sw/source/core/layout/tabfrm.cxx |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

New commits:
commit f40515eefd466a58d207750f13d713a169c18b23
Author:     Miklos Vajna <vmik...@collabora.com>
AuthorDate: Wed Jul 30 09:19:57 2025 +0200
Commit:     Xisco Fauli <xiscofa...@libreoffice.org>
CommitDate: Thu Aug 7 10:21:49 2025 +0200

    sw: fix crash in lcl_InnerCalcLayout()
    
    Crashreport signature:
    
    kit-32444-32444 2025-07-30 00:27:03.547433 +0000 [ kitbroker_7771 ] SIG   
Fatal signal received: SIGSEGV code: 1 for address: 0xa8
    ...
    program/libswlo.so
          lcl_InnerCalcLayout(SwFrame*, long, bool)
                  sw/source/core/inc/rootfrm.hxx:217
    program/libswlo.so
          lcl_RecalcRow(SwRowFrame&, long)
                  sw/source/core/layout/tabfrm.cxx:1923
    program/libswlo.so
          SwTabFrame::MakeAll(OutputDevice*) [clone .localalias]
                  sw/source/core/inc/flowfrm.hxx:170
    program/libswlo.so
          SwFrame::PrepareMake(OutputDevice*)
                  sw/source/core/inc/frmtool.hxx:476
    
    and then gdb reports:
    
            Program terminated with signal SIGSEGV, Segmentation fault.
            #0  0x00007fa134d7e4c4 in SwRootFrame::GetCurrShell 
(this=<optimized out>) at sw/source/core/inc/rootfrm.hxx:217
            217         SwViewShell *GetCurrShell() const { return mpCurrShell; 
}
            (gdb) up
            #1  lcl_InnerCalcLayout(SwFrame*, long, bool) () at 
sw/source/core/layout/tabfrm.cxx:1864
            1864        vcl::RenderContext* pRenderContext = 
pFrame->getRootFrame()->GetCurrShell() ? 
pFrame->getRootFrame()->GetCurrShell()->GetOut() : nullptr;
            (gdb) print pFrame
            $2 = (SwFrame *) 0x0
    
    Change-Id: I78a02ec062ad1c9645dbcb2fe82a5ae732d1f060
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/188584
    Reviewed-by: Miklos Vajna <vmik...@collabora.com>
    Tested-by: Jenkins
    (cherry picked from commit 548adbdda062ce595b49939a617fcccf2cf212de)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/188675
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/sw/source/core/layout/tabfrm.cxx b/sw/source/core/layout/tabfrm.cxx
index 003b528dcbd7..145429b107b3 100644
--- a/sw/source/core/layout/tabfrm.cxx
+++ b/sw/source/core/layout/tabfrm.cxx
@@ -1873,10 +1873,15 @@ static bool lcl_InnerCalcLayout( SwFrame *pFrame,
                                       tools::Long nBottom,
                                       bool _bOnlyRowsAndCells )
 {
+    bool bRet = false;
+    if (!pFrame)
+    {
+        return bRet;
+    }
+
     vcl::RenderContext* pRenderContext = 
pFrame->getRootFrame()->GetCurrShell() ? 
pFrame->getRootFrame()->GetCurrShell()->GetOut() : nullptr;
     // LONG_MAX == nBottom means we have to calculate all
     bool bAll = LONG_MAX == nBottom;
-    bool bRet = false;
     const SwFrame* pOldUp = pFrame->GetUpper();
     SwRectFnSet aRectFnSet(pFrame);
     do

Reply via email to