From 2a6fde04a7ad716117118e5dada895ec87e24de3 Mon Sep 17 00:00:00 2001 From: Miklos Vajna Date: Wed, 8 Dec 2021 12:58:22 +0100 Subject: sw: fix crash in SwFEShell::SelectObj() Crashreport signature: SwContact::GetFormat() sw/inc/dcontact.hxx:112 SwFEShell::SelectObj(Point const&, unsigned char, SdrObject*) sw/source/core/frmedt/feshview.cxx:292 SwWrtShell::UnSelectFrame() sw/source/uibase/wrtsh/select.cxx:326 SwWrtShell::DelRight() sw/source/uibase/wrtsh/delete.cxx:467 SwBaseShell::ExecDelete(SfxRequest&) sw/source/uibase/shells/basesh.cxx:198 I.e. it seems that in case we're in the middle of a delete, then it's possible that the mark list contains an SdrObject that doesn't have a matching SwClient anymore. Ignore such SdrObjects when looking for the textbox of a draw shape. Change-Id: I065b2ea44d39220184a5f604c3ea13f6a106ddb0 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/126537 Tested-by: Jenkins CollaboraOffice Reviewed-by: Mike Kaganski --- sw/source/core/frmedt/feshview.cxx | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/sw/source/core/frmedt/feshview.cxx b/sw/source/core/frmedt/feshview.cxx index 4247041b09b0..5a2385e19cf5 100644 --- a/sw/source/core/frmedt/feshview.cxx +++ b/sw/source/core/frmedt/feshview.cxx @@ -289,7 +289,13 @@ bool SwFEShell::SelectObj( const Point& rPt, sal_uInt8 nFlag, SdrObject *pObj ) for (size_t i = 0; i < rMrkList.GetMarkCount(); ++i) { SdrObject* pObject = rMrkList.GetMark(i)->GetMarkedSdrObj(); - SwFrameFormat* pFormat = GetUserCall(pObject)->GetFormat(); + SwContact* pContact = GetUserCall(pObject); + if (!pContact) + { + continue; + } + + SwFrameFormat* pFormat = pContact->GetFormat(); if (SwFrameFormat* pShapeFormat = SwTextBoxHelper::getOtherTextBoxFormat(pFormat, RES_FLYFRMFMT)) { SdrObject* pShape = pShapeFormat->FindSdrObject(); -- cgit