==1168891==ERROR: AddressSanitizer: heap-use-after-free on address 0x7cc3f9900268
READ of size 8 at 0x7cc3f9900268 thread T0
#0 in BigPtrEntry::GetPos() const sw/inc/bparr.hxx:107:5
#1 in SwNode::GetIndex() const sw/inc/node.hxx:317:57
#2 in SwTableBox::GetSttIdx() const sw/source/core/table/swtable.cxx:2288:41
#3 in SwCellFrame::SwCellFrame(SwTableBox const&, SwFrame*, bool) sw/source/core/layout/tabfrm.cxx:5968:37
#4 in SwRowFrame::SwRowFrame(SwTableLine const&, SwFrame*, bool) sw/source/core/layout/tabfrm.cxx:4822:33
#5 in SwTabFrame::SwTabFrame(SwTable&, SwFrame*) sw/source/core/layout/tabfrm.cxx:109:32
#6 in SwTableNode::MakeFrame(SwFrame*) sw/source/core/docnode/ndtbl.cxx:2474:16
#7 in InsertCnt_(SwLayoutFrame*, SwDoc&, ...) sw/source/core/layout/frmtool.cxx:1735:34
#8 in SwRootFrame::Init(SwFrameFormat*) sw/source/core/layout/newfrm.cxx:511:5
#9 in SwViewShell::Init(SwViewOption const*, long) sw/source/core/view/vnew.cxx:143:23
An empty table cell keeps its section because the SwTableBox that owns
the cell points at the start node. Nothing updates
SwTableBox::m_pStartNode, so removing the section leaves the table's
sort array holding a box that points at freed memory.
The ww8 import flushes its redline stack in WW8TabDesc::FinishSwTable
when the table finishes, and a tracked change that continues across a
cell mark gives a range with its two ends in different cells, and
applying it emptied the cell section.
so keep the empty start/end pair only when the table that owns the
cell survives the deletion too
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Ia3f9cb45e361095f17a5a544f1efcd2a7465ef3f
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/11630
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit f196f8dfeda9ee0bdc7dc859f456582ddb0ce054)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211378
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Caolán McNamara
3ae0b0a194