Give the driver a directory of its own, extract each embedded database
into a subdirectory of it, and set DatabaseAccess so firebird keeps any
associated files it makes for a database in the same directory.
A distro firebird reads only firebird.conf from the directory the
FIREBIRD variable names and finds its other resources at their normal
absolute paths. A bundled firebird finds everything relative to it.
Change-Id: If082a30d2426e7942fc9dd48f7124928fc984434
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-on: https://gerrit.collaboraoffice.com/c/core/+/6701
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 520d8173cef39a4da85b3ba21bdaaa3150384c25)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/208039
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Concatenating two matrices of different sizes gives a result the size
of the larger one.
Each operand was read across the whole result. The shorter operand
has fewer cells than the result, so the read ran past the operand's
end and went out of bounds, which crashed. Now each operand is read
only within its own size.
A cell that only the larger operand covers has no partner in the
shorter one to join with, so it stays empty.
a problem since:
commit b4957ed105bcaa4a73666a6a5e119d523284b0c9
Date: Sat Jun 27 19:26:56 2026 +0900
sc: extend mismatched-extent matrix arithmetic to the longer side
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I0ae4a0b71a846bb88383cd1cb472a022895ae14a
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6696
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Tomaž Vajngerl <tomaz.vajngerl@collabora.com>
(cherry picked from commit 645e103b914f07f80c0c425fb1b3262e5e4f1648)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/208007
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
Interpreting a callable consumes its arguments off the interpreter stack
and must leave exactly one result token behind.
Two paths returned without pushing anything: a lambda whose result was
empty, and a macro whose arguments could not be built.
Each such call left the stack one entry short, so a later token read
past the stack base. That surfaces later as the "underflow" abort in
Interpret, and as the matrix count mismatch in ConvertMatrixParameters.
Push the error, or an empty result, on those two paths.
crash converting forum-en-34250.ods to xlsx:
#21 ScInterpreter::Interpret at sc/source/core/tool/interpr4.cxx:4328
#22 ScFormulaCell::InterpretTail at sc/source/core/data/formulacell.cxx:2201
#24 ScFormulaCell::GetMatrix at sc/source/core/data/formulacell.cxx:3267
#25 ScInterpreter::ScMatRef at sc/source/core/tool/interpr5.cxx:3764
#26 ScInterpreter::DispatchOpCode at sc/source/core/tool/interpr4.cxx:4050
#27 ScInterpreter::Interpret at sc/source/core/tool/interpr4.cxx:4333
#30 ScFormulaCell::MaybeInterpret at sc/inc/formulacell.hxx:515
the same problem also aborts in ScInterpreter::ConvertMatrixParameters
at sc/source/core/tool/interpr4.cxx:1555.
since:
commit 837cf12bc45c72e08c4629d07a43c27763b263b2
Date: Sat Jun 20 23:28:17 2026 -0400
Implemented callables as first-class objects in Calc formulas
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I46a9fa77872ac1c540f9b0904da2e3f9397e71c9
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6153
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit f239eafadbb1c539d0c6dfbb459ca25bc10b7456)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207976
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
PutMatrixValue cloned the referenced cell's formula result token for a
single, double or list reference, but a reference can point at an ordinary
value, string or empty cell, where ScDocument::GetFormulaCell returns null
and cloning its result token dereferences null. Read the plain cell value
into the matrix in that case.
crash finalizing an xlsx import (forum-mso-en4-792534.xlsx):
#0 ScFormulaCell::NeedsInterpret (this=0x0) at sc/inc/formulacell.hxx:487
#1 ScFormulaCell::MaybeInterpret (this=0x0) at sc/inc/formulacell.hxx:501
#2 ScFormulaCell::CloneResultToken (this=0x0) at sc/source/core/data/formulacell.cxx:3236
#3 ScInterpreter::PutMatrixValue at sc/source/core/tool/interpr5.cxx:1285
#4 ScInterpreter::ScByRow at sc/source/core/tool/interpr5.cxx:1521
#5 ScInterpreter::DispatchOpCode (eOp=ocByRow) at sc/source/core/tool/interpr4.cxx:4090
#6 ScInterpreter::Interpret at sc/source/core/tool/interpr4.cxx:4371
#11 ScCellFormat::GetString at sc/source/core/tool/cellform.cxx:90
#19 ScColumn::GetOptimalHeight at sc/source/core/data/column2.cxx:950
#24 ScDocShell::UpdateAllRowHeights at sc/source/ui/docshell/docsh5.cxx:450
#25 oox::xls::WorkbookGlobals::finalize at sc/source/filter/oox/workbookhelper.cxx:665
since:
commit e95c50471e6553f04ec814184456c50209a7e970
Date: Sat Jun 20 23:53:18 2026 -0400
Implemented functions which rely on callables
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Iadede9c4c75e9d1ee79fe2156d356389827595d6
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6151
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
(cherry picked from commit 0abe27b56512e1d524e23f1b759d9647cba85a87)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207975
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
ScLet and ScLambda read the parameter-name token's string without checking
GetType() first, so a token that isn't a string name faults on load, e.g.
forums/xlsx/forum-mso-en4-789942.xlsx:
#0 rtl::str::acquire (pThis=0x20d) at sal/rtl/strtmpl.hxx:735
#6 std::vector<OUString>::push_back
#8 ScInterpreter::ScLet at sc/source/core/tool/interpr1.cxx:10938
#9 ScInterpreter::DispatchOpCode (eOp=ocLet)
#13 ScFormulaCell::MaybeInterpret
#15 ScCellFormat::GetString
#17 ScColumn::GetRangeScriptType
#24 GetOptimalHeightsInColumn
ScLet used to have this check until it was rewritten, the new ScLambda
never had it, since:
commit 6ad6aebb83305608788c878909cd77c29b298271
Date: Sat Jun 20 23:50:39 2026 -0400
Implemented LAMBDA and ISOMITTED for Calc
use the same fix as:
commit 4f5764a223f86ceea1eca70cbec55eb8aebea1f3
Date: Tue May 5 11:45:29 2026 +0100
crashtesting: fix ScLet/ScMatch/IterateParametersIf[s] crashes
Add a GetStringNameToken() helper for this and use it in ScLet, ScLambda
and the dynamic_cast calls in callable.cxx.
see also:
commit 65da502b7b40bd3bcad0cfd146716e815c72d48d
Date: Thu Apr 16 12:31:01 2026 +0200
reduce virtual calling in String*Token
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I7ce591bf5e53538aa947fafa9607b7339d715aaa
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6107
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit 8b1f9cc417d914d72ea223815e8306bcb07299ec)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207977
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Annotation marks bind to their comment field by end position. The field
used is the one at end minus one.
Two .doc range comments that end at the same position then resolve to
the same single SwPostItField, and only one mark can own it.
The first mark applied names the field. A second mark at the same
position cannot get its own field, because AnnotationMark::InitDoc
looks the field up by end position and would only reuse the
first mark's name.
So the second comment trips the assert that the field is still unnamed.
Its range cannot be reconstructed, but the comment still exists in the
text as the postit field. Keep it as a point comment instead of
asserting.
assert added since:
commit 4b4ebb1545
Date: Wed Aug 30 22:47:09 2017 +0200
sw: WW8 import: properly handle consecutive range annotations
which fixed ends colliding through MoveAttrs. Here the collapsed end
positions are already in the file, written by our own .doc export of
adjacent ranged comments.
Reproduced with tdf89698-1.docx converted to doc and reloaded (also
tdf132496-1.docx and fdo82922-2.odt), dbgutil build:
soffice.bin: sw/source/filter/basflt/fltshell.cxx:617: virtual void
SwFltControlStack::SetAttrInDoc(const SwPosition&, SwFltStackEntry&):
Assertion `pPostIt->GetName().isEmpty()' failed.
#21 SwFltControlStack::SetAttrInDoc at sw/source/filter/basflt/fltshell.cxx:617
#22 SwWW8ReferencedFltEndStack::SetAttrInDoc at sw/source/filter/ww8/ww8par.cxx:1393
#23 SwFltControlStack::SetAttr at sw/source/filter/basflt/fltshell.cxx:419
#24 SwWW8ImplReader::DeleteStack at sw/source/filter/ww8/ww8par.cxx:4218
#25 SwWW8ImplReader::DeleteRefStacks at sw/source/filter/ww8/ww8par.hxx:1458
#26 SwWW8ImplReader::CoreLoad at sw/source/filter/ww8/ww8par.cxx:5253
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Ic0ba214dab656ed1bd121e3151417b92b7675fed
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/4725
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Michael Stahl <michael.stahl@collabora.com>
(cherry picked from commit e78633c0161added4c4b57a5fe532e65a7159683)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207947
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
ScHorizontalAttrIterator only reinitialises when nRow passes the global
nMinNextEnd, so a column can be more than one run behind and a single ++
leaves its run end below nRow, tripping the "Sequence out of order"
assert. Re-search with ScAttrArray::Search instead, as the first row does.
forum-mso-en4-146187.xlsx aborted before this when saved to xls or xlsx.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I3065114f04b976a72ef44634bc981547fff4a87b
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/4721
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit f48aa0234af8a16aecb20f32c9584226fc928d3f)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207396
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
A three argument SUMIF or AVERAGEIF grows a small sum range to the shape of
the criteria range. It then reads cells that no reference token names.
The parallel-calc dependency scan only follows reference tokens, so it
misses those cells, and a worker hits one uninterpreted and trips the
group-calc assert.
Drop that form, like the nearby ocRange guard. The two argument form
sums the criteria range itself and stays parallel.
sc/inc/formulacell.hxx:514: void ScFormulaCell::MaybeInterpret():
Assertion `!rDocument.IsThreadedGroupCalcInProgress()' failed.
seen reloading forum-mso-en4-35616.xlsx saved as xls, M9 is
=IFERROR(SUMIF(B9:E33,B9,L9:L33)/SUM(L9:L33),0): the sum range grows from
L9:L33 to L9:O33 and reads the uninterpreted O9.
Only started asserting once the callables work landed, which doesn't touch
this path, so that seems to have uncovered an older gap.
maybe since:
commit 837cf12bc45c72e08c4629d07a43c27763b263b2
Date: Sat Jun 20 23:28:17 2026 -0400
Implemented callables as first-class objects in Calc formulas
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I861c7f645a65cd0c7564ccb96bf040e401cd2f08
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6160
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Tomaž Vajngerl <tomaz.vajngerl@collabora.com>
(cherry picked from commit 04ad1ed4ba2c9a78ed260fc4e18249a40137db94)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207824
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
vcl/source/outdev/ImplMapRes.cxx:115:70: runtime error: signed integer overflow: -9223372036854775808 + -57089 cannot be represented in type 'long long'
#0 0x592c9880de2d in operator() vcl/source/outdev/ImplMapRes.cxx:115:70
#1 0x592c9880de2d in ImplMapRes::CalcMapResolution(MapMode const&, long, long) vcl/source/outdev/ImplMapRes.cxx:119:9
#2 0x592c9819827c in OutputDevice::SetMapMode(MapMode const&) vcl/source/outdev/map.cxx:519:18
#3 0x592c9830750e in GDIMetaFile::Play(OutputDevice&, unsigned long) vcl/source/gdi/gdimtf.cxx:365:26
#4 0x592c978beda6 in TestImportSVM vcl/source/filter/svm/SvmConverter.cxx:1281:22
This seems to have appeared since:
commit 64c6a8c44b7730d1f703f260e7359642e8af9288
Date: Sun Mar 22 15:09:35 2026 +0200
Fraction->double in MapMode
Clamp the divided value to sal_Int32 range to explicitly restore the
limits that BigInt path incidentally.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I3c8061a72e447e4bdcad07ace3075076d09285be
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/1891
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit b1dd07307b7a00e73996975616efa113940fdf37)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207723
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
ReplaceCharWithItem's EraseText can delete an earlier footnote's text
section that m_oLastAnchorPos points into, leaving it dangling. Save and
restore it across the erase like the two existing spots do, and fold all
three into a WW8LastAnchorPosSaver guard.
see also:
commit 1de064acc0ef2b7084e31a1e5ba872054e3942e8
Date: Fri Mar 13 20:55:50 2026 +0000
crashtesting: SwContentIndexReg::~SwContentIndexReg on reimport of docx->doc
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I46c237cf65b58e99628bd3da69b44c145a4ce80e
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/5976
Reviewed-by: Michael Stahl <michael.stahl@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 09a12e662d33ca33e1e398c9c2a26eaf9405450d)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207582
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
ScDocumentImport::setMatrixCells places the matrix master and its
reference cells with raw cell-store set() calls. set() destroys the
cell it overwrites with no shared-formula bookkeeping, so a group
whose member dies that way is left with a stale length, or with a
dead top cell that the next Interpret of a surviving member
dereferences (formulacell.cxx:1560).
The xlsx import builds exactly such groups from stacked dynamic
arrays: the empty <f ca="1"/> spill placeholders of adjacent rows
compile to identical empty token arrays, and applyCellFormulas puts
vertical runs of identical formulas into one group. Materialising the
upper row's array then destroys the lower row's group top.
A member surviving its top cell's destruction became reachable since:
commit e4476c8072af0d825578f5222935718a159bb383
Date: Wed May 6 23:33:16 2026 +0900
sc: Preserve #SPILL! state through XLSX and ODS import
which keeps the cells of a spill-flagged array's range alive instead
of overwriting them all. Detach the doomed cell from its group before
each set().
Reproduced with forum-mso-en4-756517.xlsx and forum-mso-en4-756511.xlsx
from interop-test-files, soffice --headless --convert-to xlsx, dbgutil
build.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Ic347cee8c30b0d93919173a85fdd42cfd8a208e9
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/4723
Reviewed-by: Tomaž Vajngerl <tomaz.vajngerl@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 2f74f677ce588c1ecbf3370c08a85ef94d49313e)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207397
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
...the footnote mark buffer
A custom footnote mark is buffered into m_aSuperBuffer, and when the
mark sits inside a tracked insertion the start of the tracked change is
buffered there too.
The footnote path copies the mark text out and then clears
m_aSuperBuffer. So the buffered start is discarded but the states that
buffered into it still had their StartedTrackchange set.
On group close they emitted an end that has no start, and
RemoveTopRedline attempted to pop an empty redline stack.
So clear the flag on those states when the buffer is dropped.
seen loading ooo53739-2.doc converted to rtf and reloaded (also
ooo83985-4.doc), where the footnote sits inside the tracked insertion as
{\revised... {\super b{\*\footnote ...}}}
#1 writerfilter::dmapper::DomainMapper_Impl::RemoveTopRedline at engine/sw/source/writerfilter/dmapper/DomainMapper_Impl.cxx:10035
#2 writerfilter::dmapper::DomainMapper::sprmWithProps at engine/sw/source/writerfilter/dmapper/DomainMapper.cxx:3242
#3 writerfilter::dmapper::DomainMapper::lcl_sprm at engine/sw/source/writerfilter/dmapper/DomainMapper.cxx:1614
#4 writerfilter::LoggedProperties::sprm at engine/sw/source/writerfilter/dmapper/LoggedResources.cxx:365
#5 writerfilter::rtftok::RTFReferenceProperties::resolve at engine/sw/source/writerfilter/rtftok/rtfreferenceproperties.cxx:34
#6 writerfilter::dmapper::DomainMapper::lcl_props at engine/sw/source/writerfilter/dmapper/DomainMapper.cxx:4970
#7 writerfilter::LoggedStream::props at engine/sw/source/writerfilter/dmapper/LoggedResources.cxx:244
#8 writerfilter::rtftok::RTFDocumentImpl::replayBuffer at engine/sw/source/writerfilter/rtftok/rtfdocumentimpl.cxx:1921
#9 writerfilter::rtftok::RTFDocumentImpl::popState at engine/sw/source/writerfilter/rtftok/rtfdocumentimpl.cxx:3899
see also:
commit 013ec10d4e
Date: Wed Oct 22 22:35:01 2014 +0200
i#84172 RTF import: handle nested groups inside redlines
Change-Id: I2a7c5f3d3aef328a6e5a663dddc72175066fcafc
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/4724
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>
(cherry picked from commit 69a5dcf79103b16d44bdab56a94242ede0347977)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207398
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
The glyph layout cache builds the layout for a substring by cutting it out
of the cached whole-string layout and reusing those glyphs without reshaping.
That is only correct at a cluster boundary that HarfBuzz reports as safe to
concatenate.
The previously checked unsafe-to-break flag is a smaller set and does not
cover boundaries where the surrounding text changes the glyphs, for example
which fallback font a run resolves to, so a subset could be cut where a fresh
layout of the substring would differ.
Ask HarfBuzz to produce the unsafe-to-concat flag and guard the subset with
it instead.
seen loading sd-cre-hea-ar-7e49187f4be1eb63.docx
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I8ff201a4af6c1c9e283a87267b47749a8ce717e6
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/5516
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 573d06f6ce4b5123ac7b0d55ae3e846c0a07cbf1)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207395
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
crash on loading sd-leg-tch-nb-e9e5c5efad47c4ae.docx
#4 SwDoc::SetTOXBaseName (...) at engine/sw/source/core/doc/doctxm.cxx:803
#5 SwXDocumentIndex::attach (...) at engine/sw/source/core/unocore/unoidx.cxx:1352
#6 writerfilter::dmapper::DomainMapper_Impl::createSectionForRange (...) at engine/sw/source/writerfilter/dmapper/DomainMapper_Impl.cxx:7775
#7 writerfilter::dmapper::DomainMapper_Impl::handleToc (...) at engine/sw/source/writerfilter/dmapper/DomainMapper_Impl.cxx:7557
#8 writerfilter::dmapper::DomainMapper_Impl::CloseFieldCommand (...) at engine/sw/source/writerfilter/dmapper/DomainMapper_Impl.cxx:8717
InsertTableOf returns null when the section cannot be inserted at the
given range, but attach went on to dereference it. createSectionForRange
already catches the exception, so throw instead.
same fix as:
commit 5bc6c7b2e1
Date: Wed Sep 12 21:51:48 2012 +0200
fdo#42450: fix crash in SwXTextSection::attach:
Change-Id: Ia97e41017d736cced41b16501763f5fc8b9f89c4
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/5488
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit aa92567bb5771e62d27dbefcc24574a9db9c35cf)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207329
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
txNew, txFree and doSingleFileSet are public now, so the extern_tx
patches go away.
The mergeFonts crash fix is merged upstream.
The noverbose patch is replaced by a SAL logger installed through
slogger::getLogger.
A new fatal-callback patch lets fatal errors raise exceptions, which
appSpecificFree used to do.
afdko 5.0 replaces makeotfexe with addfeatures, drops the typecomp
Type 1 to CFF converter, and rewrites most of c/shared in C++.
hotconv now only reads CFF, so makeotf() first converts its Type 1 input
to bare CFF with tx, the same step the upstream makeotf driver script
performs.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I1e5b6ac8413eb66d81034f4f1d0b7f2e46e12233
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/4251
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
(cherry picked from commit 6c40019917bd6e88f6b54d0a2d53d64729c64166)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207285
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Xisco Fauli <xiscofauli@libreoffice.org>
CtorInitAttrIter can build a SwRedlineItr for a merged paragraph in
Mode::Ignore but have no extended-input array.
That combination has nothing useful to do, and the ctor asserts.
An issue probably since:
commit 4fccc66345
Date: Tue Nov 3 16:40:45 2020 +0100
sw_fieldmarkhide: SwRedlineItr assumption that Show means no MergedPara
Reproduced on saving ooo121134-1.docx (and ooo121176-1.docx) to odt. The
docx loads fine, but asserts on export to odt when exporting a text
frame forces an on-demand layout.
Skip it, a null m_pRedline is already handled throughout SwAttrIter.
soffice.bin: sw/source/core/text/redlnitr.cxx:858: SwRedlineItr::SwRedlineItr(...):
Assertion `m_pExt || m_eMode != Mode::Ignore' failed.
#4 SwRedlineItr::SwRedlineItr at sw/source/core/text/redlnitr.cxx:858
#5 SwAttrIter::CtorInitAttrIter at sw/source/core/text/redlnitr.cxx:817
#10 SwTextFormatter::CtorInitTextFormatter at sw/source/core/text/itrform2.cxx:97
#12 SwTextFrame::FormatImpl at sw/source/core/text/frmform.cxx:2092
#14 SwContentFrame::MakeAll at sw/source/core/layout/calcmove.cxx:1633
#20 SwLayAction::Action at sw/source/core/layout/layact.cxx:404
#21 SwViewShell::CalcLayout at sw/source/core/view/viewsh.cxx:1313
#22 SwEditShell::CalcLayout at sw/source/core/edit/edws.cxx:89
#23 SwXFrame::getPropertyValue at sw/source/core/unocore/unoframe.cxx:2216
#25 XMLTextParagraphExport::addTextFrameAttributes at xmloff/source/text/txtparae.cxx:2968
#32 XMLTextParagraphExport::exportText at xmloff/source/text/txtparae.cxx:1746
#34 SwXMLExport::ExportContent_ at sw/source/filter/xml/xmlexp.cxx:552
#36 SvXMLExport::exportDoc at xmloff/source/core/xmlexp.cxx:1440
#44 SwXMLWriter::Write at sw/source/filter/xml/wrtxml.cxx:479
#46 SwDocShell::SaveAs at sw/source/uibase/app/docsh.cxx:544
#53 SfxBaseModel::storeToURL at sfx2/source/doc/sfxbasemodel.cxx:1829
#54 desktop::DispatchWatcher::executeDispatchRequests at desktop/source/app/dispatchwatcher.cxx:714
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Ia290785e8a60c5b8b972e51d490b0cdf0b730111
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/4726
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Michael Stahl <michael.stahl@collabora.com>
(cherry picked from commit 602a72cb5aa116b244d1a499c156d9321c7b1e58)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207159
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
After createXShapes pushes shapes into the core model, the oox-side
shape tree and shape map are no longer needed. Clear them immediately
so memory from one slide is freed before the next is imported.
Save the title text from the shape map before clearing so that
importSlideNames can still set slide names from titles.
Reduces peak memory during PPTX import by around 58% for a huge
slide deck.
Change-Id: I078d4af1aec4a7d19f29658bd3edbb393cf99570
Reviewed-on: https://gerrit.collaboraoffice.com/c/core/+/963
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit 8114fa350fcaa0bb7a148935d3d2124516524d94)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207075
Tested-by: Jenkins
Reviewed-by: Julien Nabet <serval2412@yahoo.fr>
IsExoticProtocol used GetHost() to recover the nested package url of a
vnd.sun.star.pkg url, but the package content provider in
ucb/source/ucp/package/pkguri.cxx uses the whole authority between "://"
and the next '/', which GetHost() truncates at '@'. Check the same
substring the provider does.
The vnd.sun.star.zip branch below already did the equivalent extraction,
so pull the shared parts into a helper that both branches call.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I27be6a839108f2e58d62baefc1a71dcbfc9a4568
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/4410
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Stephan Bergmann <stephan.bergmann@collabora.com>
(cherry picked from commit ce436efb34d2e0e90ee2cdb450da285530c562f7)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/206681
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
ScTable::CalcAll interprets every formula cell in each column's cell
store. Interpreting a dynamic-array master whose result size changed
runs ResizeMatrixFormula, which deletes or inserts reference cells in
the columns being walked and frees the block the iterator sits on.
Take a MatrixResizeGuard around the whole per-table walk so any such
resize is queued and drained once, after every column. At the table
level this covers both callers, ScDocument::CalcAll and the direct
FetchTable(n)->CalcAll() in the xlsx exporter, and the per-table drain
makes the trailing ProcessPendingMatrixResizes in ScDocument::CalcAll
dead, so drop it.
forum-mso-en4-776376.xlsx aborted before this under DoHardRecalc when
saved to xlsx or ods, and converts cleanly with this.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I54cd8ce944d791339a0f2feec02bea5bb87d9312
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/4216
Reviewed-by: Tomaž Vajngerl <tomaz.vajngerl@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 630cd3a5e5a7280cc19f80b51751de8afda2afe9)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/206659
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
SlideTransitionPane's EventMultiplexerListener default branch called
onSelectionChanged + onChangeCurrentPage on every non-Disposing event,
including ShapeChanged.
ShapeChanged fires for every text edit on any view, so with several
users editing the panel re-emitted its full notebookbar state hundreds
of times to every view, although the page-level transition properties
had not changed.
Sync SlideTransitionPane with CustomAnimationPane so SlideTransitionPane
handles only the same explicit cases. And use the same sort of setup
as that panel does, e.g. take the controller from the ViewShellBase directly like:
commit ec58f5e318
Date: Thu Dec 16 09:12:41 2004 +0000
2004/12/10 10:11:53 af 1.2.10.1: #i38630# Using the right controller after views have changed.
Transitions panel update sent on every shape edit since:
commit c4e0d6596d
Date: Thu Jun 2 15:43:45 2016 +0200
notebookbar: added slide transition tab
To reproduce: open the Slide Transition sidebar in Impress, click into
a text frame and type. updateControls() fires twice per keystroke via
the ShapeChanged -> default path. With this change it only fires on
actual slide selection changes.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I12a44e17e982f0502fe8fbf6b61f41cb3ac26e07
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/3236
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Szymon Kłos <szymon.klos@collabora.com>
(cherry picked from commit 9a49d09e20b0687b30c9603d427ae2bd87d20638)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/206639
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Footnote text is buffered into m_aSectionHeaders while
m_bBufferSectionHeaders is set, but EndParagraphProperties and the
depth-1 StartTableRow wrote straight to the output stream, so a table
in a footnote shed its row definitions and intbl/itap paragraph marks
outside the buffered footnote group. Route both writes through the
buffer.
Not a regression, co-25.04 writes the same. Reproduced with
File_1333.docx (the cloudon set) converted to rtf and reloaded, where
the import rejects our own output with the io::WrongFormatException
"mismatch between \itap and number of \nestrow" of
#1 writerfilter::rtftok::RTFDocumentImpl::dispatchSymbol at sw/source/writerfilter/rtftok/rtfdispatchsymbol.cxx:305
#2 writerfilter::rtftok::RTFTokenizer::dispatchKeyword at sw/source/writerfilter/rtftok/rtftokenizer.cxx:2195
#3 writerfilter::rtftok::RTFTokenizer::resolveKeyword at sw/source/writerfilter/rtftok/rtftokenizer.cxx:2145
#4 writerfilter::rtftok::RTFTokenizer::resolveParse at sw/source/writerfilter/rtftok/rtftokenizer.cxx:2023
#5 writerfilter::rtftok::RTFDocumentImpl::resolve at sw/source/writerfilter/rtftok/rtfdocumentimpl.cxx:920
and on the crashtesting box as part of the loadComponentFromURL
AbortOnLoadFailure cluster.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I71a46c396f52f3a3d38bb84c778bd1eef871e3c8
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/4449
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit c5a540fde6c993c9aa527ffbc2e9a1700808f9c8)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/206634
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
The split (finishParagraph plus lcl_startParagraphGroup) pushes a
CONTEXT_PARAGRAPH with no matching pop, tripping the stack-balance
assert at the end of DomainMapper_Impl::substream(). A header or footer
cannot break pages or columns, so skip the split there.
Reproduced with tdf89392-1.odt converted to docx and reloaded, dbgutil
build:
soffice.bin: sw/source/writerfilter/dmapper/DomainMapper_Impl.cxx:10370:
void writerfilter::dmapper::DomainMapper_Impl::substream(Id, const
writerfilter::Reference<writerfilter::Stream>::Pointer_t&): Assertion
`m_aContextStack.size() == contextSize' failed.
#21 writerfilter::dmapper::DomainMapper_Impl::substream at sw/source/writerfilter/dmapper/DomainMapper_Impl.cxx:10370
#22 writerfilter::dmapper::DomainMapper::lcl_substream at sw/source/writerfilter/dmapper/DomainMapper.cxx:5012
#23 writerfilter::LoggedStream::substream at sw/source/writerfilter/dmapper/LoggedResources.cxx:272
#24 writerfilter::ooxml::OOXMLDocument::resolveFastSubStreamWithId at sw/source/writerfilter/ooxml/OOXMLDocumentImpl.cxx:132
#25 writerfilter::ooxml::OOXMLDocument::resolveHeader at sw/source/writerfilter/ooxml/OOXMLDocumentImpl.cxx:398
#26 writerfilter::ooxml::OOXMLFastContextHandler::resolveHeader at sw/source/writerfilter/ooxml/OOXMLFastContextHandler.cxx:897
#27 writerfilter::ooxml::OOXMLHeaderHandler::finalize at sw/source/writerfilter/ooxml/Handler.cxx:214
Change-Id: I45f10d3d990bbf13614299e87d27dd88dcf9e0a3
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/4243
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
(cherry picked from commit 671b1b51f26fbb8630d1f0022a6d2771bba938db)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/206354
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
These three changes are on raptor master but not in any release
raptor_ntriples.c: inspect the last character of a blank node id only
when the id length is greater than zero (upstream ece2c79d, github issue
70).
raptor_rfc2396.c: return an empty path when normalisation reduces the
remaining length to zero (upstream da7a7997, github issue 70).
raptor_term.c: guard the language copy loop with language_len (github
issue 83 / pull request 84)
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I70d9f5d5489628775a7e8a3b0dbe448ef285465b
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/3990
Reviewed-by: Andras Timar <andras.timar@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit f34d6fa958a84638060f648abbecbca0b290d63e)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/206206
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
to xls at least an assert of:
sc/source/core/tool/compiler.cxx:4693: bool ScCompiler::NextNewToken(bool):
Assertion `pArr->GetCodeError() != FormulaError::NONE' failed.
formula is:
INDIRECT("'WHS'!"&"$"&CHAR(CODE(LEFT(AM28,1)))&"$2:$"&CHAR(CODE(LEFT(AM28,1)))&"$6")
CODE("") returns 0, and CHAR(0) inserts a literal null character into the resulting reference string
Triggered at export time since:
commit c6bcd2f7c467b944765b363e9a900eaa6625ff6f
Date: Fri Mar 6 19:29:29 2026 +0530
XLSX: Skip export of Data Validations with invalid formulas
which I think is blameless though
Change-Id: I28dd96e9107631d05b9e16ac7247dbc44309f3aa
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/1595
Reviewed-by: Karthik Godha <karthik.godha@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit e7810e8e2d2216afda181768744ea15ff42046cb)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/205955
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
ScExternalSingleRefToken cast to its sibling ScExternalDoubleRefToken
to call GetTableName. The fields line up so the right string came back,
but UBSan flags the vptr mismatch.
Direct call to GetString became a cast to ScExternalDoubleRefToken since:
commit 65da502b7b40bd3bcad0cfd146716e815c72d48d
Date: Thu Apr 16 12:31:01 2026 +0200
reduce virtual calling in String*Token
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Id5d690fec60e52529f045779c40484df604b3e36
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/3170
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 988be8de0a6422a97a6beed4bec877b83b5b0682)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/205653
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
crash on converting forums/xlsx/forum-mso-en4-719{400,422,450}.xlsx to .ods
#0 0x00007fb8a598aeec in raise () at /lib/x86_64-linux-gnu/libc.so.6
...
#21 0x00007fb87cce0b52 in o3tl::detail::MulDiv<long> (n=-9223372036854773760, m=72, d=127) at engine/include/o3tl/unit_conversion.hxx:75
#25 0x00007fb87cec1c53 in ScDrawLayer::GetPrintArea (...) at engine/sc/source/core/data/drwlayer.cxx:1439
#30 0x00007fb87d320577 in ScXMLExport::GetViewSettings (...) at engine/sc/source/filter/xml/xmlexprt.cxx:5337
Where the problem rectangle was produced (not where it crashed) at:
#2 0x0000000000000000 in SdrTextObj::NbcSetSnapRect (...) at engine/svx/source/svdraw/svdotxtr.cxx:53
#6 0x0000000000000000 in SdrObject::SetSnapRect (...) at engine/svx/source/svdraw/svdobj.cxx:1853
#7 0x0000000000000000 in ScDrawLayer::RecalcPos (...) at engine/sc/source/core/data/drwlayer.cxx:1305
#8 0x0000000000000000 in ScDrawLayer::SetPageSize (...) at engine/sc/source/core/data/drwlayer.cxx:683
#9 0x0000000000000000 in ScTable::SetDrawPageSize (...) at engine/sc/source/core/data/table2.cxx:4287
#10 0x0000000000000000 in ScTable::SetOptimalHeight (...) at engine/sc/source/core/data/table1.cxx:523
#12 0x0000000000000000 in ScDocShell::UpdateAllRowHeights (...) at engine/sc/source/ui/docshell/docsh5.cxx:451
#13 0x0000000000000000 in oox::xls::WorkbookGlobals::finalize () at engine/sc/source/filter/oox/workbookhelper.cxx:667
Each of the three xlsx files has a zero-width rectangle rotated -90 degrees.
WorkbookGlobals::finalize eventually calls SdrTextObj::NbcSetSnapRect
and scales the shape by:
double(nWdt1) / nWdt0, double(nHgt1) / nHgt0
so the X scale becomes +inf. Eventually this bad value ends up in
ScDrawLayer::GetPrintArea and overflows.
presumably since:
commit 282cb403cd5cf8660b36a410c0370d51fb1efc96
Date: Sun Mar 15 15:15:54 2026 +0200
Fraction->double in SdrObject::Resize
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I087c5d10ad1fbc20d2735cf4a1b940c26e159350
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/3016
(cherry picked from commit a7f20642f1f5355577a691ae27aff70154997a81)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/205509
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
Caolán McNamara