crash on converting forums/ods/forum-en-39357.ods to xls, and on
recalculating INDIRECT cells in 14 other documents, a debug build
asserts:
soffice.bin: svl/source/notify/lstner.cxx:83: void SfxListener::StartListening(SfxBroadcaster&, DuplicateHandling): Assertion `!(bListeningAlready && eDuplicateHanding == DuplicateHandling::Unexpected) && "duplicate listener, try building with DBG_UTIL to find the other insert site."' failed.
#21 SfxListener::StartListening(SfxBroadcaster&, DuplicateHandling) at svl/source/notify/lstner.cxx:83
#22 SfxBasicManagerHolder::reset(BasicManager*) at sfx2/source/appl/appbaslib.cxx:70
#23 SfxObjectShell::InitBasicManager_Impl() at sfx2/source/doc/objxtor.cxx:845
#24 lcl_getBasicManagerForDocument(SfxObjectShell const&) at sfx2/source/doc/objxtor.cxx:656
#25 SfxObjectShell::GetBasicManager() const at sfx2/source/doc/objxtor.cxx:690
#26 SfxObjectShell::GetBasic() const at sfx2/source/doc/objxtor.cxx:799
#27 ScCompiler::ParseMacro(rtl::OUString const&, bool) at sc/source/core/tool/compiler.cxx:3830
#28 ScCompiler::NextNewToken(bool) at sc/source/core/tool/compiler.cxx:5137
#29 ScCompiler::CompileString(rtl::OUString const&) at sc/source/core/tool/compiler.cxx:5293
#30 XclExpChSourceLink::ConvertDataSequence(...) at sc/source/filter/excel/xechart.cxx:901
and the first StartListening of the pair was:
SfxBasicManagerHolder::reset(BasicManager*) at sfx2/source/appl/appbaslib.cxx:71
SfxObjectShell::InitBasicManager_Impl() at sfx2/source/doc/objxtor.cxx:845
lcl_getBasicManagerForDocument(SfxObjectShell const&) at sfx2/source/doc/objxtor.cxx:657
SfxObjectShell::GetBasicManager() const at sfx2/source/doc/objxtor.cxx:690
ScServiceProvider::MakeInstance(ScServiceProvider::Type, ScDocShell*) at sc/source/ui/unoobj/servuno.cxx:590
ScModelObj::createInstance(rtl::OUString const&) at sc/source/ui/unoobj/docuno.cxx:4085
basic::SfxScriptLibraryContainer::importLibraryElement(...)
Creating the BasicManager of a VBA mode document loads its VBA
document modules, and they create the VBA globals, which asks for
the document's BasicManager again. That nested InitBasicManager_Impl
gets the BasicManager under construction from the repository and
passes it to the holder, then the outer one passes the same one
again, so the holder starts listening to it twice.
That recursion is old, but crashtesting only reaches it since:
commit c8da2d3a99b3a318545f1947f57c929ac9b9a82d
Date: Sat Sep 26 20:23:11 2026 +0000
load the Basic project of a VBA mode Calc document after import
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/13614
Previously the import loaded the Basic project at once and the first
request for the BasicManager came from inside that load. Now with
macros not allowed the project stays unloaded, so the first request
comes later, from a formula, and the load runs inside it.
so make SfxBasicManagerHolder::reset do nothing when it is given the
BasicManager it already holds
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I5db2184ae0124879e47310d90b5371e1e2fb0235
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/14516
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit a095496e0d649882531fd8e211ec4179333adee0)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211941
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
/src/libreoffice/sw/source/core/table/swtable.cxx:2347:73: runtime error: member call on address 0x5ae75cdc3ea0 which does not point to an object of type 'SwNode'
#0 0x5ae73cde0805 in SwTable::GetTableNode() const /src/libreoffice/sw/source/core/table/swtable.cxx:2347:73
#1 0x5ae73cddf1d6 in SwTable::SwClientNotify(SwModify const&, SfxHint const&) /src/libreoffice/sw/source/core/table/swtable.cxx:329:39
#2 0x5ae73be96db9 in SwModify::CallSwClientNotify(SfxHint const&) const /src/libreoffice/sw/source/core/attr/calbck.cxx:276:20
#3 0x5ae73be96f81 in sw::BroadcastingModify::CallSwClientNotify(SfxHint const&) const /src/libreoffice/sw/source/core/attr/calbck.cxx:297:15
#4 0x5ae73c389203 in SwDoc::IsUsed(sw::BroadcastingModify const&) const /src/libreoffice/sw/source/core/doc/poolfmt.cxx:108:13
#5 0x5ae73c472533 in SwDoc::GetUniqueTableName() const /src/libreoffice/sw/source/core/docnode/ndtbl.cxx:4265:38
#6 0x5ae73c46dc3b in SwDoc::InsertTable(SwInsertTableOptions const&, SwPosition const&, unsigned short, unsigned short, short, SwTableAutoFormat const*, std::__1::vector<unsigned short, std::__1::allocator<unsigned short>> const*, bool, bool, rtl::OUString const&) /src/libreoffice/sw/source/core/docnode/ndtbl.cxx:379:22
#7 0x5ae73ba4ba51 in WW8TabDesc::CreateSwTable() /src/libreoffice/sw/source/filter/ww8/ww8par2.cxx:2415:30
#8 0x5ae73ba595f0 in SwWW8ImplReader::StartTable(int) /src/libreoffice/sw/source/filter/ww8/ww8par2.cxx:3428:23
a tracked deletion applied at import ran from one cell to two cells
later, and removed the whole section of the cell between them while
the table still listed that cell
a range that ends in another table, runs into a cell from outside, or
ends in a nested table leaves a box without its cell in the same way
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I1f07e0e1784d88e47feb97bce4490ba3db83e7cb
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/13647
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit 898c0e4329e20e3bc2988cc1f576bad1074fff4f)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211701
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
crash on import of bugtrackers/html/novell574949-2.html,
novell574949-3.html and novell688091-3.html, a debug build asserts:
soffice.bin: include/o3tl/typed_flags_set.hxx:168: constexpr typename o3tl::typed_flags<T>::Wrap operator&(E, E) [with E = SwFrameType; typename o3tl::typed_flags<T>::Wrap = o3tl::is_typed_flags<SwFrameType, 64511>::Wrap]: Assertion `o3tl::detail::isNonNegative( o3tl::to_underlying(lhs))' failed.
and valgrind of novell688091-3.html reports:
Invalid read of size 4
at SwFrame::GetType() const (frame.hxx:533)
by SwFrame::IsContentFrame() const (frame.hxx:1283)
by SwContentFrame::ImplGetNextContentFrame(bool) const (findfrm.cxx:523)
by SwContentFrame::GetPrevContentFrame() const (cntfrm.hxx:138)
by SwFrame::FindPrevCnt_() (findfrm.cxx:1250)
by SwFrame::FindPrevCnt() const (findfrm.cxx:267)
by SwTextFrame::IsHiddenNowImpl() const (txtfrm.cxx:1635)
by SwTextFrame::Prepare(PrepareHint, void const*, bool) (txtfrm.cxx:3047)
by SwFlyInContentFrame::NotifyBackground(SwPageFrame*, SwRect const&, PrepareHint) (flyincnt.cxx:230)
by SwFlyInContentFrame::DestroyImpl() (flyincnt.cxx:51)
by SwLayoutFrame::DestroyImpl() (ssfrm.cxx:509)
by SwSectionFrame::DestroyImpl() (sectfrm.cxx:192)
by SwLayoutFrame::DestroyImpl() (ssfrm.cxx:572)
by SwCellFrame::DestroyImpl() (tabfrm.cxx:6021)
by SwLayoutFrame::DestroyImpl() (ssfrm.cxx:572)
by SwRowFrame::DestroyImpl() (tabfrm.cxx:4853)
by SwTabFrame::DestroyImpl() (tabfrm.cxx:154)
by SwTableNode::DelFrames(SwRootFrame const*) (ndtbl.cxx:2530)
by (anonymous namespace)::TableSaveStruct::MakeTable(unsigned short, SwPosition&, SwDoc*) (htmltab.cxx:4754)
by SwHTMLParser::BuildTable(SvxAdjust, bool, bool, bool) (htmltab.cxx:5167)
Address 0x2d286d30 is 272 bytes inside a block of size 472 free'd
at operator delete(void*, unsigned long) (vg_replace_malloc.c:1146)
by SwSectionFrame::~SwSectionFrame() (sectfrm.cxx:197)
by SwFrame::DestroyFrame(SwFrame*) (ssfrm.cxx:392)
by SwLayoutFrame::DestroyImpl() (ssfrm.cxx:572)
by SwCellFrame::DestroyImpl() (tabfrm.cxx:6021)
by SwLayoutFrame::DestroyImpl() (ssfrm.cxx:572)
by SwRowFrame::DestroyImpl() (tabfrm.cxx:4853)
by SwTabFrame::DestroyImpl() (tabfrm.cxx:154)
by SwTableNode::DelFrames(SwRootFrame const*) (ndtbl.cxx:2530)
by (anonymous namespace)::TableSaveStruct::MakeTable(unsigned short, SwPosition&, SwDoc*) (htmltab.cxx:4754)
by SwHTMLParser::BuildTable(SvxAdjust, bool, bool, bool) (htmltab.cxx:5167)
SetControlSize creates a hidden temporary view to measure a form
control, so a layout exists while the document is still being parsed,
which is an unusual thing to attempt, so it seems easiest to just avoid
that entirely.
The temporary view is originally, since:
commit ff09ed094d
Date: Mon Jul 7 11:06:22 2008 +0000
INTEGRATION: CWS ab53 (1.26.112); FILE MERGED 2008/06/20 06:47:28 tkr 1.26.112.1: #i47763# synchronous html import
But svx already had a way to get a control for a plain window with no
view with:
commit e1137040e3
Date: Tue Nov 14 12:48:07 2006 +0000
INTEGRATION: CWS aw024 (1.18.138); FILE MERGED ... 2006/03/21 13:20:59 fs 1.18.138.7: #i62854# +GetTemporaryControlForWindow ...
The recent problem only shows up in crashtesting since hidden text
support was added to html filter in:
commit eb9ca728e179aab3f51be4d96b02a03e502a1f87
Date: Fri Sep 18 08:36:02 2026 +0200
Related: cool#16219 engine sw HTML import: handle hidden text
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/12991
so drop the temporary view and realize the control with
GetTemporaryControlForWindow in a hidden window of the parser's own
when there is no view. valgrind is clean on all of these documents,
and the 104 controls in them and in the sw HTML test documents keep
the same sizes.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I47c26c7efba47f747cd1ec29b21350172b1df0c2
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/13960
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit c7e0ef4a46fb127962a69b2124de46bc46486685)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211685
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
vcl/source/outdev/ImplMapRes.cxx:190:23: runtime error: signed integer overflow: 0 - -9223372036854775808 cannot be represented in type 'tools::Long' (aka 'long')
#0 0x5afc86b89af9 in AbsoluteToLocalX vcl/source/outdev/ImplMapRes.cxx:190:23
#1 0x5afc86b89af9 in ImplMapRes::TransformPointX(long, ImplMapRes const&) const vcl/source/outdev/ImplMapRes.cxx:214:21
#2 0x5afc862abe28 in OutputDevice::LogicToLogic(Point const&, MapMode const*, MapMode const*) const vcl/source/outdev/map.cxx:991:32
#3 0x5afc862ab0eb in OutputDevice::SetRelativeMapMode(MapMode const&) vcl/source/outdev/map.cxx:417:16
#4 0x5afc85733670 in (anonymous namespace)::GraphicExporter::GetGraphic((anonymous namespace)::ExportSettings const&, Graphic&, bool) svx/source/unodraw/UnoGraphicExporter.cxx:909:19
when none of the shapes rendered for a SmartArt fallback has any
content the bound stays empty, and the metafile origin taken from
the minimum of that empty range rounds to LONG_MIN
so start an empty bound at 0,0
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I7f35f6280a882cd5c49de3e411bc0d006cdf9725
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/13623
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit 47dca3b9edf464297b1cef08a6223885d12efebf)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211528
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
Timeout in rtf2pdffuzzer, stack sampled with gdb:
#14 writerfilter::rtftok::RTFDocumentImpl::dispatchDestination at sw/source/writerfilter/rtftok/rtfdispatchdestination.cxx:83
#15 writerfilter::rtftok::RTFTokenizer::dispatchKeyword at sw/source/writerfilter/rtftok/rtftokenizer.cxx:2190
#16 writerfilter::rtftok::RTFTokenizer::resolveKeyword at sw/source/writerfilter/rtftok/rtftokenizer.cxx:2146
a \fldinst cut off at the end of the file, before the field name ends,
was scanned for that end forever
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I1210ec48b0cbc333ab58b6662df71a22be8d0391
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/13416
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit 0b0a478ab8f533eb89dd1267e3d3860b8c62b167)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211455
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
A PPTX shape keeps the fit the file was saved with until its text is
edited, and after that it is fitted by our own rules.
The fontScale and lnSpcReduction of a normAutofit never reached the
shape, for three reasons.
Import passed fractions to the TextFitToSizeFontScale and
TextFitToSizeSpacingScale properties, which are percentages.
A missing lnSpcReduction was read as 100000, a full reduction,
instead of 0.
When both properties were set in one setPropertyValues call along
with TextFitToSize, the collected fit item was applied last and
overwrote the scales.
Change-Id: I6b7fcfb6a1822f289f18b8ce77e78526a80f8944
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/13539
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
(cherry picked from commit c6938c35aa527883e2fd867f36e22c396601d376)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211506
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
seen on converting forums/xlsx/forum-mso-en4-237685.xlsx to xls and
doing a hard recalculation of the reloaded export, which aborts with:
soffice.bin: sc/inc/formulacell.hxx:514: void ScFormulaCell::MaybeInterpret():
Assertion `!rDocument.IsThreadedGroupCalcInProgress()' failed.
#11 ScFormulaCell::MaybeInterpret at sc/inc/formulacell.hxx:514
#12 ScFormulaCell::IsEmpty at sc/source/core/data/formulacell.cxx:3218
#13 ScRefCellValue::hasEmptyValue at sc/source/core/data/cellvalue.cxx:705
#14 ScInterpreter::Compare at sc/source/core/tool/interpr1.cxx:881
#15 ScInterpreter::ScNotEqual at sc/source/core/tool/interpr1.cxx:1162
#16 ScInterpreter::DispatchOpCode at sc/source/core/tool/interpr4.cxx:3852
#17 ScInterpreter::Interpret at sc/source/core/tool/interpr4.cxx:4414
#18 ScFormulaCell::InterpretTail at sc/source/core/data/formulacell.cxx:2274
#19 ScColumn::CalculateInThread at sc/source/core/data/column2.cxx:3270
#20 ScTable::CalculateInColumnInThread at sc/source/core/data/table1.cxx:2740
#21 ScDocument::CalculateInColumnInThread at sc/source/core/data/documen8.cxx:421
#22 Executor::doWork at sc/source/core/data/formulacell.cxx:5541
#23 comphelper::ThreadTask::exec at comphelper/source/misc/threadpool.cxx:320
lcl_InterpretSpan calculates the first cell of a dirty span with a
group call and the cells after it one at a time, and rechecks only
the cells it calculated one at a time.
The first cell can still be dirty when that call returns. The
dependency walk found a cycle, so the group was rejected, and that is
recorded on the group itself, as mbPartOfCycle and a meCalcState of
GroupCalcDisabled. Interpret then skips InterpretTail, so that only
the group which starts the cycle is calculated.
Both flags sit on the group that was rejected, while lcl_InterpretSpan
looks at the parent group. The bool it gets back says whether a group
interpret was done, not whether this cell was calculated, so the cell
has to be asked.
The rest of the span and the ungrouped cells have been checked for
exactly this since:
commit 4f36f2ccab
Date: Fri Sep 4 15:51:07 2020 +0200
detect if a cell still needs interpreting after Interpret()
so check the first cell too, and leave the group to the unthreaded
path when it was left uncalculated
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I3756ed54fbbb9caf48467e0faab5f5cdddb8e5da
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/12674
Reviewed-by: Tomaž Vajngerl <tomaz.vajngerl@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit e685bd07146af13db00f6b6811b74d2eba297d80)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211379
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
==1168891==ERROR: AddressSanitizer: heap-use-after-free on address 0x7cc3f9900268
READ of size 8 at 0x7cc3f9900268 thread T0
#0 in BigPtrEntry::GetPos() const sw/inc/bparr.hxx:107:5
#1 in SwNode::GetIndex() const sw/inc/node.hxx:317:57
#2 in SwTableBox::GetSttIdx() const sw/source/core/table/swtable.cxx:2288:41
#3 in SwCellFrame::SwCellFrame(SwTableBox const&, SwFrame*, bool) sw/source/core/layout/tabfrm.cxx:5968:37
#4 in SwRowFrame::SwRowFrame(SwTableLine const&, SwFrame*, bool) sw/source/core/layout/tabfrm.cxx:4822:33
#5 in SwTabFrame::SwTabFrame(SwTable&, SwFrame*) sw/source/core/layout/tabfrm.cxx:109:32
#6 in SwTableNode::MakeFrame(SwFrame*) sw/source/core/docnode/ndtbl.cxx:2474:16
#7 in InsertCnt_(SwLayoutFrame*, SwDoc&, ...) sw/source/core/layout/frmtool.cxx:1735:34
#8 in SwRootFrame::Init(SwFrameFormat*) sw/source/core/layout/newfrm.cxx:511:5
#9 in SwViewShell::Init(SwViewOption const*, long) sw/source/core/view/vnew.cxx:143:23
An empty table cell keeps its section because the SwTableBox that owns
the cell points at the start node. Nothing updates
SwTableBox::m_pStartNode, so removing the section leaves the table's
sort array holding a box that points at freed memory.
The ww8 import flushes its redline stack in WW8TabDesc::FinishSwTable
when the table finishes, and a tracked change that continues across a
cell mark gives a range with its two ends in different cells, and
applying it emptied the cell section.
so keep the empty start/end pair only when the table that owns the
cell survives the deletion too
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Ia3f9cb45e361095f17a5a544f1efcd2a7465ef3f
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/11630
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit f196f8dfeda9ee0bdc7dc859f456582ddb0ce054)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211378
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
seen on converting interop-test-files/doc/forum-mso-en4-218597.doc to
rtf and reloading the export, which aborts with:
soffice.bin: sw/source/writerfilter/dmapper/DomainMapper_Impl.cxx:10493:
void writerfilter::dmapper::DomainMapper_Impl::substream(Id, const
writerfilter::Reference<writerfilter::Stream>::Pointer_t&):
Assertion `m_aContextStack.size() == contextSize' failed.
#12 writerfilter::dmapper::DomainMapper_Impl::substream at engine/sw/source/writerfilter/dmapper/DomainMapper_Impl.cxx:10494
#13 writerfilter::dmapper::DomainMapper::lcl_substream at engine/sw/source/writerfilter/dmapper/DomainMapper.cxx:5039
#14 writerfilter::LoggedStream::substream at engine/sw/source/writerfilter/dmapper/LoggedResources.cxx:275
#15 writerfilter::rtftok::RTFDocumentImpl::resolveSubstream at engine/sw/source/writerfilter/rtftok/rtfdocumentimpl.cxx:407
#16 writerfilter::rtftok::RTFDocumentImpl::resolveSubstream at engine/sw/source/writerfilter/rtftok/rtfdocumentimpl.cxx:379
#17 writerfilter::rtftok::RTFDocumentImpl::sectBreak at engine/sw/source/writerfilter/rtftok/rtfdocumentimpl.cxx:778
#18 writerfilter::rtftok::RTFDocumentImpl::dispatchSymbol at engine/sw/source/writerfilter/rtftok/rtfdispatchsymbol.cxx:217
In the header \intbl makes the table buffer current, so \shptxt buffers
the shape start instead of sending it to the dmapper. A paragraph mark
inside the shape text finds no table properties in that buffer and
decides it is not in a table. Replaying the buffer then sends the start
to the dmapper, and the start pushes a paragraph context.
When the shape text group ends the current buffer is still set, so the
end is appended to the buffer that was just drained. Nothing replays
that buffer again, so the paragraph context stays on the stack and the
header substream ends deeper than it began.
The start and the end have tested the current buffer separately since:
commit 818d80eb0c
Date: Fri Jun 28 16:47:49 2013 +0200
RTF import: support shapes inside tables
so remember whether the shape is open in the dmapper, and send its end
there directly when it is
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Ifb94f77e3db4d3fcc6041a7927e88c62d9d970a4
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/12757
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 306c1f840c413b352940513c83d1498d599b8359)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211313
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
seen on converting interop-test-files/odt/ooo115853-3.odt to odt,
which faults with:
#0 SwLayoutFrame::Lower() const (this=0x0) at engine/sw/source/core/inc/layfrm.hxx:103
#1 SwLayoutFrame::ContainsContent() const (this=0x0) at engine/sw/source/core/layout/findfrm.cxx:107
#2 GetBodyTextNode at engine/sw/source/core/fields/expfld.cxx:234
#3 SwChapterField::ChangeExpansion at engine/sw/source/core/fields/chpfld.cxx:145
#4 SwTextFormatter::NewFieldPortion at engine/sw/source/core/text/txtfld.cxx:113
...
#20 SwViewShell::CalcLayout() at engine/sw/source/core/view/viewsh.cxx:1005
#21 SwEditShell::CalcLayout() at engine/sw/source/core/edit/edws.cxx:89
#22 SwXFrame::getPropertyValue at engine/sw/source/core/unocore/unoframe.cxx:2225
#23 XMLTextParagraphExport::addTextFrameAttributes at engine/xmloff/source/text/txtparae.cxx:2969
A chapter field in the header asks GetBodyTextNode which text node the
page starts with. When the first body content of the page sits in the
repeated headline of a follow table, that headline is a repeat of the
master table's heading, so the code takes the first row after it
instead.
GetFirstNonHeadlineRow returns nothing when the follow holds only
repeated headline rows. The export reaches it in the middle of a
layout calculation, which SwXFrame::getPropertyValue starts in order
to answer a property of a text frame in a table cell.
GetFrameInPage in trvlfrm.cxx does the same step for the same reason
and checks the row it gets. Both callers arrived together,
probably since:
commit a3db03b8d4
Date: Mon May 3 12:45:37 2004 +0000
INTEGRATION: CWS gt03 (1.17.22); FILE MERGED 2004/03/11 14:55:03 fme 1.17.22.1: #26165# Feature - Multiple headline rows in tables
so check the row here too, and leave the fallback underneath to take
the content below the header
Not reproduced locally. The odt export runs clean here, under the
crashtest font set and through the harness round trip as well, and the
branch is reached eight times on this document with a row present each
time. Setting that row to null under gdb gives the frames above.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I5adb3b9495cfafe11cfa98d701a8ab7476b986bc
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/12786
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 653b962592ae7ee257c8b7d28070e95d35cd09e1)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211312
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
seen on converting interop-test-files/odt/tdf118553-1.odt, tdf118558-1.odt
and tdf91677-1.odt to doc and reloading the exports
One dies with a stack overflow, SwFrame::InvalidateInfFlags recursing
between a column frame and a body frame that are each other's upper. The
other two abort on the pTmp->IsTabFrame() assertion at
sw/source/core/layout/sectfrm.cxx:2016 in SwFrame::GetNextSctLeaf, reached
through SwFrame::GetNextFootnoteLeaf and SwContentFrame::MoveFootnoteCntFwd.
Every doc import turns on ContinuousEndnotes, so AppendFootnote makes a
section frame for the endnotes at the end of the document and inserts it
into the page's body frame. When the page style has more than one column the
body's lowers are column frames and all the text lives in the column bodies,
so the endnote section became a sibling of the columns. Its next sibling is
then a column frame, which GetNextSctLeaf doesn't expect, and the move it
makes puts a column frame under its own child body frame.
since:
commit 6885dcd7ec
Date: Tue May 14 08:28:33 2024 +0200
tdf#160984 sw continuous endnotes: switch to a section-based layout
so work out where the section belongs once, in GetEndNoteSectionUpper, and
let both the insert and GetEndNoteSection ask it
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I474131fca4f74254a5168d79d83ba11116abc692
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/12675
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
(cherry picked from commit f29d74eea952d3a9ea90b32afe2c9a8047afc10a)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211310
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
reproduce by converting novell485609-1.doc to odt and loading the
export, which fails with:
warn:sax:19444:19444:sax/source/fastparser/fastparser.cxx:649: Unexpected exception from XML parser com.sun.star.lang.IllegalArgumentException message: "at sw/source/core/unocore/unotext.cxx:923" ArgumentPosition: 0
Error: source file could not be loaded
#0 SwXText::ComparePositions (this=0x55555962dab8, xPos1=..., xPos2=...) at sw/source/core/unocore/unotext.cxx:923
#1 0x00007fffcb3ae036 in SwXText::compareRegionStarts (this=0x55555962dab8, xRange1=..., xRange2=...) at sw/source/core/unocore/unotext.cxx:965
#2 0x00007fffe7ec5ccc in InsertFieldmark (rImport=..., rHelper=..., isFieldmarkSeparatorMissing=false) at xmloff/source/text/XMLTextMarkImportContext.cxx:196
#3 0x00007fffe7ec7743 in XMLTextMarkImportContext::endFastElement (this=0x5555597140d0, nElement=3804281) at xmloff/source/text/XMLTextMarkImportContext.cxx:434
#4 0x00007fffe7aba6c2 in SvXMLImport::endFastElement (this=0x5555594e8030, Element=3804281) at xmloff/source/core/xmlimp.cxx:1086
CheckForOwnMember made a cursor and took the section node it landed in
as the node this text starts at. createXTextCursor moves forward to
the first content node, so in a cell that starts with a nested table
it lands in that table's first cell.
The fieldmark here is in a paragraph under such a table, so the check
reported it as belonging to some other text.
GetStartNode can be used to do this without a cursor and is apparently
the typical pattern used elsewhere.
see also:
commit 01ce0e62df
Date: Tue Jun 12 06:28:29 2001 +0000
#86004#: performance: check cursor position using start node
which moved insertString onto it, so use it here too, the last of
these checks that still makes a cursor
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I57ba4b23308daa1c0f3d6cb64686bce678f72aa6
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/13108
Reviewed-by: Michael Stahl <michael.stahl@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit b88b52f2694ff696e6141add82fc3c89b64243fc)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211294
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
The document-wide link update permission is decided when the document is
loaded. But media files that the users interactively inserts should be
automatically allowed.
Remember on the media object that the user picked the reference and
allow it on its own, the same way a presentation sound the user picks is
allowed. A reference that arrived with the document still needs the
document-wide permission.
since:
commit f0768394c14f928d47547408fc1195368be81f86
Date: Tue Jul 14 19:12:01 2026 +0100
put slideshow media links under link control
see also:
commit 0aa870b7b5a6bda50bab50c7a0a41d28fdf4f6ab
Date: Wed Jun 17 09:37:23 2026 +0000
bring external presentation sounds under link management
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-on: https://gerrit.collaboraoffice.com/c/core/+/7939
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Michael Stahl <michael.stahl@collabora.com>
(cherry picked from commit 17c0a99a0886b397d5682b87209e34c01fdcd44f)
Change-Id: I711fee12416e3e5e91fc07999ea62df32684b625
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211276
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
42 was never a flag value. SystemShellExecuteFlags publishes DEFAULTS 0,
NO_SYSTEM_ERROR_MESSAGE 1 and URIS_ONLY 2, and 42 needs bits 2, 8 and 32. It
was a private signal meaning the parameter is already quoted.
since:
commit c582b21de9
Date: Wed Jul 11 14:04:25 2007 +0000
INTEGRATION: CWS stclient (1.16.22); FILE MERGED 2007/07/03 07:43:38 obr 1.16.22.1: #b6573281# the answer to all questions
the only caller arrived the same day in
c61477eea7, a Solaris Service Tags startup job in
framework/source/jobs/shelljob.cxx. It defined the number as
ANSWER_TO_ALL_QUESTIONS and carried the comment explaining it, which is why a
bare 42 was all that was left here.
the job moved to osl_executeProcess in January 2008 in
5629b13246, and the wrapper it drove went in
6b8e02c741, "Kill Sun-specific stclient_wrapper".
unreachable regardless since URIS_ONLY took the value 2 in
d4b67611c4, because 42 & 2 is 2 and so the
URIS_ONLY test above it diverts any caller passing 42.
so always escape the parameter and drop the unused branch
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I6f95a0a6a1ff7d39456b999c11f8aa91e36833c0
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/12883
Reviewed-by: Stephan Bergmann <stephan.bergmann@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 0e4a3baffc249372706508681977a9c486e4d73f)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211109
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
reproduce by converting the crashtesting document
bitmapreadaccess_getpixelforn24bittcbgr_segmentation_fault.sample,
which is a pdf despite its name, to odg:
soffice.bin: sd/source/filter/pdf/sdpdffilter.cxx:102: bool ImportPDF(...):
Assertion `nPageNumber >= 0 && o3tl::make_unsigned(nPageNumber) < aGraphics.size()' failed.
pdfium cannot read three of the five pages here. Both the page size by
index and the page itself fail, so this isn't our size test being too
strict. The file is fuzzed, mutool reports a broken xref and an
invalid object number, and one MediaBox reads
[ 1612934155079108773 0 594 841 ].
ImportPDFUnloaded dropped each page that it couldn't read, so a five
page pdf became a two page Draw document with nothing to say three
pages were lost. The graphics that remained kept their own pdf page
numbers, which then had gaps, and the last one pointed past the end.
Keep an entry for every page the pdf declares. Such a page takes the
size of the last page that did come through, A4 to start, and warns.
It still carries its own page number, so there are no gaps left for
sd to trip over.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Id0d0bde13a2102b4e30cc0dd71edf17031406e1d
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/5639
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit 321ab2f58f62bf3037ee32e1696bacd14c8f06ed)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211020
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
every following newline was skipped, so stream data starting with
0x0a or 0x0d lost a byte and an encrypted stream decrypted to the
wrong bytes
CppunitTest_vcl_pdf_encryption failed at random in CI with:
PDFEncryptionTest.cxx:362:Assertion
Test name: (anonymous namespace)::testEmbeddedDocumentOfEncryptedHybridFile::TestBody
equality assertion failed
- Expected: 0
- Actual : -38
Failures !!!
Run: 16 Failure total: 1 Failures: 1 Errors: 0
since:
commit b6f98b7115
Date: Wed Oct 26 17:55:02 2016 +0200
xmlsecurity PDF verify: support SHA-256
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I72e4e72506942ed0151e5d96a1abc94cce1a059f
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/11825
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit b42ffcd8af9427a0ecdfe917d897db98d4f00b6f)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/210954
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
every custom xml item was given the values of every data-bound control,
so a document with two data stores came back with both controls showing
the same value, and testTdf147724 failed in ci with:
xmltesttools.cxx:214:Assertion
Test name: testTdf147724::Load_Verify_Reload_Verify
equality assertion failed
- Expected: Placeholder -> *ABC*
- Actual : Placeholder -> *HERUNTERLADEN*
- In <>, XPath contents of child does not match
the second control's data binding names no store, so the import picks a
store by std::unordered_map iteration order. That order differs from one
builder to the next, and the test accepts either value for that control,
so only some machines saw the failure.
since:
commit b5c616d10b
Date: Wed Nov 24 14:50:12 2021 +0300
tdf#104823: support for sdt plain text fields
so keep the storeItemID of the data binding along with the value and
only update the item whose ds:itemID matches it
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I794ebb7c647ecddcd2cee3e90c25145ba4c32b97
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/12083
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
(cherry picked from commit b522379deae4c9df243d0493a3d242e80822c171)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/210923
Tested-by: Jenkins
Tested-by: Xisco Fauli <xiscofauli@libreoffice.org>
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
drawinglayer/source/tools/emfphelperdata.cxx:771:32: runtime error: load of value 4280295456, which is not a valid value for type 'EmfPlusHatchStyle'
#0 0x7b14dd7d4d02 in emfplushelper::EmfPlusHelperData::EMFPPlusFillPolygon(basegfx::B2DPolyPolygon const&, bool, unsigned int) drawinglayer/source/tools/emfphelperdata.cxx:771:32
#1 0x7b14dd7f903a in emfplushelper::EmfPlusHelperData::processEmfPlusData(SvMemoryStream&, drawinglayer::geometry::ViewInformation2D const&) drawinglayer/source/tools/emfphelperdata.cxx:1776:29
#2 0x7b14dd7c020c in emfplushelper::EmfPlusHelper::processEmfPlusData(SvMemoryStream&, drawinglayer::geometry::ViewInformation2D const&) drawinglayer/source/tools/emfplushelper.cxx:41:14
#3 0x7b14dd932d9d in wmfemfhelper::implInterpretMetafile(GDIMetaFile const&, wmfemfhelper::TargetHolders&, wmfemfhelper::PropertyHolders&, drawinglayer::geometry::ViewInformation2D const&) drawinglayer/source/tools/wmfemfhelper.cxx:2957:43
#4 0x7b14dd919d51 in wmfemfhelper::interpretMetafile(GDIMetaFile const&, drawinglayer::geometry::ViewInformation2D const&) drawinglayer/source/tools/wmfemfhelper.cxx:2993:9
#5 0x7b14dd470d93 in drawinglayer::primitive2d::MetafilePrimitive2D::create2DDecomposition(drawinglayer::geometry::ViewInformation2D const&) const drawinglayer/source/primitive2d/metafileprimitive2d.cxx:42:42
#6 0x7f14fb527e4f in drawinglayer::primitive2d::BufferedDecompositionPrimitive2D::get2DDecomposition(drawinglayer::primitive2d::Primitive2DDecompositionVisitor&, drawinglayer::geometry::ViewInformation2D const&) const drawinglayer/source/primitive2d/BufferedDecompositionPrimitive2D.cxx:90:41
#7 0x7b14dd4727d5 in TestImportWMF drawinglayer/source/primitive2d/metafileprimitive2d.cxx:149:16
so keep the hatch style as the value read from the stream, and an
unknown one then reaches the switch default
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I9725f2f80d3a00fbf82ac5a84cf55b5c071af68b
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/11529
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 906c713f2cdd05372db04c1d807d31b1fff5377a)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/210589
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
reproduce by loading crashtesting (rtf) file:
swxtextframe_createtextcursorbyrange.sample
and exporting it to pdf:
#0 SwContentNode::GetSwAttrSet (this=0x0) at sw/inc/node.hxx:750
#1 SwTextFrame::RecalcAllLines at sw/source/core/text/txtfrm.cxx:4130
#2 SwLayAction::FormatContent at sw/source/core/layout/layact.cxx:1870
#3 SwLayAction::InternalAction at sw/source/core/layout/layact.cxx:640
#4 SwLayAction::Action at sw/source/core/layout/layact.cxx:418
#5 SwViewShell::CalcLayout at sw/source/core/view/viewsh.cxx:990
the frame at #2 has m_pMergedPara 0, GetDep() 0 and mbInDtor true, so
it was freed under the object formatting two statements earlier:
SwFrame::DestroyFrame (the follow)
SwTextFrame::JoinFrame frmform.cxx:778
SwTextFrame::AdjustFollow_ frmform.cxx:681
SwTextFrame::FormatAdjust / Format_ / Format
SwContentFrame::MakeAll calcmove.cxx:1633
SwFrame::Calc (the MASTER)
SwAnchoredDrawObject::MakeObjPosAnchoredAtPara
SwObjectFormatter::FormatObj_
SwObjectFormatterTextFrame::DoFormatObj
SwObjectFormatter::FormatObjsAtFrame_
FormatContent is formatting a follow frame. Placing a drawing object
anchored in that paragraph calls Calc on the master, the master reflows
and takes back its text, and JoinFrame then destroys the follow.
the loop already keeps an SfxDeleteListener on pContentPrev, so keep one
on pContent too and return false, and the caller invalidates the page and
runs it again.
no unit test, the layout tests only have the bundled fonts and this
document asks for Palatino Linotype. Only P052, its metric substitute,
keeps the layout that splits the paragraph, and P052 isn't bundled
either, so the document needs adjusting first.
reached since:
commit ac332d53d565325f3db2697126d97e02a15e4b5d
Date: Wed Aug 26 21:02:06 2026 +0000
crashtesting: pass the collected page number to CheckMovedFwdCondition
which dropped the DoFormatObj assert that used to stop this document
before the object formatting could complete the join.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I64e95ba6d3a6fda6ab585b5f319be2fb8bca8533
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/11273
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit ab7337476075e0b903ec5cb705821d8b3a14e9f7)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/210590
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
see on loading forums/xlsx/forum-mso-en4-748529.xlsx and doing a
hard recalculation, which aborts with:
soffice.bin: sc/inc/formulacell.hxx:514: void ScFormulaCell::MaybeInterpret():
Assertion `!rDocument.IsThreadedGroupCalcInProgress()' failed.
#4 ScFormulaCell::MaybeInterpret at sc/inc/formulacell.hxx:514
#5 ScFormulaCell::IsEmpty at sc/source/core/data/formulacell.cxx:3153
#6 FillMatrixHandler::operator() at sc/source/core/data/column2.cxx:2636
#7 sc::ParseBlock at sc/inc/mtvfunctions.hxx:66
#8 ScColumn::FillMatrix at sc/source/core/data/column2.cxx:2708
#9 ScTable::FillMatrix at sc/source/core/data/table1.cxx:2700
#10 ScDocument::FillMatrix at sc/source/core/data/documen8.cxx:400
#11 ScInterpreter::CreateMatrixFromDoubleRef at sc/source/core/tool/interpr5.cxx:386
#12 ScInterpreter::ScSpilledRange at sc/source/core/tool/interpr1.cxx:1703
#13 ScInterpreter::DispatchOpCode at sc/source/core/tool/interpr4.cxx:3868
#14 ScInterpreter::Interpret at sc/source/core/tool/interpr4.cxx:4414
#15 ScFormulaCell::InterpretTail at sc/source/core/data/formulacell.cxx:2209
#16 ScColumn::CalculateInThread at sc/source/core/data/column2.cxx:3270
#17 ScTable::CalculateInColumnInThread at sc/source/core/data/table1.cxx:2740
#18 ScDocument::CalculateInColumnInThread at sc/source/core/data/documen8.cxx:421
#19 Executor::doWork at sc/source/core/data/formulacell.cxx:5463
ScSpilledRange calculates cells itself. It calls MaybeInterpret on the
master cell of the dynamic array, and CreateMatrixFromDoubleRef then
covers the whole spill range, so FillMatrix asks every cell in that
range whether it is empty and IsEmpty calculates it. A worker thread
inside a threaded group calculation must not calculate a cell.
The dependency evaluator can't cover it either, only the operand's own
cell is named by a reference token and how far the spill reaches is
known only once that cell has been calculated
an issue since:
commit 9b97b0fc91bce4b8726ea210347e8ea84270e148
Date: Mon Jul 6 13:09:39 2026 +0000
sc: add the # postfix operator for spilled-range references
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Id58e88d1bd927576e4723dd23bc119673feed108
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/11285
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Tomaž Vajngerl <tomaz.vajngerl@collabora.com>
(cherry picked from commit 89af05e8a5e8ce4ae337e2f0048f670940573930)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/210542
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
reproduce by loading ooo59043-1.odt and exporting it to the binary doc
format, which toggles the tracked-change display.
that save-time show and hide joins and splits the text nodes, and can
leave the spell wrong list with an invalid end past the now shorter
text.
the idle autospell then maps that end and asserts, here with nIndex 15
on a 12 char node:
soffice.bin: sw/source/core/text/txtfrm.cxx:1344:
Assertion `nIndex <= pNode->Len()' failed.
#4 sw::MapModelToView (nIndex=15) at txtfrm.cxx:1344
#5 SwTextFrame::MapModelToView (nIndex=15) at txtfrm.cxx:1385
#6 lcl_CalculateRepaintRect (nChgStart=0, nChgEnd=15) at txtedt.cxx
#7 SwTextFrame::AutoSpell_ at txtedt.cxx:1519
#8 SwLayIdle::DoIdleJob_ (ONLINE_SPELLING) at layact.cxx:2171
#9 SwLayIdle::DoIdleJob at layact.cxx:2312
#10 SwLayIdle::SwLayIdle at layact.cxx:2573
#11 SwViewShell::LayoutIdle at viewsh.cxx:927
#12 sw::DocumentTimerManager::DoIdleJobs at DocumentTimerManager.cxx:179
AutoSpell_ already tolerates the over-long end, set with std::max
against the text length a few lines up, and the word scanner stops at
the real end.
so clamp the repaint range the same way before it is mapped.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I5ad086753f8b3fc0f838a45a7291cd62a4d4a343
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6699
Reviewed-by: Andras Timar <andras.timar@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 1920f81f2df779c9787256c9ad93903640817419)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/210508
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
There are two rules for which node of a merged paragraph provides the
paragraph properties. The classic rule takes the first node that has
visible text.
Under the classic rule, when SwContentNode::DelFrames deletes the
properties node and it is also the last node, no node has visible text
left, so the merge must be empty. An assert checks that, and it always
held until:
commit 0849ddd0b1
Date: Wed Oct 8 19:29:46 2025 +0200
sw: text formatting: implement per-line paragraph properties like Word
which added the second rule: with a hidden paragraph mark the
properties node is the last node, even while earlier nodes still have
visible text. Now the same delete can happen while the merge still has
visible text, and the assert fires falsely.
So allow non-empty extents in hidden paragraph mode too. The existing
relocation loop already picks the correct new properties node under
both rules.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I599b0c09c92e5f9adaa1874a6de5a054eb947d8b
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/9281
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 29b5b72c31483af4585fe419ce1789b990c55c8e)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/210477
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
KillPython runs an inline CodeTaskFactory task that compiles a temporary
dll and loads it. Two parallel builds on one machine race over that dll,
and one build fails to find it:
pyproject.props(176,5): error MSB4175: The task factory "CodeTaskFactory"
could not be loaded from the assembly "...\Microsoft.Build.Tasks.Core.dll".
Could not find file '...\tmp\rmlsuizu\rmlsuizu.dll'.
KillPython only kills a stray python.exe that holds the output file open
across an incremental rebuild. A clean build has none to kill, so pass
/p:KillPython=false to override pythoncore.vcxproj and skip the target.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Ic6cc3d51d4409bce6cc95137626debcab67dbc53
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/10183
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit a287185f62eaa49f03ab0b3b2e5d956221ef9997)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/210291
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
reproduce by loading bugtrackers/docx/novell592907-1.docx under the
crashtest reduced font set:
soffice.bin: sw/source/core/layout/objectformattertxtfrm.cxx:235: virtual bool SwObjectFormatterTextFrame::DoFormatObj(SwAnchoredObject&, bool): Assertion `GetPageFrame().GetPhyPageNum() == GetPgNumOfCollected(nIdx)' failed.
#12 SwObjectFormatterTextFrame::DoFormatObj(SwAnchoredObject&, bool) at ./sw/source/core/layout/objectformattertxtfrm.cxx:238
#13 SwObjectFormatter::FormatObj(SwAnchoredObject&, SwFrame*, SwPageFrame const*, SwLayAction*) at ./sw/source/core/layout/objectformatter.cxx:191 (discriminator 3)
#14 CalcContent(SwLayoutFrame*, bool) at ./sw/source/core/layout/fly.cxx:1880 (discriminator 4)
a cluster of 27 crashtesting documents assert like this
partial revert of:
commit 533a998e54
Date: Thu May 6 18:20:14 2021 +0200
tdf#138518 sw: layout: fix assert on ooo43913-1.doc
The two page numbers only have to match for the FormatObjsAtFrame_
caller. On the CalcContent route the formatter is built with the anchor
text frame's page, while Collect recorded the page of the frame holding
the anchor character. Here the anchor paragraph is split over two
pages: the anchor character sits in the follow on page 2 while
CalcContent formats the master on page 1. Nothing has moved.
In a release build the anchor is then measured from the formatter's
page and looks moved forward, so the master paragraph gets marked to
move to the next page for an anchor that never moved.
The other user of the page frame parameter, the scan over the page's
flys, was removed in:
commit 59a917305d
Date: Wed Dec 10 21:13:55 2025 +0500
tdf#169882: revert commit c799de145f
leaving GetPhyPageNum as its only use, so pass the snapshot page number
collected earlier and drop the asserts. Whether an anchor moved forward
is again decided against the page numbering recorded at collect time,
as it was before 533a998e54.
A debug build without this change aborts reliably on loading the added
test document. Its final layout is the same with and without the
change, so the test asserts only the page count.
The tdf#138518 bugdoc ooo43913-1.doc still passes in crashtesting with
this change
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I248072d9e7101f1f925d6d75e3cb7a9dec855313
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/10147
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>
(cherry picked from commit ac332d53d565325f3db2697126d97e02a15e4b5d)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/210289
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
SvxBrushItem::GetGraphic wants the name of the document the brush came
from, so take it as an argument and hand in SwDoc::GetLinkReferer
wherever a document is at hand, the Writer style, frame and background
shell paths included.
The dialog and example-window callers pass the name of the active
document shell through a new svx helper getActiveDocumentLinkReferer.
The hand-rolled copies of the GetPersist, HasName, GetMedium GetName
sequence elsewhere in sw now call SwDoc::GetLinkReferer too.
Change-Id: I8693d27869baed79962b2d5bdcb7b7e2c63227bb
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/8200
Reviewed-by: Stephan Bergmann <stephan.bergmann@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 18f91ac71710027479dfe9f206ae2207bad8f2b7)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/209827
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
We have added various workarounds for ScPatternAttr use after free
issues since:
commit 2e1f9da8a6
Date: Sat Dec 23 15:52:06 2023 +0100
Decouple ScPatternAttr from SfxItemPool
separated ScPatternAttr from SfxItemPool.
Prior to that an ScPatternAttr was an SfxPoolItem held in the doc's
SfxItemPool which kept every item alive for the document's whole
lifetime, so any raw const ScPatternAttr* was basically safe.
The various workarounds for the new behaviour were:
commit dca19993a4c732e95b9a47e1abdcaad6efbeebe9
Date: Sat Jan 6 14:40:28 2024 +0100
tdf#159042: crash after changing cell style (if direct formatting done)
commit 19437715eb415fe2c40b8b40dbe04ddca28f9a35
Date: Thu Sep 12 12:06:28 2024 +0100
null pattern deref seen in ScViewData::SetEditEngine
commit e384f2e8de9603ee65a3edc6dcb50b07116ee4fc
Date: Mon Mar 10 14:45:22 2025 +0000
crashtesting: crash on reimport of xlsx output of forum-pl-2758.ods
commit 7999585bd8378f1a8d04ea2a9a93a8e0bf4d8eb6
Date: Fri May 9 08:50:17 2025 +0100
crash on null pattern de-ref
commit 1bf9bbea96
Date: Tue Oct 28 16:53:49 2025 +0300
tdf#169115: sc: fix use-after-free bug in ScDocument::FillInfo
commit 9f366af81478ad218dc2ef2e37423a9ebcc84e73
Date: Sat Apr 25 14:47:02 2026 +0200
ScPatternAttr use-after-free
commit 20fe691a18fb35120d0765dd1519acd6d2986c38
Date: Tue Apr 28 08:33:34 2026 +0200
ScPatternAttr use-after-free (2)
This commit picks the class member fields that are still raw
ScPatternAttr* and converts them to CellAttributeHolder:
ScUsedAreaIterator::pPattern and pFoundPattern
ScInputHandler::pLastPattern
LotAttrCol::ENTRY::pPattAttr
ScPatternCache::Entry::pPattern
The CalcAll() workaround from 9f366af81478 then doesn't seem to be needed(?)
A new compiler plugin catches class member fields of raw type
ScPatternAttr pointer.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Ibb9f28b8fcaa5470c7a82eee52900c2d60434e41
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/3163
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit 9c7b6313a29067bf0eef12884fc3ce7efb0374e5)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/209822
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
db_maxkeys came from the index header, the key count of a page came from the
page itself, and node access used neither. Now the header value is capped to
the number of keys a DINDEX_PAGE_SIZE page can hold for the given key length,
each page keeps its own capacity and caps its key count to it, and node
positions are clamped to the same bound, so all three agree.
ODbaseIndex::CreateImpl worked out db_maxkeys from a four byte page header
while the reader counts eight bytes of page header, so use eight here too and
write an index the reader agrees with.
ONDXPage::Remove asserted on a position past the key count and then carried on
regardless, so return early instead.
ONDXPage::Merge added the key counts of two pages together in a sal_uInt16, so
widen the sum to sal_uInt32.
nValue was a file-level static shared by the page read and write operators for
no reason, so make it a local in the reader and write rPage.nCount directly.
The two GetChild overloads would load a child page that is already on the chain
of parents the descent came down, so leave such a page unread rather than
descending into a page we are inside. ONDXPage::Merge and ONDXPage::PrintPage
can then be handed a page that was left unread, so both check for one with
nothing loaded.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Id51bf8368099447df41aaacbaebba7783c5769e2
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/9518
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit db92d0be756305ec0b1e122a1d00333477c17ba5)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/209449
Tested-by: Xisco Fauli <xiscofauli@libreoffice.org>
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Caolán McNamara