svx/source/accessibility/AccessibleTextHelper.cxx |    4 ++++
 1 file changed, 4 insertions(+)

New commits:
commit 04ea0000d124a7ee9a5ced435725966162133147
Author:     Michael Stahl <michael.st...@allotropia.de>
AuthorDate: Tue Sep 7 18:55:40 2021 +0200
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Thu Sep 9 10:56:54 2021 +0200

    svx: try to avoid crash in AccessibleEditableTextPara
    
    There is an out-of-bounds access to a non-existant editengine paragraph:
    
    warn:legacy.tools:40400:40400:editeng/source/editeng/editdoc.cxx:1136: 
Index out of range in Adjust(2)
    warn:legacy.tools:40400:40400:editeng/source/editeng/editeng.cxx:1984: 
Paragraph not found: GetWindowPosTopLeft
    /usr/include/c++/11/debug/vector:438:
    Error: attempt to subscript container with out-of-bounds index 1, but
    container only holds 1 elements.
    
    4  ParaPortionList::operator[](int) (this=0x6270d38, nPos=1) at 
editeng/source/editeng/editdoc.cxx:722
    5  ImpEditEngine::CalcParaWidth(int, bool) (this=0x6270ca0, nPara=1, 
bIgnoreExtraSpace=true) at editeng/source/editeng/impedit2.cxx:3307
    6  EditEngine::GetParaBounds(int) (this=0x6264a00, nPara=1) at 
editeng/source/editeng/editeng.cxx:646
    7  Outliner::GetParaBounds(int) const (this=0x30fb510, nParagraph=1) at 
editeng/source/outliner/outlin2.cxx:414
    8  SvxOutlinerForwarder::GetParaBounds(int) const (this=0x3424710, nPara=1) 
at editeng/source/uno/unoforou.cxx:326
    9  SvxAccessibleTextAdapter::GetParaBounds(int) const (this=0x73d7d30, 
nPara=1) at editeng/source/uno/unoedprx.cxx:757
    10 accessibility::AccessibleEditableTextPara::getBounds() (this=0x27c45c0) 
at editeng/source/accessibility/AccessibleEditableTextPara.cxx:1050
    11 accessibility::AccessibleTextHelper_Impl::UpdateBoundRect() 
(this=0x73d7c90) at svx/source/accessibility/AccessibleTextHelper.cxx:799
    12 accessibility::AccessibleTextHelper::UpdateChildren() (this=0x2ae5eb0) 
at svx/source/accessibility/AccessibleTextHelper.cxx:1658
    13 
accessibility::AccessibleShape::notifyShapeEvent(com::sun::star::document::EventObject
 const&) (this=0x73d7690, rEventObject=...) at 
svx/source/accessibility/AccessibleShape.cxx:926
    14 SfxBaseModel::notifyEvent(com::sun::star::document::EventObject const&) 
const (this=0x2eb1b80, aEvent=...) at sfx2/source/doc/sfxbasemodel.cxx:3341
    15 SdXImpressDocument::Notify(SfxBroadcaster&, SfxHint const&) 
(this=0x2eb1b80, rBC=..., rHint=...) at sd/source/ui/unoidl/unomodel.cxx:408
    16 SfxBroadcaster::Broadcast(SfxHint const&) (this=0x2e6f120, rHint=...) at 
svl/source/notify/SfxBroadcaster.cxx:39
    17 SdrObject::BroadcastObjectChange() const (this=0x30fb190) at 
svx/source/svdraw/svdobj.cxx:1028
    18 SdrUndoObjSetText::Undo() (this=0x732acb0) at 
svx/source/svdraw/svdundo.cxx:1050
    19 sd::UndoObjectSetText::Undo() (this=0x732acb0) at 
sd/source/core/undo/undoobjects.cxx:204
    
    This was replaced when GetTextForwarder() apparently replaced the
    editengine object or something along those lines:
    
    5  ParaPortionList::Insert(int, ParaPortion&&) (this=0x6270d38, nPos=0, 
p=...) at editeng/source/editeng/editdoc.cxx:740
    6  ImpEditEngine::InitDoc(bool) (this=0x6270ca0, bKeepParaAttribs=true) at 
editeng/source/editeng/impedit2.cxx:241
    7  ImpEditEngine::RemoveText() (this=0x6270ca0) at 
editeng/source/editeng/impedit2.cxx:678
    8  ImpEditEngine::SetText(rtl::OUString const&) (this=0x6270ca0, rText="") 
at editeng/source/editeng/impedit2.cxx:694
    9  ImpEditEngine::SetText(EditTextObject const&) (this=0x6270ca0, 
rTextObject=...) at editeng/source/editeng/impedit4.cxx:1139
    10 EditEngine::SetText(EditTextObject const&) (this=0x6264a00, 
rTextObject=...) at editeng/source/editeng/editeng.cxx:1535
    11 Outliner::SetText(OutlinerParaObject const&) (this=0x30fb510, rPObj=...) 
at editeng/source/outliner/outliner.cxx:568
    12 SvxTextEditSourceImpl::GetBackgroundTextForwarder() (this=0x73d7990) at 
svx/source/unodraw/unoshtxt.cxx:553
    13 SvxTextEditSourceImpl::GetTextForwarder() (this=0x73d7990) at 
svx/source/unodraw/unoshtxt.cxx:658
    14 SvxTextEditSource::GetTextForwarder() (this=0x73c9580) at 
svx/source/unodraw/unoshtxt.cxx:936
    15 SvxEditSourceAdapter::GetTextForwarderAdapter() (this=0x73d7d20) at 
editeng/source/uno/unoedprx.cxx:324
    16 SvxEditSourceAdapter::GetTextForwarder() (this=0x73d7d20) at 
editeng/source/uno/unoedprx.cxx:339
    17 accessibility::AccessibleTextHelper_Impl::GetTextForwarder() const 
(this=0x73d7c90) at svx/source/accessibility/AccessibleTextHelper.cxx:265
    18 accessibility::AccessibleTextHelper_Impl::UpdateVisibleChildren(bool) 
(this=0x73d7c90, bBroadcastEvents=true) at 
svx/source/accessibility/AccessibleTextHelper.cxx:750
    19 accessibility::AccessibleTextHelper::UpdateChildren() (this=0x2ae5eb0) 
at svx/source/accessibility/AccessibleTextHelper.cxx:1657
    20 
accessibility::AccessibleShape::notifyShapeEvent(com::sun::star::document::EventObject
 const&) (this=0x73d7690, rEventObject=...) at 
svx/source/accessibility/AccessibleShape.cxx:926
    21 SfxBaseModel::notifyEvent(com::sun::star::document::EventObject const&) 
const (this=0x2eb1b80, aEvent=...) at sfx2/source/doc/sfxbasemodel.cxx:3341
    22 SdXImpressDocument::Notify(SfxBroadcaster&, SfxHint const&) 
(this=0x2eb1b80, rBC=..., rHint=...) at sd/source/ui/unoidl/unomodel.cxx:408
    23 SfxBroadcaster::Broadcast(SfxHint const&) (this=0x2e6f120, rHint=...) at 
svl/source/notify/SfxBroadcaster.cxx:39
    24 SdrObject::BroadcastObjectChange() const (this=0x30fb190) at 
svx/source/svdraw/svdobj.cxx:1028
    25 SdrUndoObjSetText::Undo() (this=0x732acb0) at 
svx/source/svdraw/svdundo.cxx:1050
    
    So try to update the number of paragraphs when GetTextForwarder()
    was called.
    
    Change-Id: I5c0712cdf0c01d2aa0e8cd929ba51aaf1c710123
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/121789
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit 294a82dda5045ad71122f946b67ec3d1d2e278d8)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/121767
    Reviewed-by: Thorsten Behrens <thorsten.behr...@allotropia.de>

diff --git a/svx/source/accessibility/AccessibleTextHelper.cxx 
b/svx/source/accessibility/AccessibleTextHelper.cxx
index f8ff9013e929..5be7ae3b3ab7 100644
--- a/svx/source/accessibility/AccessibleTextHelper.cxx
+++ b/svx/source/accessibility/AccessibleTextHelper.cxx
@@ -750,6 +750,10 @@ namespace accessibility
             SvxTextForwarder& rCacheTF = GetTextForwarder();
             sal_Int32 nParas=rCacheTF.GetParagraphCount();
 
+            // GetTextForwarder might have replaced everything, update
+            // paragraph count in case it's outdated
+            maParaManager.SetNum( nParas );
+
             mnFirstVisibleChild = -1;
             mnLastVisibleChild = -2;
 

Reply via email to