sw/source/core/unocore/unodraw.cxx |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

New commits:
commit dc323680b9c82527eeef3bc69ac4ebf978cac69f
Author:     Michael Stahl <michael.st...@allotropia.de>
AuthorDate: Thu Dec 21 19:59:48 2023 +0100
Commit:     Michael Stahl <michael.st...@allotropia.de>
CommitDate: Fri Dec 22 16:23:34 2023 +0100

    tdf#158451 sw: fix crash in text formatting of as-char group shape
    
    The problem is that during formatting of a SwTextFrame, SwTextFly
    contains a list of all anchored objects that could overlap, and then
    creating a portion for the as-char anchored group shape sets the anchor
    property and thereby unexpectedly deletes the child anchored object,
    while SwTextFly stores a pointer to it:
    
    4  SwFlyLayFrame::~SwFlyLayFrame()
    5  SwFrame::DestroyFrame()
    6  SwFrameFormat::DelFrames()
    7  SwDoc::SetFlyFrameAnchor()
    8  lcl_SetFlyFrameAttr()
    10 SwXFrame::setPropertyValue()
       (this=0x4042de0, rPropertyName="AnchorType", 
_rValue=uno::Any("com.sun.star.text.TextContentAnchorType": 
com::sun::star::text::TextContentAnchorType::TextContentAnchorType_AT_CHARACTER))
 at sw/source/core/unocore/unoframe.cxx:1941
    11 SwTextBoxHelper::changeAnchor()
    12 SwTextBoxHelper::synchronizeGroupTextBoxProperty()
    13 SwTextBoxHelper::synchronizeGroupTextBoxProperty()
    14 SwFlyCntPortion::SetBase()
    15 sw::DrawFlyCntPortion::Create()
    16 SwTextFormatter::NewFlyCntPortion()
    
    This is because after the import is complete, only the group shape has
    its anchor set, while the child shapes all have a default FLY_AT_PAGE
    anchor.
    
    There is already code in SwXShape::setPropertyValue() to propagate the
    new anchor to children, but it's limited to group shape with more than 1
    text frame; very unclear why this limit exists so just remove it.
    
    Change-Id: Ide0f9def36e3b4eff6140206e3dfa4ee2c65e3eb
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/161137
    Tested-by: Jenkins
    Reviewed-by: Regina Henschel <rb.hensc...@t-online.de>
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>

diff --git a/sw/source/core/unocore/unodraw.cxx 
b/sw/source/core/unocore/unodraw.cxx
index 41faa061fdfc..9104b5b2f62c 100644
--- a/sw/source/core/unocore/unodraw.cxx
+++ b/sw/source/core/unocore/unodraw.cxx
@@ -1364,12 +1364,12 @@ void SwXShape::setPropertyValue(const OUString& 
rPropertyName, const uno::Any& a
                     // If this property is an anchor change, and there is a 
group shape with textboxes
                     // do anchor sync in time unless the anchor sync in the 
porfly will cause crash during
                     // layout calculation (When importing an inline shape in 
docx via dmapper).
-                    if (pFormat->Which() == RES_DRAWFRMFMT && 
pFormat->GetOtherTextBoxFormats()
-                        && pFormat->GetOtherTextBoxFormats()->GetTextBoxCount()
-                               > o3tl::make_unsigned(1))
+                    if (pFormat->Which() == RES_DRAWFRMFMT && 
pFormat->GetOtherTextBoxFormats())
+                    {
                         SwTextBoxHelper::synchronizeGroupTextBoxProperty(
                             SwTextBoxHelper::changeAnchor, pFormat,
                             SdrObject::getSdrObjectFromXShape(mxShape));
+                    }
                 }
                 else
                     pFormat->SetFormatAttr(aSet);

Reply via email to