sw/source/core/layout/anchoreddrawobject.cxx |   10 ++++++----
 sw/source/core/layout/fly.cxx                |   13 ++++++++-----
 2 files changed, 14 insertions(+), 9 deletions(-)
New commits:
commit b3d710ffd5f63d9c37a61fccc97213d22c4d721f
Author:     Matt K <matt...@gmail.com>
AuthorDate: Sun Jan 21 12:23:33 2024 -0600
Commit:     Xisco Fauli <xiscofa...@libreoffice.org>
CommitDate: Mon Jan 22 21:37:39 2024 +0100

    tdf#132810 Prevent more crashes on gallery objects
    
    This change is a follow-up to https://gerrit.libreoffice.org/c/core/+/161950
    where there is still a crash occurring on application close, and
    a general crash when using gallery objects.  The fix is to check for object
    existence or if the object has the destructor bit set before using the
    objects.
    
    Here is the callstack for the assert that was removed:
    
    >       swlo.dll!SwClient::GetRegisteredIn() Line 166   C++
            swlo.dll!SwContact::GetFormat() Line 112        C++
            swlo.dll!SwAnchoredDrawObject::GetFrameFormat() Line 622        C++
            swlo.dll!SwAnchoredObject::FindAnchorCharFrame() Line 719       C++
            swlo.dll!SwAnchoredObject::GetAnchorFrameContainingAnchPos() Line 
132   C++
            swlo.dll!SwAnchoredObject::FindPageFrameOfAnchor() Line 697     C++
            swlo.dll!SwObjectFormatterLayFrame::AdditionalFormatObjsOnPage() 
Line 144       C++
            swlo.dll!SwObjectFormatterLayFrame::DoFormatObjs() Line 94      C++
            swlo.dll!SwObjectFormatter::FormatObjsAtFrame(SwFrame & 
_rAnchorFrame, const SwPageFrame & _rPageFrame, SwLayAction * _pLayAction) Line 
160     C++
            swlo.dll!SwLayAction::InternalAction(OutputDevice * pRenderContext) 
Line 565    C++
            swlo.dll!SwLayAction::Action(OutputDevice * pRenderContext) Line 
390    C++
            swlo.dll!SwViewShell::ImplEndAction(const bool bIdleEnd) Line 308   
    C++
            swlo.dll!SwViewShell::EndAction(const bool bIdleEnd) Line 628   C++
            swlo.dll!SwCursorShell::EndAction(const bool bIdleEnd) Line 266 C++
            swlo.dll!SwEditShell::EndAllAction() Line 102   C++
            swlo.dll!SwWrtShell::Do(SwWrtShell::DoType eDoType, unsigned short 
nCnt, unsigned short nOffset) Line 60        C++
            swlo.dll!SwBaseShell::ExecUndo(SfxRequest & rReq) Line 655      C++
    
    Change-Id: I90bd40f3ae864ec9655340c342ddc16b59d79aba
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/162349
    Tested-by: Jenkins
    Reviewed-by: Mike Kaganski <mike.kagan...@collabora.com>
    (cherry picked from commit 6840c242684986483624557a405a00e91ea048e9)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/162371
    Reviewed-by: Matt K <matt...@gmail.com>
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/sw/source/core/layout/anchoreddrawobject.cxx 
b/sw/source/core/layout/anchoreddrawobject.cxx
index 77a19aa8295a..5a9e1245afd8 100644
--- a/sw/source/core/layout/anchoreddrawobject.cxx
+++ b/sw/source/core/layout/anchoreddrawobject.cxx
@@ -619,13 +619,15 @@ void SwAnchoredDrawObject::InvalidateObjPos()
 
 SwFrameFormat* SwAnchoredDrawObject::GetFrameFormat()
 {
-    
assert(static_cast<SwDrawContact*>(GetUserCall(GetDrawObj()))->GetFormat());
-    return static_cast<SwDrawContact*>(GetUserCall(GetDrawObj()))->GetFormat();
+    if (SwDrawContact* pDC = 
static_cast<SwDrawContact*>(GetUserCall(GetDrawObj())))
+        return pDC->GetFormat();
+    return nullptr;
 }
 const SwFrameFormat* SwAnchoredDrawObject::GetFrameFormat() const
 {
-    
assert(static_cast<SwDrawContact*>(GetUserCall(GetDrawObj()))->GetFormat());
-    return static_cast<SwDrawContact*>(GetUserCall(GetDrawObj()))->GetFormat();
+    if (SwDrawContact* pDC = 
static_cast<SwDrawContact*>(GetUserCall(GetDrawObj())))
+        return pDC->GetFormat();
+    return nullptr;
 }
 
 SwRect SwAnchoredDrawObject::GetObjRect() const
diff --git a/sw/source/core/layout/fly.cxx b/sw/source/core/layout/fly.cxx
index 8b3b316ec469..503dfedb35fa 100644
--- a/sw/source/core/layout/fly.cxx
+++ b/sw/source/core/layout/fly.cxx
@@ -2596,12 +2596,15 @@ void SwFrame::RemoveDrawObj( SwAnchoredObject& 
_rToRemoveObj )
 {
     // Notify accessible layout.
 #if !ENABLE_WASM_STRIP_ACCESSIBILITY
-    SwViewShell* pSh = getRootFrame()->GetCurrShell();
-    if( pSh )
+    if (!mbInDtor)
     {
-        SwRootFrame* pLayout = getRootFrame();
-        if (pLayout && pLayout->IsAnyShellAccessible())
-            pSh->Imp()->DisposeAccessibleObj(_rToRemoveObj.GetDrawObj(), 
false);
+        SwViewShell* pSh = getRootFrame()->GetCurrShell();
+        if (pSh)
+        {
+            SwRootFrame* pLayout = getRootFrame();
+            if (pLayout && pLayout->IsAnyShellAccessible())
+                pSh->Imp()->DisposeAccessibleObj(_rToRemoveObj.GetDrawObj(), 
false);
+        }
     }
 #endif
 

Reply via email to