crashtesting: skip the deferred-break split in headers on the run path too

same fix as:

commit 671b1b51f26fbb8630d1f0022a6d2771bba938db
Date:   Wed Jun 10 15:31:58 2026 +0000

    crashtesting: skip the deferred-break paragraph split in headers and footers

that guarded the paragraph-mark branch of lcl_utext but not the run
branch beside it, which does the same finishParagraph plus
lcl_startParagraphGroup and pushes a CONTEXT_PARAGRAPH with no matching
pop. A column break as the first run of a header paragraph, followed by
text, flushes through the run branch, so tdf89392-1 still tripped the
stack-balance assert at the end of substream().

Reproduced with tdf89392-1.odt converted to docx and reloaded, dbgutil
build:

soffice.bin: sw/source/writerfilter/dmapper/DomainMapper_Impl.cxx:10400:
void writerfilter::dmapper::DomainMapper_Impl::substream(Id, const
writerfilter::Reference<writerfilter::Stream>::Pointer_t&): Assertion
`m_aContextStack.size() == contextSize' failed.

 #21 writerfilter::dmapper::DomainMapper_Impl::substream at sw/source/writerfilter/dmapper/DomainMapper_Impl.cxx:10400
 #22 writerfilter::dmapper::DomainMapper::lcl_substream at sw/source/writerfilter/dmapper/DomainMapper.cxx:5018
 #23 writerfilter::LoggedStream::substream at sw/source/writerfilter/dmapper/LoggedResources.cxx:272
 #24 writerfilter::ooxml::OOXMLDocument::resolveFastSubStreamWithId at sw/source/writerfilter/ooxml/OOXMLDocumentImpl.cxx:133
 #25 writerfilter::ooxml::OOXMLDocument::resolveHeader at sw/source/writerfilter/ooxml/OOXMLDocumentImpl.cxx:399
 #26 writerfilter::ooxml::OOXMLFastContextHandler::resolveHeader at sw/source/writerfilter/ooxml/OOXMLFastContextHandler.cxx:897
 #27 writerfilter::ooxml::OOXMLHeaderHandler::finalize at sw/source/writerfilter/ooxml/Handler.cxx:214

Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Ib1126759fca9ff7772a573b7737817fb5f1f3ee7
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6704
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>
(cherry picked from commit c1637ff78d7acd3fe8c081f7a4aefdd1a47910fb)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/209376
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
This commit is contained in:
Caolán McNamara
2026-08-20 13:55:17 +02:00
committed by Xisco Fauli
parent 29a5796177
commit d70403b9c6
@@ -4882,7 +4882,8 @@ void DomainMapper::lcl_utext(const sal_Unicode *const data_, size_t len)
{
// GetTopContext() is changed by inserted breaks, but we want to keep the current context
PropertyMapPtr pContext = m_pImpl->GetTopContext();
if (!m_pImpl->GetFootnoteContext() && !m_pImpl->IsInShape() && !m_pImpl->IsInComments())
if (!m_pImpl->GetFootnoteContext() && !m_pImpl->IsInShape() && !m_pImpl->IsInComments()
&& !m_pImpl->IsInHeaderFooter())
{
auto pPara = static_cast<ParagraphPropertyMap*>(m_pImpl->GetTopContextOfType(CONTEXT_PARAGRAPH).get());
if (m_pImpl->isBreakDeferred(PAGE_BREAK))