From 003b45624788610fba98e3f3334f99140017e472 Mon Sep 17 00:00:00 2001 From: Julien Nabet Date: Sun, 10 Jan 2021 15:42:31 +0100 Subject: Related tdf#123632: fix crash in accdoc (sw) Make sure to use gtk3 rendering - Open https://bugs.documentfoundation.org/attachment.cgi?id=149492 - Click F5 to open the navigator - Go to Images - Try double click the third and last image at least 15 times -> crash, here's part of bt: Thread 1 "soffice.bin" received signal SIGSEGV, Segmentation fault. SwFrame::IsInTab (this=0x0) at sw/source/core/inc/frame.hxx:938 938 if ( mbInfInvalid ) (gdb) bt 0 SwFrame::IsInTab() const (this=0x0) at sw/source/core/inc/frame.hxx:938 1 0x00007fd7e78caf9c in SwAccessibleDocument::getExtendedAttributes() (this=0x7e4e090) at sw/source/core/access/accdoc.cxx:596 2 0x00007fd7e78cbf9d in non-virtual thunk to SwAccessibleDocument::getExtendedAttributes() () at sw/source/core/access/accdoc.cxx:708 3 0x00007fd7f18f90ad in attribute_set_new_from_extended_attributes(com::sun::star::uno::Reference const&) (rExtendedAttributes=uno::Reference to (SwAccessibleDocument *) 0x7e4e180) at vcl/unx/gtk3/a11y/gtk3atktextattributes.cxx:1229 4 0x00007fd7f19113f3 in wrapper_get_attributes(_AtkObject*) (atk_obj=0x7df37d0) at vcl/unx/gtk3/a11y/gtk3atkwrapper.cxx:394 I put "Related" because I don't know if it corresponds to the initial bug but I used the attached file of the bugtracker Change-Id: Ief9fda9f7bcf277d18490169eee2e43fb046a1bf Reviewed-on: https://gerrit.libreoffice.org/c/core/+/109051 Tested-by: Jenkins Reviewed-by: Michael Stahl --- sw/source/core/access/accdoc.cxx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sw/source/core/access/accdoc.cxx b/sw/source/core/access/accdoc.cxx index a1661bb468d5..7d920afc7d17 100644 --- a/sw/source/core/access/accdoc.cxx +++ b/sw/source/core/access/accdoc.cxx @@ -582,7 +582,7 @@ uno::Any SAL_CALL SwAccessibleDocument::getExtendedAttributes() { if (!(pCurrTextFrame->IsInTab() || pCurrTextFrame->IsInFootnote())) { - while( pTextFrame != pCurrTextFrame ) + while( pTextFrame && pTextFrame != pCurrTextFrame ) { //check header/footer pFrame = pTextFrame; -- cgit