sc/source/core/data/dociter.cxx            |    8 ++++++--
 sc/source/ui/view/cellsh.cxx               |    3 ++-
 sc/source/ui/view/viewfunc.cxx             |    3 ++-
 sfx2/source/sidebar/SidebarController.cxx  |   11 +++++++----
 sw/source/core/doc/docfmt.cxx              |    9 +++++++++
 sw/source/core/frmedt/feshview.cxx         |    8 +++++++-
 sw/source/uibase/uiview/viewdraw.cxx       |    2 ++
 sw/uiconfig/swxform/toolbar/formdesign.xml |    2 +-
 vcl/source/control/button.cxx              |    8 +++++++-
 vcl/source/window/cursor.cxx               |    5 +++--
 vcl/source/window/dockmgr.cxx              |    4 ++++
 vcl/source/window/event.cxx                |    3 ++-
 vcl/source/window/floatwin.cxx             |    2 ++
 vcl/source/window/window.cxx               |    5 +++--
 vcl/source/window/window2.cxx              |    3 ++-
 15 files changed, 59 insertions(+), 17 deletions(-)

New commits:
commit afc5889493a16a74dd8086ddc02c84fa78fd401d
Author:     Ashod Nakashian <ashod.nakash...@collabora.co.uk>
AuthorDate: Sat Mar 21 11:48:40 2020 -0400
Commit:     Samuel Mehrbrodt <samuel.mehrbr...@allotropia.de>
CommitDate: Mon May 23 11:24:52 2022 +0200

    sw: check for null SdrObject before accessing
    
    Change-Id: I30f1cc658450982232feea10dbe9c5bfefe07d91
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/90896
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
    Reviewed-by: Ashod Nakashian <ashnak...@gmail.com>
    (cherry picked from commit 8ed4ac6152c96280616a784b47c4f75df147501a)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/90946
    Tested-by: Jenkins

diff --git a/sw/source/uibase/uiview/viewdraw.cxx 
b/sw/source/uibase/uiview/viewdraw.cxx
index 6866b31cd3b1..465ab3dfc82d 100644
--- a/sw/source/uibase/uiview/viewdraw.cxx
+++ b/sw/source/uibase/uiview/viewdraw.cxx
@@ -668,6 +668,8 @@ bool SwView::AreOnlyFormsSelected() const
         {
             // Except controls, are still normal draw objects selected?
             SdrObject *pSdrObj = rMarkList.GetMark(i)->GetMarkedSdrObj();
+            if (!pSdrObj)
+                continue;
 
             if (!HasOnlyObj(pSdrObj, SdrInventor::FmForm))
             {
commit 25ba49d3de229f940fa7271beb0a84c2ff297618
Author:     Ashod Nakashian <ashod.nakash...@collabora.co.uk>
AuthorDate: Sun Feb 2 14:37:38 2020 -0500
Commit:     Samuel Mehrbrodt <samuel.mehrbr...@allotropia.de>
CommitDate: Mon May 23 11:21:41 2022 +0200

    vcl: avoid accessing null member on unloading views
    
    Change-Id: If4e416c7257c861b9e13352b3329d9719b159e61
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/87830
    Reviewed-by: Michael Meeks <michael.me...@collabora.com>
    Tested-by: Aron Budea <aron.bu...@collabora.com>
    (cherry picked from commit 9ec3d637c1c99c729da67eafc375efce1cc7f026)

diff --git a/vcl/source/window/cursor.cxx b/vcl/source/window/cursor.cxx
index 3bdd19b08ddf..708fb19793fc 100644
--- a/vcl/source/window/cursor.cxx
+++ b/vcl/source/window/cursor.cxx
@@ -193,8 +193,9 @@ void vcl::Cursor::ImplDoShow( bool bDrawDirect, bool 
bRestore )
             // show the cursor, if there is an active window and the cursor
             // has been selected in this window
             pWindow = Application::GetFocusWindow();
-            if ( !pWindow || (pWindow->mpWindowImpl->mpCursor != this) || 
pWindow->mpWindowImpl->mbInPaint
-                || !pWindow->mpWindowImpl->mpFrameData->mbHasFocus )
+            if (!pWindow || !pWindow->mpWindowImpl || 
(pWindow->mpWindowImpl->mpCursor != this)
+                || pWindow->mpWindowImpl->mbInPaint
+                || !pWindow->mpWindowImpl->mpFrameData->mbHasFocus)
                 pWindow = nullptr;
         }
 
commit e901a1e3a6914da49cc69fbb898cf2df1e9e92c7
Author:     Ashod Nakashian <ashod.nakash...@collabora.co.uk>
AuthorDate: Wed Dec 18 07:30:14 2019 -0500
Commit:     Samuel Mehrbrodt <samuel.mehrbr...@allotropia.de>
CommitDate: Mon May 23 11:21:16 2022 +0200

    vcl: don't use null window in FloatingWindow HitTest
    
    Change-Id: I551f31cf30c7a58642becebe0256684055d0703a
    Reviewed-on: https://gerrit.libreoffice.org/85383
    Reviewed-by: Ashod Nakashian <ashnak...@gmail.com>
    Tested-by: Ashod Nakashian <ashnak...@gmail.com>
    (cherry picked from commit 65685bac09a4320602f4dda5151d247c5a83a75c)

diff --git a/vcl/source/window/floatwin.cxx b/vcl/source/window/floatwin.cxx
index baa3a46bc978..4eef15b88be2 100644
--- a/vcl/source/window/floatwin.cxx
+++ b/vcl/source/window/floatwin.cxx
@@ -520,6 +520,8 @@ FloatingWindow* FloatingWindow::ImplFloatHitTest( 
vcl::Window* pReference, const
 
         // use the border window to have the exact position
         vcl::Window *pBorderWin = pWin->GetWindow( GetWindowType::Border );
+        if (!pBorderWin)
+            break;
 
         // the top-left corner in output coordinates ie (0,0)
         tools::Rectangle devRect( 
pBorderWin->ImplOutputToUnmirroredAbsoluteScreenPixel( tools::Rectangle( 
Point(), pBorderWin->GetSizePixel()) ) ) ;
commit 3fee58e0194ccc375a6fd3fc35197229df2518b0
Author:     Szymon Kłos <szymon.k...@collabora.com>
AuthorDate: Fri Dec 4 12:24:27 2020 +0100
Commit:     Samuel Mehrbrodt <samuel.mehrbr...@allotropia.de>
CommitDate: Mon May 23 11:00:59 2022 +0200

    Avoid crash on closing docking window
    
    Change-Id: I9f5ac4fae9e37e3eece8ad8bd2d6505514517d9f
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/107215
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
    Reviewed-by: Szymon Kłos <szymon.k...@collabora.com>

diff --git a/vcl/source/window/dockmgr.cxx b/vcl/source/window/dockmgr.cxx
index 45708e8d709f..ee3ae7261221 100644
--- a/vcl/source/window/dockmgr.cxx
+++ b/vcl/source/window/dockmgr.cxx
@@ -376,6 +376,10 @@ void DockingManager::RemoveWindow( const vcl::Window 
*pWindow )
     {
         if( (*it)->mpDockingWindow == pWindow )
         {
+            // deleting wrappers calls set of actions which may want to use
+            // wrapper we want to delete - avoid crash using temporary owner
+            // while erasing
+            auto pTemporaryOwner = std::move(*it);
             mvDockingWindows.erase( it );
             break;
         }
commit 44d80c54581b818a7405e98a591ba3b0632747ee
Author:     Miklos Vajna <vmik...@collabora.com>
AuthorDate: Fri Apr 9 16:40:01 2021 +0200
Commit:     Samuel Mehrbrodt <samuel.mehrbr...@allotropia.de>
CommitDate: Mon May 23 10:54:01 2022 +0200

    sw style copy: fix crash when handling a conditional paragraphy style
    
    - "Text body" is normally a conditional style for a full-blown, default
      SwDoc
    
    - SwTransferable::GetData() creates a temporary, stripped down SwDoc,
      which has a "Text body" style, but it's not conditional
    
    - SwDoc::CopyFormatArr() assumes that in case the target already has a
      style with a given name, then either both the source and destination
      styles are conditional, or neither
    
    - in practice this only causes a crash if the style is customized, as we
      skip default styles, probably that's why this was not noticed so far
    
    The Online case invokes this as part of
    lok::Document::getSelectionType(), so it was enough to set the paragraph
    style to Text body and then select some of that text (with a suitable
    document) to hit this.
    
    Based on a patch from Michael Meeks, thanks for that.
    
    (cherry picked from commit ce98bef935dccd79735615a9299b2aa7a1ab0b94)
    
    Conflicts:
            sw/qa/extras/tiledrendering/tiledrendering.cxx
    
    Change-Id: Ic3c27ec582ae1745469042856254313cbc996ee0
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/113970
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
    Reviewed-by: Mike Kaganski <mike.kagan...@collabora.com>

diff --git a/sw/source/core/doc/docfmt.cxx b/sw/source/core/doc/docfmt.cxx
index f7a11676594e..e61d27c6a961 100644
--- a/sw/source/core/doc/docfmt.cxx
+++ b/sw/source/core/doc/docfmt.cxx
@@ -1328,9 +1328,18 @@ void SwDoc::CopyFormatArr( const SwFormatsBase& 
rSourceArr,
 
 //FEATURE::CONDCOLL
             if( RES_CONDTXTFMTCOLL == pSrc->Which() )
+            {
+                if (pDstColl->Which() != RES_CONDTXTFMTCOLL)
+                {
+                    // Target already had a style with a matching name, but 
it's not a conditional
+                    // style, then don't copy the conditions.
+                    continue;
+                }
+
                 // Copy the conditions, but delete the old ones first!
                 
static_cast<SwConditionTextFormatColl*>(pDstColl)->SetConditions(
                             
static_cast<SwConditionTextFormatColl*>(pSrc)->GetCondColls() );
+            }
 //FEATURE::CONDCOLL
         }
     }
commit 9b1d7b235753c85151cc97503764bc99a8903618
Author:     Tünde Tóth <toth.tu...@nisz.hu>
AuthorDate: Tue May 11 11:21:35 2021 +0200
Commit:     Samuel Mehrbrodt <samuel.mehrbr...@allotropia.de>
CommitDate: Mon May 23 10:50:01 2022 +0200

    tdf#57351 sc UI: fix disabled Insert Columns options
    
    In a sheet with active autofilter or standard filter,
    Insert Columns Before/After weren't available in the
    context menu of the column header and in Sheet->Insert
    Columns...
    
    Change-Id: I746d7d5a451848306d67d57e42d3981c471c66f2
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/115400
    Tested-by: László Németh <nem...@numbertext.org>
    Reviewed-by: László Németh <nem...@numbertext.org>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/119146
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
    Reviewed-by: Andras Timar <andras.ti...@collabora.com>

diff --git a/sc/source/ui/view/cellsh.cxx b/sc/source/ui/view/cellsh.cxx
index 67908ba1ba68..6b1fc8cf7ef0 100644
--- a/sc/source/ui/view/cellsh.cxx
+++ b/sc/source/ui/view/cellsh.cxx
@@ -254,7 +254,8 @@ void ScCellShell::GetBlockState( SfxItemSet& rSet )
                 if (nWhich == FID_INS_COLUMNS_AFTER)
                     eAction = sc::ColRowEditAction::InsertColumnsAfter;
 
-                bDisable = (!bSimpleArea) || GetViewData()->SimpleRowMarked();
+                bDisable = (!bSimpleArea && eMarkType != 
SC_MARK_SIMPLE_FILTERED)
+                           || GetViewData()->SimpleRowMarked();
                 if (!bEditable && nRow1 == 0 && nRow2 == pDoc->MaxRow())
                 {
                     // See if row insertions are allowed.
diff --git a/sc/source/ui/view/viewfunc.cxx b/sc/source/ui/view/viewfunc.cxx
index 21d10fcd1726..8d3afb70ea2e 100644
--- a/sc/source/ui/view/viewfunc.cxx
+++ b/sc/source/ui/view/viewfunc.cxx
@@ -1602,7 +1602,8 @@ void ScViewFunc::OnLOKSetWidthOrHeight(SCCOLROW nStart, 
bool bWidth)
 bool ScViewFunc::InsertCells( InsCellCmd eCmd, bool bRecord, bool bPartOfPaste 
)
 {
     ScRange aRange;
-    if (GetViewData().GetSimpleArea(aRange) == SC_MARK_SIMPLE)
+    ScMarkType eMarkType = GetViewData().GetSimpleArea(aRange);
+    if (eMarkType == SC_MARK_SIMPLE || eMarkType == SC_MARK_SIMPLE_FILTERED)
     {
         ScDocShell* pDocSh = GetViewData().GetDocShell();
         const ScMarkData& rMark = GetViewData().GetMarkData();
commit d572ee2d6c17c112a457d47d759a72bffcbc4bba
Author:     Michael Meeks <michael.me...@collabora.com>
AuthorDate: Mon Aug 2 13:38:31 2021 +0100
Commit:     Samuel Mehrbrodt <samuel.mehrbr...@allotropia.de>
CommitDate: Mon May 23 10:49:16 2022 +0200

    vcl: avoid native widget pieces for disposed BorderWindow.
    
    Fixes crash around help windows:
            vcl::Window::IsCompoundControl() const
                    vcl/source/window/window2.cxx:1200
            vcl::Window::Show(bool, ShowFlags)
                    vcl/source/window/window.cxx:2243 (discriminator 3)
            vcl::Window::Show(bool, ShowFlags)
                    vcl/source/window/window.cxx:2298
            HelpTextWindow::ImplShow()
                    vcl/source/app/help.cxx:371
            Scheduler::ProcessTaskScheduling()
                    vcl/source/app/scheduler.cxx:495
    
    Change-Id: Ia0205813f3e9d306314577d59d6cdd1bdfa0ee71
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/119881
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
    Reviewed-by: Miklos Vajna <vmik...@collabora.com>

diff --git a/vcl/source/window/window.cxx b/vcl/source/window/window.cxx
index 49551be5f901..9a5a6cde533b 100644
--- a/vcl/source/window/window.cxx
+++ b/vcl/source/window/window.cxx
@@ -2239,7 +2239,8 @@ void Window::Show(bool bVisible, ShowFlags nFlags)
         // inherit native widget flag for form controls
         // required here, because frames never show up in the child hierarchy 
- which should be fixed...
         // eg, the drop down of a combobox which is a system floating window
-        if( mpWindowImpl->mbFrame && GetParent() && 
GetParent()->IsCompoundControl() &&
+        if( mpWindowImpl->mbFrame && GetParent() && !GetParent()->IsDisposed() 
&&
+            GetParent()->IsCompoundControl() &&
             GetParent()->IsNativeWidgetEnabled() != IsNativeWidgetEnabled() &&
             !(GetStyle() & WB_TOOLTIPWIN) )
         {
@@ -3706,7 +3707,7 @@ void Window::EnableNativeWidget( bool bEnable )
 
 bool Window::IsNativeWidgetEnabled() const
 {
-    return ImplGetWinData()->mbEnableNativeWidget;
+    return mpWindowImpl ? ImplGetWinData()->mbEnableNativeWidget : false;
 }
 
 Reference< css::rendering::XCanvas > Window::ImplGetCanvas( bool bSpriteCanvas 
) const
diff --git a/vcl/source/window/window2.cxx b/vcl/source/window/window2.cxx
index 0e4b3d6ee00f..e2c306fdab1b 100644
--- a/vcl/source/window/window2.cxx
+++ b/vcl/source/window/window2.cxx
@@ -1182,7 +1182,7 @@ GetFocusFlags Window::GetGetFocusFlags() const
 
 bool Window::IsCompoundControl() const
 {
-    return mpWindowImpl->mbCompoundControl;
+    return mpWindowImpl ? mpWindowImpl->mbCompoundControl : false;
 }
 
 bool Window::IsWait() const
commit 019d9472d29adbb6487e20433b6c576047b16e66
Author:     Szymon Kłos <szymon.k...@collabora.com>
AuthorDate: Mon Aug 23 10:06:26 2021 +0200
Commit:     Samuel Mehrbrodt <samuel.mehrbr...@allotropia.de>
CommitDate: Mon May 23 10:48:33 2022 +0200

    Check mpWindowImpl before use in Window::EndTracking
    
    Change-Id: I0a4ddd1b61f5919f346bb2f3a1e2ca9fbad958bc
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/120860
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
    Reviewed-by: Andras Timar <andras.ti...@collabora.com>

diff --git a/vcl/source/window/window2.cxx b/vcl/source/window/window2.cxx
index aa791975e765..0e4b3d6ee00f 100644
--- a/vcl/source/window/window2.cxx
+++ b/vcl/source/window/window2.cxx
@@ -286,6 +286,7 @@ void Window::EndTracking( TrackingEventFlags nFlags )
         ReleaseMouse();
 
         // call EndTracking if required
+        if (mpWindowImpl && mpWindowImpl->mpFrameData)
         {
             Point           aMousePos( 
mpWindowImpl->mpFrameData->mnLastMouseX, 
mpWindowImpl->mpFrameData->mnLastMouseY );
             if( ImplIsAntiparallel() )
commit 87494146c5f56ef8779966f8c59544613a4d3f60
Author:     Michael Meeks <michael.me...@collabora.com>
AuthorDate: Tue Nov 23 14:25:45 2021 +0000
Commit:     Samuel Mehrbrodt <samuel.mehrbr...@allotropia.de>
CommitDate: Mon May 23 10:45:50 2022 +0200

    Crash around help-windows.
    
    Seems a popular way to crash:
            vcl::Window::ImplCallMove()
                    vcl/source/window/event.cxx:555
            vcl::Window::Show(bool, ShowFlags) [clone .localalias]
                    /usr/include/c++/10/bits/unique_ptr.h:173
            vcl::Window::Show(bool, ShowFlags)
                    vcl/source/window/window.cxx:2345
            HelpTextWindow::ImplShow()
                    vcl/source/app/help.cxx:371
            Scheduler::ProcessTaskScheduling()
                    vcl/source/app/scheduler.cxx:495
    
    Change-Id: I33ca0059844395c41f4d76619cca22aec81df207
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/125702
    Tested-by: Michael Meeks <michael.me...@collabora.com>
    Reviewed-by: Jan Holesovsky <ke...@collabora.com>

diff --git a/vcl/source/window/event.cxx b/vcl/source/window/event.cxx
index edfa7fd8c4d8..a0ccb699b1d9 100644
--- a/vcl/source/window/event.cxx
+++ b/vcl/source/window/event.cxx
@@ -548,7 +548,8 @@ void Window::ImplCallMove()
         vcl::Window *pParent = ImplGetParent();
         while( pParent )
         {
-            if( pParent->mpWindowImpl->mpFrame != mpWindowImpl->mpFrame )
+            if( pParent->mpWindowImpl &&
+                pParent->mpWindowImpl->mpFrame != mpWindowImpl->mpFrame )
             {
                 pParentFrame = pParent->mpWindowImpl->mpFrame;
                 break;
commit b3ac549ba096dd7bfc6842a3d8e68a3cc4ad4054
Author:     Miklos Vajna <vmik...@collabora.com>
AuthorDate: Wed Dec 8 12:58:22 2021 +0100
Commit:     Samuel Mehrbrodt <samuel.mehrbr...@allotropia.de>
CommitDate: Mon May 23 10:45:06 2022 +0200

    sw: fix crash in SwFEShell::SelectObj()
    
    Crashreport signature:
    
            SwContact::GetFormat()
                    sw/inc/dcontact.hxx:112
            SwFEShell::SelectObj(Point const&, unsigned char, SdrObject*)
                    sw/source/core/frmedt/feshview.cxx:292
            SwWrtShell::UnSelectFrame()
                    sw/source/uibase/wrtsh/select.cxx:326
            SwWrtShell::DelRight()
                    sw/source/uibase/wrtsh/delete.cxx:467
            SwBaseShell::ExecDelete(SfxRequest&)
                    sw/source/uibase/shells/basesh.cxx:198
    
    I.e. it seems that in case we're in the middle of a delete, then it's
    possible that the mark list contains an SdrObject that doesn't have a
    matching SwClient anymore. Ignore such SdrObjects when looking for the
    textbox of a draw shape.
    
    Change-Id: I065b2ea44d39220184a5f604c3ea13f6a106ddb0
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/126537
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
    Reviewed-by: Mike Kaganski <mike.kagan...@collabora.com>
    (cherry picked from commit 2a6fde04a7ad716117118e5dada895ec87e24de3)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/126564

diff --git a/sw/source/core/frmedt/feshview.cxx 
b/sw/source/core/frmedt/feshview.cxx
index 2c6666b024f5..fd0a930a95a0 100644
--- a/sw/source/core/frmedt/feshview.cxx
+++ b/sw/source/core/frmedt/feshview.cxx
@@ -298,7 +298,13 @@ bool SwFEShell::SelectObj( const Point& rPt, sal_uInt8 
nFlag, SdrObject *pObj )
         for (size_t i = 0; i < rMrkList.GetMarkCount(); ++i)
         {
             SdrObject* pObject = rMrkList.GetMark(i)->GetMarkedSdrObj();
-            SwFrameFormat* pFormat = GetUserCall(pObject)->GetFormat();
+            SwContact* pContact = GetUserCall(pObject);
+            if (!pContact)
+            {
+                continue;
+            }
+
+            SwFrameFormat* pFormat = pContact->GetFormat();
             if (SwFrameFormat* pShapeFormat = 
SwTextBoxHelper::getOtherTextBoxFormat(pFormat, RES_FLYFRMFMT))
             {
                 SdrObject* pShape = pShapeFormat->FindSdrObject();
commit ce97861c1090e06493fa5fc823ed7795ba46e1e1
Author:     Aron Budea <aron.bu...@collabora.com>
AuthorDate: Wed Dec 9 18:39:54 2020 +0100
Commit:     Samuel Mehrbrodt <samuel.mehrbr...@allotropia.de>
CommitDate: Mon May 23 10:42:23 2022 +0200

    tdf#138762: crash when trying to open sidebar w chart in Writer
    
    In Writer when in chart edit mode, and the chart is deselected,
    the object selection remains. Opening Properties sidebar at
    this point crashed. Calc and Impress were unaffected.
    
    Regression from b5fdb148fe87a90f3e586efcea7aa6ef865fa42a
    
    Change-Id: I356c3a42c41dd38e4739df27c72c6d67722b1dbc
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/107500
    Tested-by: Jenkins
    Reviewed-by: Aron Budea <aron.bu...@collabora.com>
    (cherry picked from commit 7e5991dc695d1e590483615c2907811ce4117834)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/107544
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
    Reviewed-by: Andras Timar <andras.ti...@collabora.com>

diff --git a/sfx2/source/sidebar/SidebarController.cxx 
b/sfx2/source/sidebar/SidebarController.cxx
index 6161967f7920..21bef3138456 100644
--- a/sfx2/source/sidebar/SidebarController.cxx
+++ b/sfx2/source/sidebar/SidebarController.cxx
@@ -630,10 +630,13 @@ void SidebarController::OpenThenToggleDeck (
     SwitchToDeck(rsDeckId);
 
     // Make sure the sidebar is wide enough to fit the requested content
-    sal_Int32 nRequestedWidth = (mpCurrentDeck->GetMinimalWidth() + 
TabBar::GetDefaultWidth())
-                                * mpTabBar->GetDPIScaleFactor();
-    if (mnSavedSidebarWidth < nRequestedWidth)
-        SetChildWindowWidth(nRequestedWidth);
+    if (mpCurrentDeck && mpTabBar)
+    {
+        sal_Int32 nRequestedWidth = (mpCurrentDeck->GetMinimalWidth() + 
TabBar::GetDefaultWidth())
+                                    * mpTabBar->GetDPIScaleFactor();
+        if (mnSavedSidebarWidth < nRequestedWidth)
+            SetChildWindowWidth(nRequestedWidth);
+    }
 
     collectUIInformation(rsDeckId);
 }
commit e511110fcddd5a8b62f7a4788a2d517c63c67f3c
Author:     Michael Weghorn <m.wegh...@posteo.de>
AuthorDate: Mon Mar 28 11:05:34 2022 +0200
Commit:     Samuel Mehrbrodt <samuel.mehrbr...@allotropia.de>
CommitDate: Mon May 23 10:41:40 2022 +0200

    tdf#148235 Restore toolbar item to switch XForm to design mode
    
        commit 45b6f096e7ae86d0692ecdfd5b7069622d8a6efa
        Date:   Sun Oct 28 17:02:34 2018 +0100
    
            sw toolbars sync context toolbars between different apps
    
    had replaced the "Form Design" toolbar item to switch
    a complete XForm to design mode with an entry that
    switches the form controls to design mode instead.
    (The former one is labelled "Design Mode On/Off",
    the latter one just "Design Mode" in the English UI.)
    
    This meant that the XForm could no longer be switched
    to design mode from there, unless the toolbar was
    manually customized to add the entry back.
    
    This brings the previous toolbar item back.
    It also removes the one to switch the form controls
    to design mode again, since that one is already contained
    in the "Form Controls" toolbar, where it fits better.
    (And having two different toolbar items with almost
    identical labels but different functionality would
    probably be rather confusing.)
    
    Change-Id: Ia4c98dfa6ad8372eba08a9f08920153133a7f88d
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132207
    Reviewed-by: Andreas Kainz <kain...@gmail.com>
    Reviewed-by: Michael Weghorn <m.wegh...@posteo.de>
    Tested-by: Jenkins
    (cherry picked from commit 4f9bf4201bb706cd19142f0805cfc4c859186cd4)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132176
    Tested-by: Michael Weghorn <m.wegh...@posteo.de>

diff --git a/sw/uiconfig/swxform/toolbar/formdesign.xml 
b/sw/uiconfig/swxform/toolbar/formdesign.xml
index 067ddff0675f..f748bcf68e2e 100644
--- a/sw/uiconfig/swxform/toolbar/formdesign.xml
+++ b/sw/uiconfig/swxform/toolbar/formdesign.xml
@@ -44,7 +44,7 @@
  <toolbar:toolbaritem xlink:href=".uno:LeaveGroup" toolbar:visible="false"/>
  <toolbar:toolbarseparator/>
  <toolbar:toolbaritem xlink:href=".uno:SelectObject"/>
- <toolbar:toolbaritem xlink:href=".uno:SwitchControlDesignMode"/>
+ <toolbar:toolbaritem xlink:href=".uno:SwitchXFormsDesignMode"/>
  <toolbar:toolbarseparator/>
  <toolbar:toolbaritem xlink:href=".uno:ControlProperties"/>
  <toolbar:toolbaritem xlink:href=".uno:FormProperties"/>
commit cf1ef5d7d599d1d1f707e09f06cd794d91c8714f
Author:     Ilhan Yesil <ilhanye...@gmx.de>
AuthorDate: Mon Dec 14 17:39:55 2020 +0100
Commit:     Samuel Mehrbrodt <samuel.mehrbr...@allotropia.de>
CommitDate: Mon May 23 10:40:31 2022 +0200

    tdf#138901 Refresh button tooltip in sidebar created by extension
    
    The button's tooltip is refreshed after setting the button's text.
    
    Change-Id: I08f272c43c3312d462981d46ab961ef925eeccbf
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/107718
    Tested-by: Jenkins
    Reviewed-by: Ilhan Yesil <ilhanye...@gmx.de>
    (cherry picked from commit f1d9648b5196eacac080a2a4db42c06829554107)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/114292
    Tested-by: Thorsten Behrens <thorsten.behr...@allotropia.de>
    Reviewed-by: Thorsten Behrens <thorsten.behr...@allotropia.de>

diff --git a/vcl/source/control/button.cxx b/vcl/source/control/button.cxx
index a4ae36cffe15..5607a62d833a 100644
--- a/vcl/source/control/button.cxx
+++ b/vcl/source/control/button.cxx
@@ -77,6 +77,7 @@ public:
     long            mnSeparatorX;
     DrawButtonFlags mnButtonState;
     bool            mbSmallSymbol;
+    bool            mbGeneratedTooltip;
 
     Image           maImage;
     ImageAlign      meImageAlign;
@@ -87,7 +88,7 @@ public:
 };
 
 ImplCommonButtonData::ImplCommonButtonData() : maFocusRect(), mnSeparatorX(0), 
mnButtonState(DrawButtonFlags::NONE),
-mbSmallSymbol(false), maImage(), meImageAlign(ImageAlign::Top), 
meSymbolAlign(SymbolAlign::LEFT)
+mbSmallSymbol(false), mbGeneratedTooltip(false), maImage(), 
meImageAlign(ImageAlign::Top), meSymbolAlign(SymbolAlign::LEFT)
 {
 }
 
@@ -219,8 +220,13 @@ void Button::ImplDrawAlignedImage(OutputDevice* pDev, 
Point& rPos,
         tools::Rectangle textRect = GetTextRect(
             tools::Rectangle(Point(), Size(0x7fffffff, 0x7fffffff)), aText, 
nTextStyle);
         // If the button text doesn't fit into it, put it into a tooltip 
(might happen in sidebar)
+        if (GetQuickHelpText()!= aText && mpButtonData->mbGeneratedTooltip)
+            SetQuickHelpText("");
         if (GetQuickHelpText().isEmpty() && textRect.getWidth() > 
rSize.getWidth())
+        {
             SetQuickHelpText(aText);
+            mpButtonData->mbGeneratedTooltip = true;
+        }
 
         ImplSetFocusRect(aOutRect);
         rSize = aOutRect.GetSize();
commit b5bdf6ffe2d24a1ccb7bc57fc8d05702d34dafdc
Author:     Michael Weghorn <m.wegh...@posteo.de>
AuthorDate: Wed Jan 20 12:41:47 2021 +0100
Commit:     Samuel Mehrbrodt <samuel.mehrbr...@allotropia.de>
CommitDate: Mon May 23 10:40:06 2022 +0200

    Related tdf#139782 sc: Make sure column exists before accessing it
    
    While the first fix (Change-Id
    I12a780bf52024cef31188651813d3a93cc2b5ddd,
    "tdf#139782 sc: Don't try to access unallocated column") makes
    opening the simplified bugdoc I had attached to tdf#139782 work,
    the original document I was given (which I can't share as is, but
    from which the simplified bugdoc was created) had more formulas and
    managed to hit another similar issue related to the fact that columns
    are now dynamically allocated, and crashed trying to access one that
    wasn't yet allocated.
    
    Fix this place as well by making sure the column exists.
    
    Backtrace:
    
        "#0  __GI_raise (sig=sig@entry=6) at 
../sysdeps/unix/sysv/linux/raise.c:50\n"
        "#1  0x00007ffff7aa7537 in __GI_abort () at abort.c:79\n"
        "#2  0x00007ffff794beb1 in std::__throw_bad_exception() () at 
/lib/x86_64-linux-gnu/libstdc++.so.6\n"
        "#3  0x00007fffa0b161dc in 
std::__debug::vector<std::unique_ptr<ScColumn, o3tl::default_delete<ScColumn> 
>, std::allocator<std::unique_ptr<ScColumn, o3tl::default_delete<ScColumn> > > 
>::operator[](unsigned long) (this=0x555558827250, __n=84) at 
/usr/include/c++/10/debug/vector:427\n"
        "#4  0x00007fffa0c23935 in ScColContainer::operator[](unsigned long) 
(this=0x555558827250, nIndex=84) at 
.../libreoffice/sc/inc/colcontainer.hxx:44\n"
        "#5  0x00007fffa0c76275 in ScQueryCellIterator::InitPos() 
(this=0x7fffffff8040) at .../libreoffice/sc/source/core/data/dociter.cxx:1082\n"
        "#6  0x00007fffa0c76c28 in ScQueryCellIterator::GetFirst() 
(this=0x7fffffff8040) at .../libreoffice/sc/source/core/data/dociter.cxx:1233\n"
        "#7  0x00007fffa0c76fb6 in 
ScQueryCellIterator::FindEqualOrSortedLastInRange(short&, int&) 
(this=0x7fffffff8040, nFoundCol=@0x7fffffff7f58: 1024, 
nFoundRow=@0x7fffffff7fb0: 1048576) at 
.../libreoffice/sc/source/core/data/dociter.cxx:1304\n"
        "#8  0x00007fffa11b1529 in ScInterpreter::ScMatch() 
(this=0x5555619f7fd0) at 
.../libreoffice/sc/source/core/tool/interpr1.cxx:5050\n"
        "#9  0x00007fffa121f653 in ScInterpreter::Interpret() 
(this=0x5555619f7fd0) at 
.../libreoffice/sc/source/core/tool/interpr4.cxx:4247\n"
        "#10 0x00007fffa0f03bf5 in 
ScFormulaCell::InterpretTail(ScInterpreterContext&, 
ScFormulaCell::ScInterpretTailParameter) (this=0x55555e793030, rContext=..., 
eTailParam=ScFormulaCell::SCITP_NORMAL) at 
.../libreoffice/sc/source/core/data/formulacell.cxx:1952\n"
        "#11 0x00007fffa0f028b2 in ScFormulaCell::Interpret(int, int) 
(this=0x55555e793030, nStartOffset=-1, nEndOffset=-1) at 
.../libreoffice/sc/source/core/data/formulacell.cxx:1644\n"
        "#12 0x00007fffa0be0274 in ScFormulaCell::MaybeInterpret() 
(this=0x55555e793030) at .../libreoffice/sc/inc/formulacell.hxx:445\n"
        "#13 0x00007fffa0f07b34 in ScFormulaCell::GetErrCode() 
(this=0x55555e793030) at 
.../libreoffice/sc/source/core/data/formulacell.cxx:2974\n"
        "#14 0x00007fffa10bac28 in ScCellFormat::GetString(ScRefCellValue 
const&, unsigned int, rtl::OUString&, Color const**, SvNumberFormatter&, 
ScDocument const&, bool, bool, bool) (rCell=..., nFormat=0, rString=\"\", 
ppColor=0x7fffffff87e8, rFormatter=..., rDoc=..., bNullVals=true, 
bFormula=false, bUseStarFormat=false) at 
.../libreoffice/sc/source/core/tool/cellform.cxx:77\n"
        "#15 0x00007fffa0bcb8f8 in 
ScColumn::UpdateScriptType(sc::CellTextAttr&, int, 
mdds::detail::mtv::iterator_base<mdds::multi_type_vector<mdds::mtv::custom_block_func3<mdds::mtv::default_element_block<52,
 svl::SharedString>, mdds::mtv::noncopyable_managed_element_block<53, 
EditTextObject>, mdds::mtv::noncopyable_managed_element_block<54, 
ScFormulaCell> >, sc::CellStoreEvent>::iterator_trait, 
mdds::detail::mtv::private_data_forward_update<mdds::detail::mtv::iterator_value_node<unsigned
 long, mdds::mtv::base_element_block> > >&) (this=0x55555e793330, rAttr=..., 
nRow=1, itr=...) at .../libreoffice/sc/source/core/data/column3.cxx:794\n"
        "#16 0x00007fffa0b9e315 in 
ScColumn::GetRangeScriptType(mdds::detail::mtv::iterator_base<mdds::multi_type_vector<mdds::mtv::custom_block_func1<mdds::mtv::default_element_block<51,
 sc::CellTextAttr> >, mdds::detail::mtv::event_func>::iterator_trait, 
mdds::detail::mtv::private_data_forward_update<mdds::detail::mtv::iterator_value_node<unsigned
 long, mdds::mtv::base_element_block> > >&, int, int, 
mdds::detail::mtv::iterator_base<mdds::multi_type_vector<mdds::mtv::custom_block_func3<mdds::mtv::default_element_block<52,
 svl::SharedString>, mdds::mtv::noncopyable_managed_element_block<53, 
EditTextObject>, mdds::mtv::noncopyable_managed_element_block<54, 
ScFormulaCell> >, sc::CellStoreEvent>::iterator_trait, 
mdds::detail::mtv::private_data_forward_update<mdds::detail::mtv::iterator_value_node<unsigned
 long, mdds::mtv::base_element_block> > > const&) (this=0x55555e793330, 
itPos=..., nRow1=1, nRow2=1, itrCells_=...) at 
.../libreoffice/sc/source/core/data/column2.cxx:2089\n"
        "#17 0x00007fffa0b27563 in (anonymous 
namespace)::FindEditCellsHandler::operator()(size_t, ScFormulaCell const*) 
(this=0x7fffffff9180, nRow=1, p=0x55555e793030) at 
.../libreoffice/sc/source/core/data/column.cxx:3091\n"
        "#18 0x00007fffa0b31267 in 
sc::CheckElem<mdds::mtv::noncopyable_managed_element_block<54, ScFormulaCell>, 
mdds::multi_type_vector<mdds::mtv::custom_block_func3<mdds::mtv::default_element_block<52,
 svl::SharedString>, mdds::mtv::noncopyable_managed_element_block<53, 
EditTextObject>, mdds::mtv::noncopyable_managed_element_block<54, 
ScFormulaCell> >, sc::CellStoreEvent>, (anonymous 
namespace)::FindEditCellsHandler>(mdds::multi_type_vector<mdds::mtv::custom_block_func3<mdds::mtv::default_element_block<52,
 svl::SharedString>, mdds::mtv::noncopyable_managed_element_block<53, 
EditTextObject>, mdds::mtv::noncopyable_managed_element_block<54, 
ScFormulaCell> >, sc::CellStoreEvent> const&, 
mdds::multi_type_vector<mdds::mtv::custom_block_func3<mdds::mtv::default_element_block<52,
 svl::SharedString>, mdds::mtv::noncopyable_managed_element_block<53, 
EditTextObject>, mdds::mtv::noncopyable_managed_element_block<54, 
ScFormulaCell> >, sc::CellStoreEvent>::const_iterator const&, size_t, size_t
 , (anonymous namespace)::FindEditCellsHandler&) (rStore=..., it=..., 
nOffset=0, nDataSize=999, rFuncElem=...) at 
.../libreoffice/sc/inc/mtvfunctions.hxx:149\n"
        "#19 0x00007fffa0b2eb58 in 
sc::FindElement2<mdds::multi_type_vector<mdds::mtv::custom_block_func3<mdds::mtv::default_element_block<52,
 svl::SharedString>, mdds::mtv::noncopyable_managed_element_block<53, 
EditTextObject>, mdds::mtv::noncopyable_managed_element_block<54, 
ScFormulaCell> >, sc::CellStoreEvent>, 
mdds::mtv::noncopyable_managed_element_block<53, EditTextObject>, 
mdds::mtv::noncopyable_managed_element_block<54, ScFormulaCell>, (anonymous 
namespace)::FindEditCellsHandler, (anonymous 
namespace)::FindEditCellsHandler>(mdds::multi_type_vector<mdds::mtv::custom_block_func3<mdds::mtv::default_element_block<52,
 svl::SharedString>, mdds::mtv::noncopyable_managed_element_block<53, 
EditTextObject>, mdds::mtv::noncopyable_managed_element_block<54, 
ScFormulaCell> >, sc::CellStoreEvent> const&, 
mdds::multi_type_vector<mdds::mtv::custom_block_func3<mdds::mtv::default_element_block<52,
 svl::SharedString>, mdds::mtv::noncopyable_managed_element_block<53, 
EditTextObject>, mdds::mtv::
 noncopyable_managed_element_block<54, ScFormulaCell> >, 
sc::CellStoreEvent>::size_type, 
mdds::multi_type_vector<mdds::mtv::custom_block_func3<mdds::mtv::default_element_block<52,
 svl::SharedString>, mdds::mtv::noncopyable_managed_element_block<53, 
EditTextObject>, mdds::mtv::noncopyable_managed_element_block<54, 
ScFormulaCell> >, sc::CellStoreEvent>::size_type, (anonymous 
namespace)::FindEditCellsHandler&, (anonymous 
namespace)::FindEditCellsHandler&) (rStore=..., nStart=0, nEnd=1048575, 
rFuncElem=..., rFuncElse=...) at .../libreoffice/sc/inc/mtvfunctions.hxx:496\n"
        "#20 0x00007fffa0b2b487 in sc::FindFormulaEditText<(anonymous 
namespace)::FindEditCellsHandler>(sc::CellStoreType const&, SCROW, SCROW, 
(anonymous namespace)::FindEditCellsHandler&) (rStore=..., nRow1=0, 
nRow2=1048575, rFunc=...) at .../libreoffice/sc/inc/mtvcellfunc.hxx:141\n"
        "#21 0x00007fffa0b293e3 in ScColumn::HasEditCells(int, int, int&) 
(this=0x55555e793330, nStartRow=0, nEndRow=1048575, rFirst=@0x7fffffff92ec: 0) 
at .../libreoffice/sc/source/core/data/column.cxx:3434\n"
        "#22 0x00007fffa0b981b1 in 
ScColumn::GetOptimalHeight(sc::RowHeightContext&, int, int, unsigned short, 
int) (this=0x55555e793330, rCxt=..., nStartRow=0, nEndRow=1048575, 
nMinHeight=0, nMinStart=0) at 
.../libreoffice/sc/source/core/data/column2.cxx:863\n"
        "#23 0x00007fffa0fcaf7d in (anonymous 
namespace)::GetOptimalHeightsInColumn(sc::RowHeightContext&, ScColContainer&, 
SCROW, SCROW, ScProgress*, sal_uLong) (rCxt=..., rCol=..., nStartRow=0, 
nEndRow=1048575, pProgress=0x7fffffff9740, nProgressStart=406268) at 
.../libreoffice/sc/source/core/data/table1.cxx:93\n"
        "#24 0x00007fffa0fccdae in 
ScTable::SetOptimalHeight(sc::RowHeightContext&, int, int, ScProgress*, 
unsigned long) (this=0x55555a39e890, rCxt=..., nStartRow=0, nEndRow=1048575, 
pOuterProgress=0x7fffffff9740, nProgressStart=406268) at 
.../libreoffice/sc/source/core/data/table1.cxx:470\n"
        "#25 0x00007fffa0c7ced6 in ScDocRowHeightUpdater::update() 
(this=0x7fffffff9910) at .../libreoffice/sc/source/core/data/dociter.cxx:2732\n"
        "#26 0x00007fffa15aae65 in ScXMLImport::endDocument() 
(this=0x555558902ec0) at 
.../libreoffice/sc/source/filter/xml/xmlimprt.cxx:1443\n"
        "#27 0x00007fff99f9e04b in 
sax_fastparser::FastSaxParserImpl::parseStream(com::sun::star::xml::sax::InputSource
 const&) (this=0x555559b8e0f0, rStructSource=...) at 
.../libreoffice/sax/source/fastparser/fastparser.cxx:911\n"
        "#28 0x00007fff99fa2318 in 
sax_fastparser::FastSaxParser::parseStream(com::sun::star::xml::sax::InputSource
 const&) (this=0x55555a718940, aInputSource=...) at 
.../libreoffice/sax/source/fastparser/fastparser.cxx:1482\n"
        "#29 0x00007fffecc8fa95 in 
SvXMLImport::parseStream(com::sun::star::xml::sax::InputSource const&) 
(this=0x555558902ec0, aInputSource=...) at 
.../libreoffice/xmloff/source/core/xmlimp.cxx:504\n"
        "#30 0x00007fffa15e0863 in 
ScXMLImportWrapper::ImportFromComponent(com::sun::star::uno::Reference<com::sun::star::uno::XComponentContext>
 const&, com::sun::star::uno::Reference<com::sun::star::frame::XModel> const&, 
com::sun::star::xml::sax::InputSource&, rtl::OUString const&, rtl::OUString 
const&, com::sun::star::uno::Sequence<com::sun::star::uno::Any> const&, bool) 
(this=0x7fffffffa2b0, xContext=uno::Reference to (cppu::(anonymous 
namespace)::ComponentContext *) 0x55555591a590, xModel=uno::Reference to 
(ScModelObj *) 0x55555a39fe50, aParserInput=..., 
sComponentName=\"com.sun.star.comp.Calc.XMLOasisContentImporter\", 
sDocName=\"content.xml\", aArgs=uno::Sequence of length 4 = {...}, 
bMustBeSuccessfull=true) at 
.../libreoffice/sc/source/filter/xml/xmlwrap.cxx:182\n"
        "#31 0x00007fffa15e3c0b in ScXMLImportWrapper::Import(ImportFlags, 
ErrCode&) (this=0x7fffffffa2b0, nMode=ImportFlags::All, rError=...) at 
.../libreoffice/sc/source/filter/xml/xmlwrap.cxx:510\n"
        "#32 0x00007fffa182aa1c in ScDocShell::LoadXML(SfxMedium*, 
com::sun::star::uno::Reference<com::sun::star::embed::XStorage> const&) 
(this=0x55555a783820, pLoadMedium=0x55555aa07260, xStor=empty uno::Reference) 
at .../libreoffice/sc/source/ui/docshell/docsh.cxx:482\n"
        "#33 0x00007fffa182b423 in ScDocShell::Load(SfxMedium&) 
(this=0x55555a783820, rMedium=...) at 
.../libreoffice/sc/source/ui/docshell/docsh.cxx:629\n"
        "#34 0x00007ffff5182831 in SfxObjectShell::LoadOwnFormat(SfxMedium&) 
(this=0x55555a783820, rMedium=...) at 
.../libreoffice/sfx2/source/doc/objstor.cxx:3128\n"
        "#35 0x00007ffff5174ee3 in SfxObjectShell::DoLoad(SfxMedium*) 
(this=0x55555a783820, pMed=0x55555aa07260) at 
.../libreoffice/sfx2/source/doc/objstor.cxx:677\n"
        "#36 0x00007ffff51c5544 in 
SfxBaseModel::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue>
 const&) (this=0x55555a39fdc0, seqArguments=uno::Sequence of length 16 = {...}) 
at .../libreoffice/sfx2/source/doc/sfxbasemodel.cxx:1883\n"
        "#37 0x00007ffff52f307f in (anonymous 
namespace)::SfxFrameLoader_Impl::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue>
 const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) 
(this=0x5555587e4650, rArgs=uno::Sequence of length 13 = {...}, 
_rTargetFrame=uno::Reference to ((anonymous namespace)::XFrameImpl *) 
0x5555569f3330) at .../libreoffice/sfx2/source/view/frmload.cxx:681\n"
        "#38 0x00007ffff5fd8854 in framework::LoadEnv::impl_loadContent() 
(this=0x555557039788) at 
.../libreoffice/framework/source/loadenv/loadenv.cxx:1163\n"
        "#39 0x00007ffff5fd45c7 in framework::LoadEnv::start() 
(this=0x555557039788) at 
.../libreoffice/framework/source/loadenv/loadenv.cxx:394\n"
        [..]
    
    Change-Id: I2d61e4a29543b1d331ae63d7ec023e88395e0b68
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/109705
    Tested-by: Jenkins
    Reviewed-by: Noel Grandin <noel.gran...@collabora.co.uk>
    (cherry picked from commit fc3b904b671a71266db2e8b30cbeeef4f7981753)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/109814
    Tested-by: Michael Weghorn <m.wegh...@posteo.de>
    Reviewed-by: Michael Weghorn <m.wegh...@posteo.de>

diff --git a/sc/source/core/data/dociter.cxx b/sc/source/core/data/dociter.cxx
index 975d1ad5335f..ed55445d0558 100644
--- a/sc/source/core/data/dociter.cxx
+++ b/sc/source/core/data/dociter.cxx
@@ -1080,8 +1080,8 @@ void ScQueryCellIterator::InitPos()
     nRow = mpParam->nRow1;
     if (mpParam->bHasHeader && mpParam->bByRow)
         ++nRow;
-    ScColumn* pCol = &(pDoc->maTabs[nTab])->aCol[nCol];
-    maCurPos = pCol->maCells.position(nRow);
+    const ScColumn& rCol = pDoc->maTabs[nTab]->CreateColumnIfNotExists(nCol);
+    maCurPos = rCol.maCells.position(nRow);
 }
 
 void ScQueryCellIterator::IncPos()
commit be05cbdca5ec535593727c5676c51ac7ffee5402
Author:     Michael Weghorn <m.wegh...@posteo.de>
AuthorDate: Wed Jan 20 12:21:43 2021 +0100
Commit:     Samuel Mehrbrodt <samuel.mehrbr...@allotropia.de>
CommitDate: Mon May 23 10:39:47 2022 +0200

    tdf#139782 sc: Don't try to access unallocated column
    
    This fixes a regression from
    
        commit 7282014e362a1529a36c88eb308df8ed359c2cfa
        Date:   Fri Feb 1 15:15:16 2019 +0100
    
            tdf#50916 Makes numbers of columns dynamic.
    
    Change-Id: I12a780bf52024cef31188651813d3a93cc2b5ddd
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/109704
    Tested-by: Jenkins
    Reviewed-by: Noel Grandin <noel.gran...@collabora.co.uk>
    (cherry picked from commit 3032cf9df042f50511a15c6a627c50f708a34238)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/109813
    Tested-by: Michael Weghorn <m.wegh...@posteo.de>
    Reviewed-by: Michael Weghorn <m.wegh...@posteo.de>

diff --git a/sc/source/core/data/dociter.cxx b/sc/source/core/data/dociter.cxx
index 5331e8ac33ae..975d1ad5335f 100644
--- a/sc/source/core/data/dociter.cxx
+++ b/sc/source/core/data/dociter.cxx
@@ -1799,6 +1799,10 @@ bool ScQueryCellIterator::BinarySearch()
     if (nTab >= pDoc->GetTableCount())
         OSL_FAIL("try to access index out of bounds, FIX IT");
     nCol = mpParam->nCol1;
+
+    if (nCol >= pDoc->maTabs[nTab]->GetAllocatedColumnsCount())
+        return false;
+
     ScColumn* pCol = &(pDoc->maTabs[nTab])->aCol[nCol];
     if (pCol->IsEmptyData())
         return false;

Reply via email to