sw/inc/doc.hxx | 2 +-
sw/source/core/doc/doclay.cxx | 4 ++--
sw/source/core/draw/dcontact.cxx | 7 ++++---
sw/source/core/frmedt/fecopy.cxx | 33 ++++++++++++++++-----------------
4 files changed, 23 insertions(+), 23 deletions(-)
New commits:
commit ea5c846fd5630acef26a3ee96d47c4a43fb5c24d
Author: Noel Grandin <noel.gran...@collabora.co.uk>
AuthorDate: Thu Apr 27 18:45:46 2023 +0200
Commit: Noel Grandin <noel.gran...@collabora.co.uk>
CommitDate: Fri Apr 28 09:12:15 2023 +0200
tdf#155028 Crash in: `anonymous namespace'::lcl_PasteFlyOrDrawFormat
since
commit 8611f6e259b807b4f19c8dc0eab86ca648891ce3
Author: Noel Grandin <noel.gran...@collabora.co.uk>
Date: Thu May 27 10:27:46 2021 +0200
ref-count SdrObject
The CloneSdrObj() call needs to return a rtl::Reference or the
created object might get destroyed before we return a (now stale)
pointer to it.
Change-Id: I3de46b025887e6d460860b37677d2b18b90fb3e3
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/151137
Tested-by: Jenkins
Reviewed-by: Noel Grandin <noel.gran...@collabora.co.uk>
diff --git a/sw/inc/doc.hxx b/sw/inc/doc.hxx
index d9ff583fcdec..abd55424f359 100644
--- a/sw/inc/doc.hxx
+++ b/sw/inc/doc.hxx
@@ -1539,7 +1539,7 @@ public:
void Unchain( SwFrameFormat &rFormat );
// For Copy/Move from FrameShell.
- SdrObject* CloneSdrObj( const SdrObject&, bool bMoveWithinDoc = false,
+ rtl::Reference<SdrObject> CloneSdrObj( const SdrObject&, bool
bMoveWithinDoc = false,
bool bInsInPage = true );
// FeShell - Interface end
diff --git a/sw/source/core/doc/doclay.cxx b/sw/source/core/doc/doclay.cxx
index 94229dbc968f..4ec0f8922da2 100644
--- a/sw/source/core/doc/doclay.cxx
+++ b/sw/source/core/doc/doclay.cxx
@@ -105,7 +105,7 @@ static bool lcl_IsItemSet(const SwContentNode & rNode,
sal_uInt16 which)
return bResult;
}
-SdrObject* SwDoc::CloneSdrObj( const SdrObject& rObj, bool bMoveWithinDoc,
+rtl::Reference<SdrObject> SwDoc::CloneSdrObj( const SdrObject& rObj, bool
bMoveWithinDoc,
bool bInsInPage )
{
// #i52858# - method name changed
@@ -150,7 +150,7 @@ SdrObject* SwDoc::CloneSdrObj( const SdrObject& rObj, bool
bMoveWithinDoc,
}
pObj->SetLayer( nLayerIdForClone );
- return pObj.get();
+ return pObj;
}
SwFlyFrameFormat* SwDoc::MakeFlySection_( const SwPosition& rAnchPos,
diff --git a/sw/source/core/draw/dcontact.cxx b/sw/source/core/draw/dcontact.cxx
index 8675f62e72c9..8e26a42af34f 100644
--- a/sw/source/core/draw/dcontact.cxx
+++ b/sw/source/core/draw/dcontact.cxx
@@ -1567,11 +1567,12 @@ void SwDrawContact::SwClientNotify(const SwModify&
rMod, const SfxHint& rHint)
{
auto pDrawFormatLayoutCopyHint = static_cast<const
sw::DrawFormatLayoutCopyHint*>(&rHint);
const SwDrawFrameFormat& rFormat = static_cast<const
SwDrawFrameFormat&>(rMod);
- new SwDrawContact(
- &pDrawFormatLayoutCopyHint->m_rDestFormat,
+ rtl::Reference<SdrObject> xNewObj =
pDrawFormatLayoutCopyHint->m_rDestDoc.CloneSdrObj(
*GetMaster(),
- pDrawFormatLayoutCopyHint->m_rDestDoc.IsCopyIsMove()
&& &pDrawFormatLayoutCopyHint->m_rDestDoc == rFormat.GetDoc()));
+ pDrawFormatLayoutCopyHint->m_rDestDoc.IsCopyIsMove()
&& &pDrawFormatLayoutCopyHint->m_rDestDoc == rFormat.GetDoc());
+ new SwDrawContact(
+ &pDrawFormatLayoutCopyHint->m_rDestFormat, xNewObj.get() );
// #i49730# - notify draw frame format that position attributes are
// already set, if the position attributes are already set at the
// source draw frame format.
diff --git a/sw/source/core/frmedt/fecopy.cxx b/sw/source/core/frmedt/fecopy.cxx
index 11a3d945d447..beb014cd5fc4 100644
--- a/sw/source/core/frmedt/fecopy.cxx
+++ b/sw/source/core/frmedt/fecopy.cxx
@@ -188,11 +188,10 @@ void SwFEShell::Copy( SwDoc& rClpDoc, const OUString*
pNewClpText )
aAnchor.SetAnchor( &aPos );
aSet.Put( aAnchor );
- SdrObject *const pNew =
- rClpDoc.CloneSdrObj( *pObj );
+ rtl::Reference<SdrObject> xNew = rClpDoc.CloneSdrObj( *pObj );
SwPaM aTemp(aPos);
- rClpDoc.getIDocumentContentOperations().InsertDrawObj(aTemp,
*pNew, aSet );
+ rClpDoc.getIDocumentContentOperations().InsertDrawObj(aTemp,
*xNew, aSet );
}
else
{
@@ -311,10 +310,10 @@ bool SwFEShell::CopyDrawSel( SwFEShell& rDestShell, const
Point& rSttPt,
(RndStdIds::FLY_AS_CHAR != rAnchor.GetAnchorId()) )
{
- SdrObject* pNew = pDestDoc->CloneSdrObj( *pObj, bIsMove &&
+ rtl::Reference<SdrObject> xNew = pDestDoc->CloneSdrObj( *pObj,
bIsMove &&
GetDoc() == pDestDoc, false );
- pNew->NbcMove( aSiz );
- pDestDrwView->InsertObjectAtView( pNew, *pDestPgView );
+ xNew->NbcMove( aSiz );
+ pDestDrwView->InsertObjectAtView( xNew.get(), *pDestPgView );
bInsWithFormat = false;
}
}
@@ -373,9 +372,9 @@ bool SwFEShell::CopyDrawSel( SwFEShell& rDestShell, const
Point& rSttPt,
{
SfxItemSet aSet(
pDestDoc->GetAttrPool(),aFrameFormatSetRange);
aSet.Put( aAnchor );
- SdrObject* pNew = pDestDoc->CloneSdrObj( *pObj, bIsMove &&
+ rtl::Reference<SdrObject> xNew = pDestDoc->CloneSdrObj(
*pObj, bIsMove &&
GetDoc() == pDestDoc );
- pFormat =
pDestDoc->getIDocumentContentOperations().InsertDrawObj(
*rDestShell.GetCursor(), *pNew, aSet );
+ pFormat =
pDestDoc->getIDocumentContentOperations().InsertDrawObj(
*rDestShell.GetCursor(), *xNew, aSet );
}
else
pFormat =
pDestDoc->getIDocumentLayoutAccess().CopyLayoutFormat( *pFormat, aAnchor, true,
true );
@@ -721,25 +720,25 @@ namespace {
const SdrObject* pSdrObj = pCpyFormat->FindSdrObject();
if(pSdrObj)
{
- SdrObject* pNew = rDoc.CloneSdrObj(*pSdrObj, false, false);
+ rtl::Reference<SdrObject> xNew = rDoc.CloneSdrObj(*pSdrObj,
false, false);
// Insert object sets any anchor position to 0.
// Therefore we calculate the absolute position here
// and after the insert the anchor of the object
// is set to the anchor of the group object.
- tools::Rectangle aSnapRect = pNew->GetSnapRect();
- if(pNew->GetAnchorPos().X() || pNew->GetAnchorPos().Y())
+ tools::Rectangle aSnapRect = xNew->GetSnapRect();
+ if(xNew->GetAnchorPos().X() || xNew->GetAnchorPos().Y())
{
const Point aPoint(0, 0);
// OD 2004-04-05 #i26791# - direct drawing object
// positioning for group members
- pNew->NbcSetAnchorPos(aPoint);
- pNew->NbcSetSnapRect(aSnapRect);
+ xNew->NbcSetAnchorPos(aPoint);
+ xNew->NbcSetSnapRect(aSnapRect);
}
- rDrawView.InsertObjectAtView(pNew, *rImp.GetPageView());
+ rDrawView.InsertObjectAtView(xNew.get(), *rImp.GetPageView());
Point aGrpAnchor(0, 0);
- SdrObjList* pList = pNew->getParentSdrObjListFromSdrObject();
+ SdrObjList* pList = xNew->getParentSdrObjListFromSdrObject();
if(pList)
{
SdrObjGroup*
pOwner(dynamic_cast<SdrObjGroup*>(pList->getSdrObjectFromSdrObjList()));
@@ -750,8 +749,8 @@ namespace {
// OD 2004-04-05 #i26791# - direct drawing object
// positioning for group members
- pNew->NbcSetAnchorPos(aGrpAnchor);
- pNew->SetSnapRect(aSnapRect);
+ xNew->NbcSetAnchorPos(aGrpAnchor);
+ xNew->SetSnapRect(aSnapRect);
return nullptr;
}
}
