sc/qa/unit/ucalc_condformat.cxx                 |   12 +++++-------
 sw/qa/extras/layout/data/tdf142694-1.odt        |binary
 sw/qa/extras/layout/layout.cxx                  |   24 ++++++++++++++++++++++++
 sw/source/core/layout/findfrm.cxx               |   16 +++++++++++++---
 sw/source/core/text/EnhancedPDFExportHelper.cxx |    4 ++++
 5 files changed, 46 insertions(+), 10 deletions(-)

New commits:
commit dd53384cfea6ad6e7995679976bd507b567afe2f
Author:     Michael Stahl <michael.st...@allotropia.de>
AuthorDate: Tue Aug 15 16:29:31 2023 +0200
Commit:     Xisco Fauli <xiscofa...@libreoffice.org>
CommitDate: Tue Aug 22 20:59:03 2023 +0200

    sw: PDF/UA export: add /Placement/Block to Note
    
    PDF 1.7 defines Note as an ILSE (inline), but that is rather odd and
    definitely not how footnotes work in Writer.
    
    PAC 3 complains about "Possibly inappropriate use of a "Note" structure
    element" and "Possibly inappropriate use of a "P" structure element"
    which is rather opaque but experimenting shows the warnings disappear
    when the Note has a /Placement/Block attribute.
    
    PDF 2.0 (ISO-32000-2:2020 Annex M) even removes the Note ILSE and
    introduces FENote as a BLSE to replace it.
    
    Change-Id: I46ee32c88d4be495bf79549280e2fa68d7da091c
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/155722
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit 7712221f5340b8eb875d391967b2726e93285ab4)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/155701
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/sw/source/core/text/EnhancedPDFExportHelper.cxx 
b/sw/source/core/text/EnhancedPDFExportHelper.cxx
index 9124522379c8..4473b89d25b4 100644
--- a/sw/source/core/text/EnhancedPDFExportHelper.cxx
+++ b/sw/source/core/text/EnhancedPDFExportHelper.cxx
@@ -585,6 +585,10 @@ void SwTaggedPDFHelper::SetAttributes( 
vcl::PDFWriter::StructElement eType )
                 bWritingMode = true;
                 break;
 
+            case vcl::PDFWriter::Note:
+                bPlacement = true;
+                break;
+
             case vcl::PDFWriter::Table :
                 bPlacement =
                 bWritingMode =
commit 346cedd597bee1058bb8ebd0681faad9d8c2b203
Author:     Michael Stahl <michael.st...@allotropia.de>
AuthorDate: Thu Aug 10 19:04:08 2023 +0200
Commit:     Xisco Fauli <xiscofa...@libreoffice.org>
CommitDate: Tue Aug 22 20:58:56 2023 +0200

    tdf#142694 sw: layout: fix infinite loop in SwFrame::PrepareMake()
    
    The problem is that SwFrame::FindNext_() returns itself, because it's a
    table frame 401 and its last cell is empty.
    
    There was a nested table in the cell, but during an attempt to split the
    outer table 401, the inner table moved backwards.
    
    This is due to code that was added in commit
    c9c956f2716c58e2573a9ac07073f712d736ed02, which only checks that the
    height of the table frame is 0, but in this case the inner table does
    contain a text frame which has never been formatted yet, but still the
    table frame's size and print area was set to valid.
    
    Unfortunately adding an obvious !ContainsContent() check to the
    condition breaks uiwriter4 testTdf114306_2, the last table is not on
    page 4 but on page 5, for no good reason.
    
    So just fix SwFrame::FindNext_(), it should never return "this" anyway.
    
    (somehow regression from commit 53a0a86df6eb5fc64a85ecd03f2e354fd4d8e213)
    
    Change-Id: If043a53c32f175fc560d422c4a4e16d8e8c6ef49
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/155563
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit fcf6f5550cc7949e94dc74cbcd10a700a225e574)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/155608
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/sw/qa/extras/layout/data/tdf142694-1.odt 
b/sw/qa/extras/layout/data/tdf142694-1.odt
new file mode 100644
index 000000000000..9e9245998735
Binary files /dev/null and b/sw/qa/extras/layout/data/tdf142694-1.odt differ
diff --git a/sw/qa/extras/layout/layout.cxx b/sw/qa/extras/layout/layout.cxx
index 53b3c2932c3a..ebb63e07eef9 100644
--- a/sw/qa/extras/layout/layout.cxx
+++ b/sw/qa/extras/layout/layout.cxx
@@ -3531,6 +3531,30 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter, testTdf128611)
     assertXPathContent(pXmlDoc, "//tab/row/cell[1]/txt", "Abcd efghijkl");
 }
 
+CPPUNIT_TEST_FIXTURE(SwLayoutWriter, testTdf142694)
+{
+    createSwDoc("tdf142694-1.odt");
+
+    xmlDocUniquePtr pXmlDoc = parseLayoutDump();
+    CPPUNIT_ASSERT(pXmlDoc);
+
+    // the problem with this table is that the 3rd text frame (inside a nested
+    // table) contains an as-char fly that doesn't fit on a page with the
+    // repeated header row; currently it's split so that the 3rd text frame is
+    // on a page of its own and extends outside the table.
+
+    assertXPathNoAttribute(pXmlDoc, "/root/page[4]/body/tab[1]", "precede");
+    CPPUNIT_ASSERT(!getXPath(pXmlDoc, "/root/page[4]/body/tab[1]", 
"follow").isEmpty());
+    assertXPath(pXmlDoc, "/root/page[4]/body/tab[1]/row[1]/cell[1]/tab", 1);
+    assertXPath(pXmlDoc, "/root/page[4]/body/tab[1]/row[2]/cell[1]/txt", 2);
+    CPPUNIT_ASSERT(!getXPath(pXmlDoc, "/root/page[5]/body/tab[1]", 
"precede").isEmpty());
+    assertXPathNoAttribute(pXmlDoc, "/root/page[5]/body/tab[1]", "follow");
+    assertXPath(pXmlDoc, "/root/page[5]/body/tab[1]/row[1]/cell[1]/tab", 1);
+    assertXPath(pXmlDoc, "/root/page[5]/body/tab[1]/row[2]/cell[1]/tab", 1);
+    assertXPathNoAttribute(pXmlDoc, 
"/root/page[5]/body/tab[1]/row[2]/cell[1]/tab", "follow");
+    assertXPath(pXmlDoc, 
"/root/page[5]/body/tab[1]/row[2]/cell[1]/tab/row/cell/txt", 1);
+}
+
 CPPUNIT_TEST_FIXTURE(SwLayoutWriter, testTdf152413)
 {
     createSwDoc("tdf152413.fodt");
diff --git a/sw/source/core/layout/findfrm.cxx 
b/sw/source/core/layout/findfrm.cxx
index ae2c7473baf3..1a98f6cf6747 100644
--- a/sw/source/core/layout/findfrm.cxx
+++ b/sw/source/core/layout/findfrm.cxx
@@ -945,9 +945,19 @@ SwFrame *SwFrame::FindNext_()
                          )
                        )
                     {
-                        pRet = pNxtCnt->IsInTab() ? pNxtCnt->FindTabFrame()
-                                                    : pNxtCnt;
-                        break;
+                        if (pNxtCnt->IsInTab())
+                        {
+                            if (!IsTabFrame() || 
!static_cast<SwLayoutFrame*>(this)->IsAnLower(pNxtCnt))
+                            {
+                                pRet = pNxtCnt->FindTabFrame();
+                                break;
+                            }
+                        }
+                        else
+                        {
+                            pRet = pNxtCnt;
+                            break;
+                        }
                     }
                     pNxtCnt = lcl_NextFrame( pNxtCnt );
                 }
commit 7a13305052806ddab07648e0701d82acb0ea76f0
Author:     Tibor Nagy <nagy.tib...@nisz.hu>
AuthorDate: Fri Aug 4 00:39:24 2023 +0200
Commit:     Xisco Fauli <xiscofa...@libreoffice.org>
CommitDate: Tue Aug 22 20:58:50 2023 +0200

    Fix heap-use-after-free
    
    The issue is caused by commit Ic87983fa6e3279a64841babc565fbe97710ff730
    (tdf#99808 sc: fix background of conditional formatting in merged cell)
    
    Change-Id: Ic72ba16c2649537dc3b486e07c12e2486cdf1957
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/155328
    Tested-by: Jenkins
    Reviewed-by: Stephan Bergmann <sberg...@redhat.com>
    (cherry picked from commit 694bacca057c9f1d93ab27d61199aec9d060b868)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/155299
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/sc/qa/unit/ucalc_condformat.cxx b/sc/qa/unit/ucalc_condformat.cxx
index 6b79a4318501..7a0abc7cf026 100644
--- a/sc/qa/unit/ucalc_condformat.cxx
+++ b/sc/qa/unit/ucalc_condformat.cxx
@@ -1394,21 +1394,19 @@ CPPUNIT_TEST_FIXTURE(TestCondformat, 
testConditionStyleInMergedCell)
     // Add a conditional format.
     auto pFormat = std::make_unique<ScConditionalFormat>(1, m_pDoc);
     pFormat->SetRange(ScRange(0, 0, 0, 0, 0, 0));
-    auto pFormatTmp = pFormat.get();
-    sal_uLong nKey = m_pDoc->AddCondFormat(std::move(pFormat), 0);
 
     // Add condition in which if the value equals 1, set the "Good" style.
     ScCondFormatEntry* pEntry = new ScCondFormatEntry(
         ScConditionMode::Equal, "=1", "", *m_pDoc, ScAddress(0, 0, 0), 
ScResId(STR_STYLENAME_GOOD));
-    pFormatTmp->AddEntry(pEntry);
+    pFormat->AddEntry(pEntry);
 
     // Apply the format to the range.
-    m_pDoc->AddCondFormatData(pFormatTmp->GetRange(), 0, nKey);
+    m_pDoc->AddCondFormatData(pFormat->GetRange(), 0, 1);
 
     ScDocFunc& rFunc = m_xDocShell->GetDocFunc();
-    sal_uInt32 nOldFormat = pFormatTmp->GetKey();
-    const ScRangeList& rRangeList = pFormatTmp->GetRange();
-    rFunc.ReplaceConditionalFormat(nOldFormat, pFormatTmp->Clone(), 0, 
rRangeList);
+    sal_uInt32 nOldFormat = pFormat->GetKey();
+    const ScRangeList& rRangeList = pFormat->GetRange();
+    rFunc.ReplaceConditionalFormat(nOldFormat, std::move(pFormat), 0, 
rRangeList);
 
     CPPUNIT_ASSERT_EQUAL(true, aListener.mbPaintAllMergedCell);
 

Reply via email to