaaa898a9caf8edbe (cherry picked from commit 66a6cb0e02e5ea9cb4a75258928103f7ecd07f36)
2022-05-20sw: no std::optional yetcib-6.1-34Michael Stahl
Change-Id: I46e238fee67af617cf8034942a7b553ac768f654
2022-05-13forcepoint#102 refetch pPara if it might have been destroyedCaolán McNamara
by SwTextFly::Relax READ of size 8 at 0x616006d9ab08 thread T0 #0 0x7f5c56a0fbe5 in Size::Height() const include/tools/gen.hxx:213:52 #1 0x7f5c56a0fb98 in Size::getHeight() const include/tools/gen.hxx:219:55 #2 0x7f5c56a040f0 in SwRect::IsEmpty() const sw/inc/swrect.hxx:306:21 #3 0x7f5c56dbb018 in SwRect::HasArea() const sw/inc/swrect.hxx:302:13 #4 0x7f5c58571d04 in SwTextFrame::Prepare(PrepareHint, void const*, bool) sw/source/core/text/txtfrm.cxx:2986:45 0x616006d9ab08 is located 136 bytes inside of 608-byte region [0x616006d9aa80,0x616006d9ace0) freed by thread T0 here: #0 0x4fe1f7 in operator delete(void*) (instdir/program/soffice.bin+0x4fe1f7) #1 0x7f5c584602c5 in SwParaPortion::~SwParaPortion() sw/source/core/text/porlay.cxx:2557:1 #2 0x7f5c5850b997 in std::default_delete<SwParaPortion>::operator()(SwParaPortion*) const /usr/bin/../lib/gcc/x86_64-redhat-linux/11/../../../../include/c++/11/bits/unique_ptr.h:85:2 #3 0x7f5c5850b826 in std::__uniq_ptr_impl<SwParaPortion, std::default_delete<SwParaPortion> >::reset(SwParaPortion*) /usr/bin/../lib/gcc/x86_64-redhat-linux/11/../../../../include/c++/11/bits/unique_ptr.h:182:4 #4 0x7f5c5850b630 in std::unique_ptr<SwParaPortion, std::default_delete<SwParaPortion> >::reset(SwParaPortion*) /usr/bin/../lib/gcc/x86_64-redhat-linux/11/../../../../include/c++/11/bits/unique_ptr.h:456:7 #5 0x7f5c5850960d in SwTextLine::SetPara(SwParaPortion*, bool) sw/source/core/text/txtcache.hxx:45:17 #6 0x7f5c58509e7d in SwTextFrame::ClearPara() sw/source/core/text/txtcache.cxx:113:24 #7 0x7f5c5855606e in SwTextFrame::Init() sw/source/core/text/txtfrm.cxx:758:9 #8 0x7f5c585735c4 in SwTextFrame::Prepare(PrepareHint, void const*, bool) sw/source/core/text/txtfrm.cxx:3090:17 #9 0x7f5c57ecafb4 in lcl_NotifyContent(SdrObject const*, SwContentFrame*, SwRect const&, PrepareHint) sw/source/core/layout/frmtool.cxx:3367:15 #10 0x7f5c57ec968b in Notify_Background(SdrObject const*, SwPageFrame*, SwRect const&, PrepareHint, bool) sw/source/core/layout/frmtool.cxx:3443:9 #11 0x7f5c57958669 in lcl_NotifyBackgroundOfObj(SwDrawContact const&, SdrObject const&, tools::Rectangle const*) sw/source/core/draw/dcontact.cxx:951:13 #12 0x7f5c579556bc in SwDrawContact::Changed_(SdrObject const&, SdrUserCallType, tools::Rectangle const*) sw/source/core/draw/dcontact.cxx:1233:21 #13 0x7f5c57953b8d in SwDrawContact::Changed(SdrObject const&, SdrUserCallType, tools::Rectangle const&) sw/source/core/draw/dcontact.cxx:1009:5 #14 0x7f5c96008baf in SdrObject::SendUserCall(SdrUserCallType, tools::Rectangle const&) const svx/source/svdraw/svdobj.cxx:2767:22 #15 0x7f5c9601befa in SdrObject::Resize(Point const&, Fraction const&, Fraction const&, bool) svx/source/svdraw/svdobj.cxx:1561:5 #16 0x7f5c57da650c in SwAnchoredDrawObject::GetObjBoundRect() const sw/source/core/layout/anchoreddrawobject.cxx:733:22 #17 0x7f5c57dae236 in SwAnchoredObject::GetObjRectWithSpaces() const sw/source/core/layout/anchoredobject.cxx:569:31 #18 0x7f5c5853c39e in SwTextFly::InitAnchoredObjList() sw/source/core/text/txtfly.cxx:900:48 #19 0x7f5c58537b0c in SwTextFly::GetAnchoredObjList() const sw/source/core/inc/txtfly.hxx:311:44 #20 0x7f5c58532a5d in SwTextFly::ForEach(SwRect const&, SwRect*, bool) const sw/source/core/text/txtfly.cxx:1067:56 #21 0x7f5c58533eec in SwTextFly::IsAnyFrame() const sw/source/core/text/txtfly.cxx:405:12 #22 0x7f5c5832ccbe in SwTextFly::Relax() sw/source/core/inc/txtfly.hxx:337:17 #23 0x7f5c58571af5 in SwTextFrame::Prepare(PrepareHint, void const*, bool) sw/source/core/text/txtfrm.cxx:2976:48 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132480 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit f49d218a671df5f7a956ccb219dc46a5c8d0a53c) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132485 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 1c4ebab83edb8fe70282f6467700a56c3aff6c1b) (cherry picked from commit fcd857710007e66085dbfa977c05f4802c0b197e) Change-Id: Ibd0d4af69d2a8d74ad538afba7da53c864fa27b6
2022-05-13forcepoint#98 don't delete SwFrame flagged as IsDeleteForbiddenCaolán McNamara
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132435 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 3644508aceee6019842bea1fee6c177eabd61681) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132484 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit ff6ca44405e0f472441bfa3902f6a3d614028029) (cherry picked from commit b500167f01bdcc0097efcffb2ccd3a010e05df14) Change-Id: I1ac2db4bf96afc4bdc8e0646576f5fa0bcd9e410
2022-05-13forcepoint#91 fix crash on layout of specific htmlCaolán McNamara
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132129 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit be04a8072e4af30ca6ead36aa92d5f380cd9feb9) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132483 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 4abce69fca83f5c98bb1fc0678cc1ce9cedd4750) (cherry picked from commit 4b23de1b8096b5814a654482966e83416498734a) Change-Id: I145649e18f382c67ea34290f44fa219b7926127f
2022-05-13forcepoint#99 SwTextFormatter unaware that FirstOfBorderMerge was deletedCaolán McNamara
READ of size 8 at 0x606000a49e50 thread T0 #0 0x7f7ab6214bf5 in SwPosSize::Height() const /home/caolan/LibreOffice/core-asan/sw/source/core/text/possiz.hxx:49:37 #1 0x7f7ab636c311 in SwTextFormatter::MergeCharacterBorder(SwLinePortion&, SwLinePortion const*, SwTextFormatInfo&) /home/caolan/LibreOffice/core-asan/sw/source/core/text/itrform2.cxx:2807:43 #2 0x7f7ab636ae08 in SwTextFormatter::InsertPortion(SwTextFormatInfo&, SwLinePortion*) /home/caolan/LibreOffice/core-asan/sw/source/core/text/itrform2.cxx:354:13 #3 0x7f7ab6371db1 in SwTextFormatter::BuildPortions(SwTextFormatInfo&) /home/caolan/LibreOffice/core-asan/sw/source/core/text/itrform2.cxx:709:9 #4 0x7f7ab638b2ac in SwTextFormatter::FormatLine(o3tl::strong_int<int, Tag_TextFrameIndex>) /home/caolan/LibreOffice/core-asan/sw/source/core/text/itrform2.cxx:1701:9 #5 0x7f7ab62a8ad1 in SwTextFrame::FormatLine(SwTextFormatter&, bool) /home/caolan/LibreOffice/core-asan/sw/source/core/text/frmform.cxx:1212:44 #6 0x7f7ab62af1cc in SwTextFrame::Format_(SwTextFormatter&, SwTextFormatInfo&, bool) /home/caolan/LibreOffice/core-asan/sw/source/core/text/frmform.cxx:1571:23 #7 0x7f7ab62b1f17 in SwTextFrame::Format_(OutputDevice*, SwParaPortion*) /home/caolan/LibreOffice/core-asan/sw/source/core/text/frmform.cxx:1743:5 #8 0x7f7ab62b5260 in SwTextFrame::Format(OutputDevice*, SwBorderAttrs const*) /home/caolan/LibreOffice/core-asan/sw/source/core/text/frmform.cxx:1932:17 #9 0x7f7ab5dbdabd in SwContentFrame::MakeAll(OutputDevice*) /home/caolan/LibreOffice/core-asan/sw/source/core/layout/calcmove.cxx:1514:17 0x606000a49e50 is located 16 bytes inside of 56-byte region [0x606000a49e40,0x606000a49e78) freed by thread T0 here: #0 0x4fe1f7 in operator delete(void*) (/home/caolan/LibreOffice/core-asan/instdir/program/soffice.bin+0x4fe1f7) #1 0x7f7ab6486d35 in SwTextPortion::~SwTextPortion() /home/caolan/LibreOffice/core-asan/sw/source/core/text/portxt.hxx:26:7 #2 0x7f7ab63da0c9 in SwLineLayout::CalcLine(SwTextFormatter&, SwTextFormatInfo&) /home/caolan/LibreOffice/core-asan/sw/source/core/text/porlay.cxx:430:21 #3 0x7f7ab6435413 in SwMultiPortion::CalcSize(SwTextFormatter&, SwTextFormatInfo&) /home/caolan/LibreOffice/core-asan/sw/source/core/text/pormulti.cxx:75:15 #4 0x7f7ab6457749 in SwTextFormatter::BuildMultiPortion(SwTextFormatInfo&, SwMultiPortion&) /home/caolan/LibreOffice/core-asan/sw/source/core/text/pormulti.cxx:2090:16 #5 0x7f7ab636f12c in SwTextFormatter::BuildPortions(SwTextFormatInfo&) /home/caolan/LibreOffice/core-asan/sw/source/core/text/itrform2.cxx:550:21 #6 0x7f7ab638b2ac in SwTextFormatter::FormatLine(o3tl::strong_int<int, Tag_TextFrameIndex>) /home/caolan/LibreOffice/core-asan/sw/source/core/text/itrform2.cxx:1701:9 #7 0x7f7ab62a8ad1 in SwTextFrame::FormatLine(SwTextFormatter&, bool) /home/caolan/LibreOffice/core-asan/sw/source/core/text/frmform.cxx:1212:44 #8 0x7f7ab62af1cc in SwTextFrame::Format_(SwTextFormatter&, SwTextFormatInfo&, bool) /home/caolan/LibreOffice/core-asan/sw/source/core/text/frmform.cxx:1571:23 #9 0x7f7ab62b1f17 in SwTextFrame::Format_(OutputDevice*, SwParaPortion*) /home/caolan/LibreOffice/core-asan/sw/source/core/text/frmform.cxx:1743:5 #10 0x7f7ab62b5260 in SwTextFrame::Format(OutputDevice*, SwBorderAttrs const*) /home/caolan/LibreOffice/core-asan/sw/source/core/text/frmform.cxx:1932:17 #11 0x7f7ab5dbdabd in SwContentFrame::MakeAll(OutputDevice*) /home/caolan/LibreOffice/core-asan/sw/source/core/layout/calcmove.cxx:1514:17 similar seen in the past as: commit 96acebb72211b4718eb3038c427df37b55b17b0b Date: Tue May 14 01:49:03 2019 +0800 tdf#124937 reset m_pFirstOfBorderMerge before truncate. commit ecd855794b22c0f7e6fb2f362b566c4d9c5f624a Date: Mon Jan 15 22:29:31 2018 +0100 tdf#114536 sw: fix use-after-free in SwTextFormatter::MergeCharacterBorder() Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132439 Tested-by: Jenkins Reviewed-by: Miklos Vajna <vmiklos@collabora.com> (cherry picked from commit b46baea4d1cce81c56ee0d82fbdc352921445fa7) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132380 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 0a34ac386187c5ca328aebc27851c2a2ff38f293) (cherry picked from commit 1737ee2c89f7a103f1a0d77f2d3548dda3c35b8e) Change-Id: Iad855f382a0daf50dac2537d4a91bfeaa9ff3799
2022-05-13forcepoint#93 fix crash on layout of specific rtfCaolán McNamara
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/133481 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 5277b953b29845555cba8f867c9c750e8bc510a5) (cherry picked from commit 97f4ea4b8b44425ed0fe34df650c7531cfa721f5) Change-Id: Id81729de2efd6f65f1b51bdb437ca21a260eaf6e
2022-05-13forcepoint#90 fix crash on layout of specific rtfCaolán McNamara
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132046 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 416cb37acae460b6ae8b175b5c5caf1601f030d4) (cherry picked from commit 7896b1e8dd9a4101f330bd48da3e3c7a1f732ce9) Change-Id: I17c227ab278ed5a2cc60449d1d005212f00ded89
2022-05-13forcepoint#94 fix crash on layout of specific htmlCaolán McNamara
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132179 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 3b6ea366796f7f7e04fb60b9394c91e4790b5c72) (cherry picked from commit c9ab0bb6487e1be7e86e8be0ef4b8aecd0c58e6b) Change-Id: I1874a431d5af9d56248a695e08a2f95b5292ba9a
2022-05-13forcepoint#92 fix crash on layout of specific docCaolán McNamara
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132142 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132148 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 0d0cee5e48ca523f11540e9ae0ff022692fd9dca) (cherry picked from commit 86108b6ddabcbd0e649a6bc4d182a82a92025b69) Change-Id: Id40d25d05d10d641d071cddd2e1c84594ac777a6
2022-05-13forcepoint#89 don't remove page with footnote continuation frameCaolán McNamara
in browse/html/web mode Change-Id: Ic821dd7f2cc1f47305b5fe2ced16d5168aedc0b9 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132045 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit e672a8351df5e9fcbdafa34857a16f2bd547ebd6) (cherry picked from commit 6a02b33e429c85c3425b6e92766a2346a1271ced)
2022-05-13sw: prevent footnote frame against delete while it's movedMichael Stahl
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130439 Tested-by: Jenkins Reviewed-by: Miklos Vajna <vmiklos@collabora.com> (cherry picked from commit fe5d3fbfe63fe8b433776bd3a0508dd712b868b0) sw: really prevent footnote frame against delete while it's moved This reverts commit fe5d3fbfe63fe8b433776bd3a0508dd712b868b0 It turns out that checking a single column's IsMovingFootnotes() is not enough - as frames can move both forwards and backwards the entire chain of columns would need to be checked. (Most callers of MoveLowerFootnotes() move forwards, but one place in tabfrm.cxx moves from a follow to master.) But it turns out that this is probably the wrong way in any case: most likely the intention in FormatAnchorFrameAndItsPrevs() is to format previous frames in the same layout environment, so if there is a section or column inside a footnote then this upper should be formatted, while if the footnote is inside a section or column this upper should not be formatted; this should make calls during MoveFootnotes_() safe as it should prevent the formatting of frames in the footnote boss moving a footnote that is already being moved. So tweak the fix in commit fa1bcc22921941b2cd8a0b32fe0d15655d12d607 a little to make it more general. Also it was previously possible that for a section with columns, both the section branch and the column branch was taken, which seems supperfluous. Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130544 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 3f569ffc9238e6bf2915e78bf21c844ca5f1270d) add a layout test to exercise UXTSOREL Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130493 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 10d46c0498b89350645cf45e744a528d3d8f1ac1) use Bitstream Vera Sans for consistent results with LIBREOFFICE-UXTSOREL.rtf instead of Palatino Linotype which will typically get substituted Reviewed-on: https://gerrit.libreoffice.org/c/core/+/133460 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit ff27c0e35ebfdbe998c372b7a36df8b5577e1fd4) (cherry picked from commit c35737020bf1d83723ac06334a2decb6b7850240) Change-Id: I39487640322339fe4d511e845d9c6bced2ba9dad
2022-05-13tdf#122894 skipping anchor in column in footnoteCaolán McNamara
a trawl of crash testing document didn't show up another example and it doesn't seem possible to create this scenario directly in out UI Reviewed-on: https://gerrit.libreoffice.org/c/core/+/112567 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit fa1bcc22921941b2cd8a0b32fe0d15655d12d607) (cherry picked from commit 87ada07d405bd6813d7ad03e66b66bc259988f61) Change-Id: Ie65a51bf609e8bacd261f368f0b8037431c116ed
2022-05-13an inconsistent SwTextFormatInfo index, len, text length caseCaolán McNamara
seen on loading sw/qa/python/testdocuments/TESTMETA.odt maybe since: commit 2f3684b2289a8c46dc6144064a452cc529400f28 Date: Tue Jul 31 16:00:02 2018 +0200 [API CHANGE] add some more asserts to the string functions but probably an underlying issue since conversion from UniString to OUString Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131407 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit eb7fbe1f3a37d89b97bd8976bdc006099578c204) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132860 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 177589cb4f8ef20ff84dbfc141b145b28e57be83) Change-Id: If731163fbc5e05b813ccd21df65164fe476cba9a (cherry picked from commit 39c62a03a607c5aed8d70e1851f48bcf01d62323)
2022-05-13forcepoint#100 drop SwBorderAttrAccess to allow cache entry to be removedCaolán McNamara
for SwBorderAttr which gets deleted during this call also includes... Related: forcepoint#100 we don't need pAttrs for the duration of the full scope similar to the case of commit 6b1eae0334ba8bad7656a859695551ce51b62f95 Date: Fri May 18 08:26:14 2001 +0000 Fix #87058#: Locked boraderattribut the SwCache object cannot be deleted if its locked, leading to a leak, we don't need pAttrs for the entire scope here so we can defer to the end of the scope the reacquire the lock to set pAttrs and also includes... Related: forcepoint#100 don't reacquire after every release instead release when we have to, and only reacquire if necessary before use of pAttrs Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132462 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> Tested-by: Jenkins (cherry picked from commit 37f39a4156069ba5f099045ce93370507d9ba215) (cherry picked from commit 65f16bbd7092f924879cb67e39bd4e826abe5a86) Change-Id: Ie52aab7e5933d76b0c055389798104e4d93f39e9
2022-05-12forcepoint#82 back() called on empty vectorCaolán McNamara
Change-Id: I8017777a58f1fef41d1545899868e333c2184c5c Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131867 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 848ba18f3196a2fc64d08573eb9d1aeda074e758) (cherry picked from commit 8007299c13ccbb5455c0475f811f7534179ddddd)
2022-05-12forcepoint#86 RES_TXTATR_UNKNOWN_CONTAINER item put at invalid indexCaolán McNamara
RES_CHRATR_BEGIN is 1, presumably RES_TXTATR_UNKNOWN_CONTAINER should be stored in the last index Change-Id: Id37fff41cbbccbc26fe5ccce6027014af7362729 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132040 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit f5ff8e0feb218a001e2ce5ced9ec4e13f2bff73d) (cherry picked from commit 117f52bab78e18aa1fb456a5df6b692ea6b45a10)
2022-05-12sw: avoid EXCEPTION_INT_DIVIDE_BY_ZEROXisco Fauli
Seen in https://crashreport.libreoffice.org/stats/signature/SwBookmarkPortion::DoPaint(SwTextPaintInfo%20const%20&,rtl::OUString%20&,SwFont%20&,int%20&) Introduced by 4ce8120f1e53f7b81e653b01d141643013bc69ab "tdf#45589 sw: create and paint text portions for bookmarks" Change-Id: I7d025878164e1f97b86f9d129af9ba93e93b6ba3 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/133562 Tested-by: Jenkins Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org> (cherry picked from commit 7c8b9fa98f4c5f7f5620e797dbbe24081e252548) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/133602 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit e2ee797ebba6ee52387cbbd662ee35d84943f0ce) (cherry picked from commit 5055aad4697f19e0f45ed4f6e2a3efbdf055d6ae)
2022-03-03protect frame from triggering deleting itselfCaolán McNamara
LIBREOFFICE-N4LA0OHZ Change-Id: I0d24277665a317f047b286fe0f0878b3814ded65 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130766 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit ee2a192923bf709d05c174848e7054cd411b205a) (cherry picked from commit 3d3c6462eeef581af2b936071c3ef432858b04a5)
2022-02-23tdf#131025 ODF import: recognize SV_COUNTRY_LANGUAGE_OFFSETJustin Luth
File import was making an exception for "float value 0" if the accompanying text had no resemblance to the value 0, but that only applied to GENERAL number format. It should apply to any language's default number format. REGRESSION warning: as we can see, this has been handled inconsistently in the past. But from the coding exception to overcome losing text to a zero (and the huge number of duplicate bugs) the best choice seems to be ignore the spec that says that a number value overrides the text value - at least in the case where the number value is zero. Change-Id: I701e72c6a5dad42c7799ab501255a4859adf61d4 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/124080 Tested-by: Jenkins Reviewed-by: Justin Luth <justin_luth@sil.org> Reviewed-by: Eike Rathke <erack@redhat.com> (cherry picked from commit 3e1d316734354c6b49696c8904e0fc431cfb5143) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/124014 Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org> (cherry picked from commit d3b4ef0f7726ef1619717d9e3327963ceb4c065a) (cherry picked from commit d9d7b17adf91c90a21a59250934e2e52e1133d81)
2022-02-21sw: layout: allow keep-with-next paragraph with fly to move backMichael Stahl
The problem is that a paragraph that has the fo:keep-with-next="always" and also a fly anchored at-char or at-para with style:flow-with-text="true" will never move to the previous page, even with space available. In SwContentFrame::MakeAll() it will first MoveBwd() and then go into the special case "if ( bKeep && bMoveable )" which calls Calc() on the next frame. But this fails to move the next frame because of SwFlowFrame::IsPrevObjMove() finding the fly with a mis-matching mpVertPosOrientFrame - that will not be fixed until the first SwContentFrame::MakeAll() is done and SwObjectFormatter::FormatObjsAtFrame() is called. But SwContentFrame::MakeAll() first detects that the frame is not on the same page as the next one despite bKeep, so it MoveFwd() again. This happens already in OOo 3.3. IsJoinLocked() should be a reasonably good heuristic for "is the previous frame being formatted". Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130033 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 38e7c18188f1c5310898181db87686774be3c040) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130014 Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de> (cherry picked from commit 58c28725b2b34941ae4f6afa7689c0d0ebde0be7) (cherry picked from commit 5350aaaff6742abdf631b805510578e961982b49) Change-Id: I86996dcb3d0c46fcb99ec9ad463569abbb8b99f0
2022-02-21Dump some more layout info as XmlJan-Marek Glogowski
Change-Id: Ia82d545e4c5d4507899d123eba9d4b2efded992d Reviewed-on: https://gerrit.libreoffice.org/c/core/+/90125 Tested-by: Jenkins Reviewed-by: Jan-Marek Glogowski <glogow@fbihome.de> (cherry picked from commit 36f0a04d3caa176b20dccb10ff0bbcfb5cb8d893)
2022-02-17Refetch in case SwTextNode::InsertItem causes it to be deletedCaolán McNamara
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130087 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 3dab7bc9dd8763d68fc2e6496e8069c7823685c2) Change-Id: Ie189ae4d37ffc33e58bb405f2521d1ae02a9997b
2022-02-11limit style export to words max style countCaolán McNamara
and use std::vector LIBREOFFICE-U78X8I5G Change-Id: I436b4c13a4ce07f5e9e5d374163bc4de55cd2cde Reviewed-on: https://gerrit.libreoffice.org/c/core/+/129766 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 8e94ec9d93fe3e1057fb1aaa2f0419114c4ea11c)
2022-01-13sw: layout: fix wrongly positioned table rows in --convert-to pdfMichael Stahl
If the document is loaded via UI, the first layout action is triggered from resizing the Window and the table is positioned properly on the first try. If the document is loaded via --convert-to, only getRendererCount() formats the content of the table, and the table is positioned 3 times but its first row is only positioned 2 times. The first time the table id="56" is positioned, the previous table id="50" is at correct Y 5988 but its content isn't formatted yet, so its height is almost 0 (just table's border etc.), so the table ends up at y = 6271. The second time the table id="56" is positioned, the previous table id="50" is at wrong Y 7937 and its content is valid, so its height is 1203, so the table ends up at y = 9140. The third time the table id="56" is positioned, the previous table id="50" is at correct Y 5988 and its content is valid, so its height is 1203, so the table ends up at correct y = 7191 ... but the first SwRowFrame remains at y = 9140 and is never repositioned, and the lower rows are cut off (invisible). Change SwTabFrame::MakeAll() so that a MakePos() that moves the table itself does not leave the first SwRowFrame's position valid, which should ensure that all rows are repositioned. (And work around C++'s particularly unhelpful type system.) This happens since the earliest version checked, OOo 3.3. Change-Id: If3dfe1ffcb81e03aa4f4bffcf33a237f0c92bd08 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/89735 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@cib.de>
2021-12-07docx export: preserve spaces in field instructionsVasily Melenchuk
MS Word is putting spaces between field mark and field instruction text. Writer preserves these spaces, but without xml:space="preserve" they are not displayed by Word later. Conflicts: sw/source/filter/ww8/docxattributeoutput.cxx Change-Id: I480e6febf0ee278b56e9dfc6e0430c5fd5bdfd71 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/125875 Tested-by: Jenkins Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de>
2021-11-29docx export: preserve spaces in field instructionsVasily Melenchuk
MS Word is putting spaces between field mark and field instruction text. Writer preserves these spaces, but without xml:space="preserve" they are not displayed by Word later. Conflicts: sw/source/filter/ww8/docxattributeoutput.cxx Change-Id: I480e6febf0ee278b56e9dfc6e0430c5fd5bdfd71 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/125875 Tested-by: Jenkins Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de>
2021-11-17ofz#40593 remove Objects from m_xResizeDrawObjects if deleted during parseCaolán McNamara
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/124563 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 2f01faaf88b6d172d7293f0c9e2a061d99b8ceb5) fix misplaced line Reviewed-on: https://gerrit.libreoffice.org/c/core/+/124630 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 4ed359093c991291216c39cffe14a60e607ec551) Change-Id: I11fa665175ef067a36f4822676c02d4df1e1e250
2021-11-17ofz#39252 use safer SwUnoCursor for the pos to move back toCaolán McNamara
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/122611 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit ca844cbdc3e933e3082e9cde0632445916de819e) Change-Id: Iba6f200cea92196986bd30564cf56ab5d8b954b1
2021-11-17ofz#38011 save and restore m_pLastAnchorPos via UnoCursorCaolán McNamara
when we do some operations that may delete paragraphs Change-Id: I2165dd287771f06c6d0fd061dd7659b06db4bd72 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/121511 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit bc7baa18435000f47f90e47d3300710bcb4cf56b)
2021-11-17ofz#37322 Bad-castCaolán McNamara
use a SwUnoCursor for the LastAnchorPos around here, this is similar to ofz#9858 Bad-cast Change-Id: I194a39ae13c382740b0ba8145dcc33fb2107105d Reviewed-on: https://gerrit.libreoffice.org/c/core/+/120679 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit c1cd505c67a53a0a27589889b34641612d10946d)
2021-11-17crashtesting: UaF on layout of fdo53985-1.docxCaolán McNamara
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/119060 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit ceb32f59d96a17c3007ed883fb44bc880673c8e0) Change-Id: Id8ca0d277f485347e21bd8d6d68de2a7de13de48
2021-11-17Only change SwLayAction::m_bAgain via SetAgainCaolán McNamara
no logic change intended Reviewed-on: https://gerrit.libreoffice.org/c/core/+/118983 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 3a5383892e1f0e22558cd56cb77d56a09c515b7a) Change-Id: Ib0174f8040faa3efde7b9c5ba9b062bac5a35da3
2021-11-17crashtesting: UaF on layout of ooo98566-1.odtCaolán McNamara
in: sw/source/core/text/itrform2.cxx:2643 SwTextFormatter::NewFlyCntPortion at: pFly = static_cast<SwTextFlyCnt*>(pHint)->GetFlyFrame(pFrame) (gdb) print m_pCurr $2 = (SwLineLayout *) 0x55ea220a0020 after calling GetFlyFrame m_pCurr is unchanged and we will call m_pCurr->MaxAscentDescent on it. But m_pCurr is deleted during GetFlyFrame by... #18 0x00007f98c5cd337f in SwLineLayout::~SwLineLayout() (this=this@entry=0x55ea220a0020, __in_chrg=<optimized out>) at source/libo-core/sw/source/core/text/portxt.hxx:26 #19 0x00007f98c5cd347a in SwParaPortion::~SwParaPortion() (this=0x55ea220a0020, __in_chrg=<optimized out>) at source/libo-core/sw/source/core/text/porlay.cxx:2491 #20 0x00007f98c5cd3485 in SwParaPortion::~SwParaPortion() (this=0x55ea220a0020, __in_chrg=<optimized out>) at source/libo-core/sw/source/core/text/porlay.cxx:2491 #21 0x00007f98c5d05e70 in std::default_delete<SwParaPortion>::operator()(SwParaPortion*) const (__ptr=<optimized out>, this=<optimized out>) at /usr/include/c++/8/bits/unique_ptr.h:75 #22 0x00007f98c5d05e70 in std::unique_ptr<SwParaPortion, std::default_delete<SwParaPortion> >::reset(SwParaPortion*) (__p=<optimized out>, this=<optimized out>) at /usr/include/c++/8/bits/unique_ptr.h:382 #23 0x00007f98c5d05e70 in SwTextLine::SetPara(SwParaPortion*, bool) (bDelete=true, pNew=0x0, this=<optimized out>) at source/libo-core/sw/source/core/text/txtcache.hxx:45 #24 0x00007f98c5d05e70 in SwTextFrame::ClearPara() (this=this@entry=0x55ea21302b60) at source/libo-core/sw/source/core/text/txtcache.cxx:113 #25 0x00007f98c5d1be89 in SwTextFrame::Init() (this=this@entry=0x55ea21302b60) at source/libo-core/sw/source/core/text/txtfrm.cxx:757 #26 0x00007f98c5d2630c in SwTextFrame::Prepare(PrepareHint, void const*, bool) (this=0x55ea21302b60, ePrep=PrepareHint::FlyFrameArrive, pVoid=<optimized out>, bNotify=<optimized out>) at source/libo-core/sw/source/core/text/txtfrm.cxx:3086 #27 0x00007f98c5b1edb8 in SwFlyInContentFrame::NotifyBackground(SwPageFrame*, SwRect const&, PrepareHint) (this=<optimized out>, rRect=..., eHint=<optimized out>) at source/libo-core/sw/inc/anchoredobject.hxx:205 #28 0x00007f98c5b261a6 in Notify(SwFlyFrame*, SwPageFrame*, SwRect const&, SwRect const*) (pFly=pFly@entry=0x55ea21a18d60, pOld=0x0, rOld=SwRect = {...}, pOldPrt=pOldPrt@entry=0x7ffeb50390f8) at source/libo-core/sw/source/core/inc/frame.hxx:1177 #29 0x00007f98c5b2ceca in SwFlyNotify::~SwFlyNotify() (this=0x7ffeb50390d0, __in_chrg=<optimized out>) at source/libo-core/sw/source/core/layout/frmtool.cxx:648 #30 0x00007f98c5b1fa25 in SwFlyInContentFrame::MakeAll(OutputDevice*) (this=0x55ea21a18d60) at source/libo-core/sw/source/core/inc/frmtool.hxx:419 #31 0x00007f98c5aec3a9 in SwFrame::PrepareMake(OutputDevice*) (this=0x55ea21a18d60, pRenderContext=0x55ea212bc4c0) at source/libo-core/sw/source/core/layout/calcmove.cxx:375 #32 0x00007f98c5b17ad2 in SwFlyFrame::Calc(OutputDevice*) const (this=<optimized out>, pRenderContext=<optimized out>) at source/libo-core/sw/source/core/layout/fly.cxx:2890 #33 0x00007f98c5b636c5 in SwObjectFormatter::FormatLayout_(SwLayoutFrame&) (this=this@entry=0x55ea2244d150, _rLayoutFrame=...) at source/libo-core/include/rtl/ref.hxx:206 #34 0x00007f98c5b6413e in SwObjectFormatter::FormatObj_(SwAnchoredObject&) (this=this@entry=0x55ea2244d150, _rAnchoredObj=...) at source/libo-core/sw/source/core/layout/objectformatter.cxx:296 #35 0x00007f98c5b6705b in SwObjectFormatterTextFrame::DoFormatObj(SwAnchoredObject&, bool) (this=0x55ea2244d150, _rAnchoredObj=..., _bCheckForMovedFwd=<optimized out>) at source/libo-core/sw/source/core/layout/objectformattertxtfrm.cxx:136 #36 0x00007f98c5b6359f in SwObjectFormatter::FormatObj(SwAnchoredObject&, SwFrame*, SwPageFrame const*) (_rAnchoredObj=..., _pAnchorFrame=<optimized out>, _pPageFrame=<optimized out>) at source/libo-core/sw/source/core/layout/objectformatter.cxx:190 #37 0x00007f98c5d717aa in SwTextFlyCnt::GetFlyFrame_(SwFrame const*) (this=this@entry=0x55ea214d8810, pCurrFrame=pCurrFrame@entry=0x55ea21302b60) at source/libo-core/sw/source/core/inc/frame.hxx:1177 #38 0x00007f98c5cb511b in SwTextFlyCnt::GetFlyFrame(SwFrame const*) (pCurrFrame=0x55ea21302b60, this=0x55ea214d8810) at source/libo-core/sw/inc/txtflcnt.hxx:48 #39 0x00007f98c5cb511b in SwTextFormatter::NewFlyCntPortion(SwTextFormatInfo&, SwTextAttr*) const (this=this@entry=0x7ffeb503a6b0, rInf=..., pHint=0x55ea214d8810) at source/libo-core/sw/source/core/text/itrform2.cxx:2643 (gdb) print this (SwLinePortion * const) 0x55ea220a0020 The SwTextFrame of SwTextFrame::ClearPara is the same pFrame/m_pFrame at SwTextFormatter::NewFlyCntPortion ClearPara is not called if the SwTextFrame is "Locked", so try using that to protect GetFlyFrame Change-Id: Ia9dcb1f345f6953d995f2acf1ec23492d1680364 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/118784 Tested-by: Jenkins Tested-by: Caolán McNamara <caolanm@redhat.com> Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 7e016df70d4ceb6c90ec5f1b129b50a65ff07505)
2021-11-17ofz#34749 don't remove trailing paragraph if something got anchored to itCaolán McNamara
Change-Id: Ic6eec2f9829c415abd4f2628bc51efbf98f918fb Reviewed-on: https://gerrit.libreoffice.org/c/core/+/118228 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit e803875fbb86b24b39fcd9adcf7df40ed255ea8f)
2021-11-17Try to fix Ubsan TBJulien Nabet
/sw/source/core/text/inftxt.cxx:651:37: runtime error: downcast of address 0x6060006542c0 which does not point to an object of type ´const SwTextPortion´ 0x6060006542c0: note: object is of type ´SwBookmarkPortion´ 3f 07 00 26 d0 ca 08 e3 2b 2b 00 00 2d 00 00 00 00 00 00 00 49 01 00 00 00 00 00 00 60 42 65 00 ^~~~~~~~~~~~~~~~~~~~~~~ vptr for ´SwBookmarkPortion´ 0x2b2bda76d6b7 in SwTextPaintInfo::DrawText_(rtl::OUString const&, SwLinePortion const&, o3tl::strong_int<int, Tag_TextFrameIndex>, o3tl::strong_int<int, Tag_TextFrameIndex>, bool, bool, bool, bool) /sw/source/core/text/inftxt.cxx:651:37 Taking a look at some other locations in the same file, it seems we need to test "rPor.InTextGrp()" to consider rPor as a SwTextPortion Reviewed-on: https://gerrit.libreoffice.org/c/core/+/123356 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 50602fed86b2b972d49d6c6366b2a3eb406e4ed4) Change-Id: I1739182a65f6738dad8623ec22950d797c59a6c7
2021-07-26sw: layout: fix red triangle problem with text frame in sectionsMichael Stahl
First, a document is loaded, then about 4 pages of content are pasted into it, in about 6 paste operations. In an idle layout action, a page's worth of content moves forward; the text frame at the bottom was split previously, and is joined. The follow has the same upper as the master text frame, so this causes the upper section frame to shrink: SwRect::operator=(const SwRect & rRect) Zeile 256 SwFrameAreaDefinition::FrameAreaWriteAccess::~FrameAreaWriteAccess() Zeile 112 SwSectionFrame::Shrink_(__int64 nDist, bool bTst) Zeile 2327 SwFrame::Shrink(__int64 nDist, bool bTst, bool bInfo) Zeile 1562 SwContentFrame::Cut() Zeile 1339 SwTextFrame::JoinFrame() Zeile 677 SwContentFrame::MakeAll(OutputDevice * __formal) Zeile 1310 The ToMaximize(false) check doesn't help because the section frame doesn't have a follow (or footnotes). Then the text frame is formatted, resulting in one line but no height for it, and a split after the one line. The split causes a follow section frame to be created, calling SwSectionFrame::SimpleFormat() on the master's upper: SwFrameAreaDefinition::FramePrintAreaWriteAccess::~FramePrintAreaWriteAccess() Zeile 120 SwFrame::SetTopBottomMargins(__int64 nTop, __int64 nBot) Zeile 175 SwRectFnSet::SetYMargins(SwFrame & rFrame, __int64 nTop, __int64 nBottom) Zeile 1405 SwSectionFrame::SimpleFormat() Zeile 1192 SwSectionFrame::SwSectionFrame(SwSectionFrame & rSect, bool bMaster) Zeile 110 SwFrame::GetNextSctLeaf(MakePageType eMakePage) Zeile 1781 SwFrame::GetLeaf(MakePageType eMakePage, bool bFwd) Zeile 879 SwFlowFrame::MoveFwd(bool bMakePage, bool bPageBreak, bool bMoveAlways) Zeile 1977 SwContentFrame::MakeAll(OutputDevice * __formal) Zeile 1349 SwFrame::PrepareMake(OutputDevice * pRenderContext) Zeile 286 SwFrame::Calc(OutputDevice * pRenderContext) Zeile 1794 SwTextFrame::CalcFollow(o3tl::strong_int<long,Tag_TextFrameIndex> nTextOfst) Zeile 281 SwTextFrame::AdjustFollow_(SwTextFormatter & rLine, o3tl::strong_int<long,Tag_TextFrameIndex> nOffset, o3tl::strong_int<long,Tag_TextFrameIndex> nEnd, const unsigned char nMode) Zeile 608 Now the upper has space but at this point the master text frame is valid and not invalidated, so it never grows into the available space. There is a check to format again in case additional space is available in SwTextFrame::CalcFollow() but peculiarly it's disabled if the upper is a section frame since initial CVS import. Removing this check appears to fix the problem. Change-Id: Ifad545f7e79675af6e33d68c7fcdbc82bd4f8f57 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/119419 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 44cc59db6f4f4f8b2ce5c993a31b5a019a8d7e97)
2021-05-20tdf#124675 sw: fix crash when moving SwTextFrame in table to prev pageMichael Stahl
The problem is that the SwTabFrame and SwRowFrame that are being iterated are deleted: 7 SwFrame::DestroyFrame(SwFrame*) (pFrame=0x79052c0) at sw/source/core/layout/ssfrm.cxx:386 8 SwTabFrame::RemoveFollowFlowLine() (this=0x5bf07d0) at sw/source/core/layout/tabfrm.cxx:907 9 SwTabFrame::MakeAll(OutputDevice*) (this=0x5bf07d0) at sw/source/core/layout/tabfrm.cxx:1839 10 SwFrame::PrepareMake(OutputDevice*) (this=0x5bf07d0) at sw/source/core/layout/calcmove.cxx:344 11 SwFrame::Calc(OutputDevice*) const (this=0x5bf07d0) at sw/source/core/layout/trvlfrm.cxx:1790 12 SwFrame::PrepareMake(OutputDevice*) (this=0x603a570) at sw/source/core/layout/calcmove.cxx:247 13 SwFrame::Calc(OutputDevice*) const (this=0x603a570) at sw/source/core/layout/trvlfrm.cxx:1790 14 SwFrame::PrepareMake(OutputDevice*) (this=0x5daf120) at sw/source/core/layout/calcmove.cxx:247 15 SwFrame::Calc(OutputDevice*) const (this=0x5daf120) at sw/source/core/layout/trvlfrm.cxx:1790 16 SwFrame::PrepareMake(OutputDevice*) (this=0x6005ca0) at sw/source/core/layout/calcmove.cxx:247 17 SwFrame::Calc(OutputDevice*) const (this=0x6005ca0) at sw/source/core/layout/trvlfrm.cxx:1790 18 SwFrame::MakePos() (this=0x6094330) at sw/source/core/layout/calcmove.cxx:490 19 SwTextFrame::MakePos() (this=0x6094330) at sw/source/core/text/frmform.cxx:343 20 SwContentFrame::MakeAll(OutputDevice*) (this=0x6094330) at sw/source/core/layout/calcmove.cxx:1346 21 SwFrame::OptPrepareMake() (this=0x6094330) at sw/source/core/layout/calcmove.cxx:368 22 SwFrame::OptCalc() const (this=0x6094330) at sw/source/core/inc/frame.hxx:1060 23 SwLayAction::FormatLayout(OutputDevice*, SwLayoutFrame*, bool) (this=0x7ffc6da48350, pLay=0x8a349c0, bAddRect=false) at sw/source/core/layout/layact.cxx:1362 24 SwLayAction::FormatLayout(OutputDevice*, SwLayoutFrame*, bool) (this=0x7ffc6da48350, pLay=0x79052c0, bAddRect=false) at sw/source/core/layout/layact.cxx:1357 25 SwLayAction::FormatLayoutTab(SwTabFrame*, bool) (this=0x7ffc6da48350, pTab=0x7a9c300, bAddRect=false) at sw/source/core/layout/layact.cxx:1569 26 SwLayAction::FormatLayout(OutputDevice*, SwLayoutFrame*, bool) (this=0x7ffc6da48350, pLay=0x7c30300, bAddRect=true) at sw/source/core/layout/layact.cxx:1354 27 SwLayAction::FormatLayout(OutputDevice*, SwLayoutFrame*, bool) (this=0x7ffc6da48350, pLay=0x79e1780, bAddRect=true) at sw/source/core/layout/layact.cxx:1357 28 SwLayAction::InternalAction(OutputDevice*) (this=0x7ffc6da48350) at sw/source/core/layout/layact.cxx:546 They are deleted because the last SwTextFrame was moved via MoveBwd() to the previous page, and is formatted there. (regression from commit 18765b9fa739337d2d891513f6e2fb7c3ce23b50) Prevent this via: * delete-guard for the SwRowFrame - causing RemoveFollowFlowLine() to return early (also, let it return false, so the Join() isn't even called, although that doesn't make a difference in practice because of the next item:) * join-guard for the SwTabFrame - otherwise tabfrm.cxx:2199 will Join() it anyway This means that when the page with the follow-frame is done formatting, the empty SwTabFrame with no SwTextFrame in it will remain. Fortunately this is not a problem, because due to the moving, the previous page will be invalid and layact.cxx:613 will iterate to the previous page and format it again; then tabfrm:2199 of the master SwTabFrame will detect that the follow SwTabFrame is empty and Join() it. Change-Id: I2cca89d63b81e7d4909319fa4feab2f5d67a6ff3 Reviewed-on: https://gerrit.libreoffice.org/71996 Tested-by: Jenkins Reviewed-by: Michael Stahl <Michael.Stahl@cib.de> (cherry picked from commit cc5916cd314a27b0cc99560ab887480026630a95) Reviewed-on: https://gerrit.libreoffice.org/72031 Tested-by: Xisco Faulí <xiscofauli@libreoffice.org> Reviewed-by: Miklos Vajna <vmiklos@collabora.com> (cherry picked from commit 232b467083dd3b55f261bebe084e696bee200ec9)
2021-03-29xmlsecurity: improve handling of multiple X509Data elementsMichael Stahl
Combine everything related to a certificate in a new struct X509Data. The CertDigest is not actually written in the X509Data element but in xades:Cert, so try to find the matching entry in XSecController::setX509CertDigest(). There was a confusing interaction with PGP signatures, where ouGpgKeyID was used for import, but export wrote the value from ouCertDigest instead - this needed fixing. The main point of this is enforcing a constraint from xmldsig-core 4.5.4: All certificates appearing in an X509Data element MUST relate to the validation key by either containing it or being part of a certification chain that terminates in a certificate containing the validation key. Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111254 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 9e82509b09f5fe2eb77bcdb8fd193c71923abb67) xmlsecurity: improve handling of multiple certificates per X509Data It turns out that an X509Data element can contain an arbitrary number of each of its child elements. How exactly certificates of an issuer chain may or should be distributed across multiple X509Data elements isn't terribly obvious. One thing that is clear is that any element that refers to or contains one particular certificate has to be a child of the same X509Data element, although in no particular order, so try to match the 2 such elements that the parser supports in XSecController::setX509Data(). Presumably the only way it makes sense to have multiple signing certificates is if they all contain the same key but are signed by different CAs. This case isn't handled currently; CheckX509Data() will complain there's not a single chain and validation of the certificates will fail. Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111500 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 5af5ea893bcb8a8eb472ac11133da10e5a604e66) xmlsecurity: add EqualDistinguishedNames() Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111545 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 1d3da3486d827dd5e7a3bf1c7a533f5aa9860e42) xmlsecurity: avoid exception in DigitalSignaturesDialog::getCertificate() Fallback to PGP if there's no X509 signing certificate because CheckX509Data() failed prevents the dialog from popping up. To avoid confusing the user in this situation, the dialog should show no certificate, which is already the case. Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111664 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 90b725675c2964f4a151d802d9afedd8bc2ae1a7) xmlsecurity: fix crash in DocumentDigitalSignatures::isAuthorTrusted() If the argument is null. This function also should use EqualDistinguishedNames(). Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111667 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit ca98e505cd69bf95d8ddb9387cf3f8e03ae4577d) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111910 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit a1cf770c2d7ca3e153e0b1f01ddcc313bc2bed7f) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/113058 Tested-by: Michael Stahl <michael.stahl@allotropia.de> Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> Change-Id: I9633a980b0c18d58dfce24fc59396a833498a77d
2021-01-25sw: WW8 import: filter control characters in GetFieldResult()Michael Stahl
Triggers the assert in SwSubFont::GetTextSize_() on ooo58234-1.doc, which has a field result with ^G cell separators that is converted to SwInputField, which inserts the field result into SwTextNode. Change-Id: Ibdb93390862a11462d62cf744bac912d6009777e Reviewed-on: https://gerrit.libreoffice.org/81788 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@cib.de> (cherry picked from commit 3a9d504b01c061f60a915b5681c8313859294118)
2021-01-25ofz#18526 sw: WW8 import: don't insert control charactersMichael Stahl
Sanitize string before calling InsertString(). This segfaults since: commit b522fc0646915d4da94df38dd249c88b28f25be7 Date: Tue Sep 24 18:11:45 2019 +0200 sw: maintain fieldmarks in DeleteRange()/DeleteAndJoin()/ReplaceRange() Change-Id: I9ef73d924420686f6838fa21900ec57b4d25c905 Reviewed-on: https://gerrit.libreoffice.org/81949 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> Tested-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 7ecda38cdaa2361e8510bf3e7206863c4936deab) Reviewed-on: https://gerrit.libreoffice.org/82759 (cherry picked from commit d494a4c0ead7db481757d8d67fbce9e1b02e65df)
2021-01-25sw: WW8 import: instead of control character insert '?' for footnoteMichael Stahl
SwWW8ImplReader::ReadChar() inserts a U+0002 control character to temporarily mark a footnote anchor; this is then deleted and replaced with a real footnote hint by SwWW8ImplReader::End_Footnote(). The assumption is that it is necessary to insert a placeholder character to be able to apply formatting to it. But if the document is corrupted, the control character could survive the import, which sounds less than ideal. So either make this magic character more explicit by documenting it in hintids.hxx and removing any outstanding ones at the end of the import, or use a non-offensive character instead; since this should only affect invalid documents, choose the solution with the least effort. Change-Id: I76d396258b32e0f0fb6393942a58a4dc57912211 Reviewed-on: https://gerrit.libreoffice.org/82760 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> Tested-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 13ba765c444713b0b0b2f4b4231bdafcbbef6ad0)
2021-01-25sw: UNO API: do not allow inserting control characters into nodesMichael Stahl
Refuse invalid input in DocInsertStringSplitCR(). Reviewed-on: https://gerrit.libreoffice.org/81696 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@cib.de> (cherry picked from commit 9b1e3e9bfdc0639630a367e45e4bdc2e9f22e503) Change-Id: I097c1b3a1f70b0cf1fa3fc33fc1d965ee6c96280
2021-01-25ofz#26480 validate WW8PLCFpcd is sorted like WW8PLCF doesCaolán McNamara
Change-Id: I11393c730986585aeea229ebeec6417e4a0578d9 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/104510 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 7f55db80c6fe42c162bbf51404e638a66b6ae9ab)
generated by cgit (git 2.34.1) at 2024-06-12 18:42:50 +0000