vcl/jsdialog/jsdialogbuilder.cxx |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

New commits:
commit 4a75ae2e2c7405a5f3f431e38b0245974970adf7
Author:     Miklos Vajna <[email protected]>
AuthorDate: Thu Nov 13 08:42:21 2025 +0100
Commit:     Caolán McNamara <[email protected]>
CommitDate: Thu Nov 13 14:40:55 2025 +0100

    vcl: fix crash in JSTreeView::render_entry()
    
    Crashreport signature:
            #0  SvTreeListEntry::GetUserData (this=0x0) at 
/home/collabora/online-buildscripts/staging/builddir/libreoffice/include/vcl/toolkit/treelistentry.hxx:109
            #1  SalInstanceTreeView::CustomRenderHdl (payload=..., 
this=0x32ad68f0) at 
/home/collabora/online-buildscripts/staging/builddir/libreoffice/vcl/source/app/salvtables.cxx:5168
            #2  SalInstanceTreeView::LinkStubCustomRenderHdl 
(instance=0x32ad68f0, data=std::tuple containing = {...})
                at 
/home/collabora/online-buildscripts/staging/builddir/libreoffice/vcl/source/app/salvtables.cxx:5163
            #3  0x00007f3dfddaba0c in Link<std::tuple<OutputDevice&, 
tools::Rectangle const&, SvTreeListEntry const&>, void>::Call (data=..., 
this=<optimized out>)
                at 
/home/collabora/online-buildscripts/staging/builddir/libreoffice/include/tools/link.hxx:111
            #4  SvTreeListBox::DrawCustomEntry (this=<optimized out>, 
rRenderContext=..., rRect=..., rEntry=...)
                at 
/home/collabora/online-buildscripts/staging/builddir/libreoffice/vcl/source/treelist/treelistbox.cxx:2881
            #5  0x00007f3dfe0d7d83 in JSTreeView::render_entry 
(this=0x32ad68f0, pos=74, dpix=<optimized out>, dpiy=<optimized out>)
                at 
/home/collabora/online-buildscripts/staging/builddir/libreoffice/vcl/jsdialog/jsdialogbuilder.cxx:1887
    
    And gdb on the coredump days rEntry is nullptr.
    SvImpLBox::ScrollToAbsPos() checks for the GetEntryAtAbsPos() return
    value already, do the same here.
    
    Change-Id: I48c5b59a5e5b5d7e4e15b67264836927c45dd7f5
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/193939
    Tested-by: Jenkins CollaboraOffice <[email protected]>
    Reviewed-by: Caolán McNamara <[email protected]>

diff --git a/vcl/jsdialog/jsdialogbuilder.cxx b/vcl/jsdialog/jsdialogbuilder.cxx
index e31e1c34247b..c92003d9038c 100644
--- a/vcl/jsdialog/jsdialogbuilder.cxx
+++ b/vcl/jsdialog/jsdialogbuilder.cxx
@@ -1880,11 +1880,15 @@ void JSTreeView::render_entry(int pos, int dpix, int 
dpiy)
     pDevice->SetDPIX(96.0 * dpix / 100);
     pDevice->SetDPIY(96.0 * dpiy / 100);
 
-    SvTreeListEntry* rEntry = m_xTreeView->GetEntryAtAbsPos(pos);
+    SvTreeListEntry* pEntry = m_xTreeView->GetEntryAtAbsPos(pos);
+    if (!pEntry)
+    {
+        return;
+    }
 
     Size aRenderSize = signal_custom_get_size(*pDevice, get_id(pos));
     pDevice->SetOutputSize(aRenderSize);
-    m_xTreeView->DrawCustomEntry(*pDevice, tools::Rectangle(Point(0, 0), 
aRenderSize), *rEntry);
+    m_xTreeView->DrawCustomEntry(*pDevice, tools::Rectangle(Point(0, 0), 
aRenderSize), *pEntry);
 
     BitmapEx aImage = pDevice->GetBitmapEx(Point(0, 0), aRenderSize);
 

Reply via email to