sdext/source/presenter/PresenterAccessibility.cxx | 6 ++++-
sw/source/uibase/inc/conttree.hxx | 1
sw/source/uibase/utlui/content.cxx | 26 ++++++----------------
3 files changed, 13 insertions(+), 20 deletions(-)
New commits:
commit dbfa3841018672d8af8e9bf1bdb4caf6cdf0ce7d
Author: Michael Stahl <mst...@redhat.com>
Date: Thu Nov 24 14:18:05 2016 +0100
tdf#103788 sw: fix use-after-free in navigator dialog
The problem is that if SwContentTree::HasContentChanged() returns true,
it may have deleted the SwTypeNumber instances that are referenced in
SvTreeListEntry::pUserData, but it has not reset pUserData so those
pointers are now used to acceess deleted objects.
Also it looks like the HasContentChanged() detects additional conditions
that would not cause a modified event from the document but should still
cause a repaint, such as when the user moves the cursor between
headings.
Revert the optimization, it was a stupid idea.
(regression from 329742e6c9da7cd7848d92a6846e3d1249d8d9b4)
Change-Id: Idb5207e896b0638324fc41b7c214536be4ba864b
(cherry picked from commit cbdf4e007650cfda4f7808402e8e24ae66d45792)
Reviewed-on: https://gerrit.libreoffice.org/31194
Tested-by: Jenkins <c...@libreoffice.org>
Reviewed-by: Michael Stahl <mst...@redhat.com>
diff --git a/sw/source/uibase/inc/conttree.hxx
b/sw/source/uibase/inc/conttree.hxx
index 525d11f..4dd2bf4d 100644
--- a/sw/source/uibase/inc/conttree.hxx
+++ b/sw/source/uibase/inc/conttree.hxx
@@ -96,7 +96,6 @@ class SwContentTree
bool m_bIsOutlineMoveable :1;
bool m_bViewHasChanged :1;
bool m_bIsImageListInitialized : 1;
- bool m_bActiveDocModified :1;
static bool bIsInDrag;
diff --git a/sw/source/uibase/utlui/content.cxx
b/sw/source/uibase/utlui/content.cxx
index 3ef1c67..8493fec 100644
--- a/sw/source/uibase/utlui/content.cxx
+++ b/sw/source/uibase/utlui/content.cxx
@@ -798,7 +798,6 @@ SwContentTree::SwContentTree(vcl::Window* pParent,
SwNavigationPI* pDialog)
, m_bIsOutlineMoveable(true)
, m_bViewHasChanged(false)
, m_bIsImageListInitialized(false)
- , m_bActiveDocModified(false)
, m_bIsKeySpace(false)
{
SetHelpId(HID_NAVIGATOR_TREELIST);
@@ -1709,8 +1708,6 @@ void SwContentTree::Display( bool bActive )
sal_Int32 nDelta = pVScroll->GetThumbPos() - nOldScrollPos;
ScrollOutputArea( (short)nDelta );
}
-
- m_bActiveDocModified = false;
}
void SwContentTree::Clear()
@@ -2196,12 +2193,6 @@ void SwContentTree::SetConstantShell(SwWrtShell* pSh)
void SwContentTree::Notify(SfxBroadcaster & rBC, SfxHint const& rHint)
{
- if (SFX_HINT_DOCCHANGED == rHint.GetId())
- {
- m_bActiveDocModified = true;
- return;
- }
-
SfxViewEventHint const*const pVEHint(dynamic_cast<SfxViewEventHint
const*>(&rHint));
SwXTextView* pDyingShell = nullptr;
if (m_pActiveShell && pVEHint && pVEHint->GetEventName() == "OnViewClosed")
@@ -2409,11 +2400,8 @@ IMPL_LINK_NOARG(SwContentTree, TimerUpdate, Timer *,
void)
else if( (m_bIsActive || (m_bIsConstant && pActShell ==
GetWrtShell())) &&
HasContentChanged())
{
- if (!m_bIsActive || m_bActiveDocModified)
- { // don't burn cpu and redraw and flicker if not modified
- FindActiveTypeAndRemoveUserData();
- Display(true);
- }
+ FindActiveTypeAndRemoveUserData();
+ Display(true);
}
}
else if(!pView && m_bIsActive && !m_bIsIdleClear)
commit 4f8eff151e8ec71eb1a5b6757d9b17d3224d67ca
Author: Michael Stahl <mst...@redhat.com>
Date: Wed Nov 23 23:01:41 2016 +0100
SwContentTree: fix bad static downcasts
Change-Id: I52c1b4a028928c3008d95df43dbc6e8183980df4
(cherry picked from commit c2c4c6ee16120108590dc64f295ab54e34a05ac0)
Reviewed-on: https://gerrit.libreoffice.org/31193
Tested-by: Jenkins <c...@libreoffice.org>
Reviewed-by: Michael Stahl <mst...@redhat.com>
diff --git a/sw/source/uibase/utlui/content.cxx
b/sw/source/uibase/utlui/content.cxx
index 0693c90..3ef1c67 100644
--- a/sw/source/uibase/utlui/content.cxx
+++ b/sw/source/uibase/utlui/content.cxx
@@ -1404,8 +1404,9 @@ SdrObject*
SwContentTree::GetDrawingObjectsByContent(const SwContent *pCnt)
bool SwContentTree::Expand( SvTreeListEntry* pParent )
{
- if(!m_bIsRoot ||
(static_cast<SwContentType*>(pParent->GetUserData())->GetType() ==
ContentTypeId::OUTLINE) ||
- (m_nRootType == ContentTypeId::OUTLINE))
+ if (!m_bIsRoot
+ || (static_cast<SwTypeNumber*>(pParent->GetUserData())->GetTypeId() ==
CTYPE_CTT && static_cast<SwContentType*>(pParent->GetUserData())->GetType() ==
ContentTypeId::OUTLINE)
+ || (m_nRootType == ContentTypeId::OUTLINE))
{
if(lcl_IsContentType(pParent))
{
@@ -1459,8 +1460,9 @@ bool SwContentTree::Expand( SvTreeListEntry* pParent )
bool SwContentTree::Collapse( SvTreeListEntry* pParent )
{
- if(!m_bIsRoot ||
(static_cast<SwContentType*>(pParent->GetUserData())->GetType() ==
ContentTypeId::OUTLINE) ||
- (m_nRootType == ContentTypeId::OUTLINE))
+ if (!m_bIsRoot
+ || (static_cast<SwTypeNumber*>(pParent->GetUserData())->GetTypeId() ==
CTYPE_CTT && static_cast<SwContentType*>(pParent->GetUserData())->GetType() ==
ContentTypeId::OUTLINE)
+ || (m_nRootType == ContentTypeId::OUTLINE))
{
if(lcl_IsContentType(pParent))
{
commit c100e38b49512512b11a0c594f244a4937bc6d66
Author: Michael Stahl <mst...@redhat.com>
Date: Tue Nov 22 22:49:15 2016 +0100
presenter console: fix STL assert when exiting slide show
AtkListener::handleChildRemoved() calls removeAccessibleEventListener(),
apparently without the listener being registered, so the remove() returns
end(), which isn't valid for erase().
(probably happens since e4e208fa2b0930be5a7cbbe2fab2ff2fe2c4a1ff)
Change-Id: Ia0de1bafe214f5a46f250d6573d8c4b408c9cf26
(cherry picked from commit f6d2ff1cb7f0f4917a0d4df38d5dcff8e37d20cc)
Reviewed-on: https://gerrit.libreoffice.org/31192
Reviewed-by: Michael Stahl <mst...@redhat.com>
Tested-by: Michael Stahl <mst...@redhat.com>
diff --git a/sdext/source/presenter/PresenterAccessibility.cxx
b/sdext/source/presenter/PresenterAccessibility.cxx
index 7c474b2..48916ebf0 100644
--- a/sdext/source/presenter/PresenterAccessibility.cxx
+++ b/sdext/source/presenter/PresenterAccessibility.cxx
@@ -1109,7 +1109,11 @@ void SAL_CALL
PresenterAccessible::AccessibleObject::removeAccessibleEventListen
{
const osl::MutexGuard aGuard(m_aMutex);
- maListeners.erase(std::remove(maListeners.begin(), maListeners.end(),
rxListener));
+ auto const it(std::remove(maListeners.begin(), maListeners.end(),
rxListener));
+ if (it != maListeners.end())
+ {
+ maListeners.erase(it);
+ }
}
}
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
