chart2/source/tools/ReferenceSizeProvider.cxx |    2 ++
 cui/source/dialogs/widgettestdlg.cxx          |   20 ++++++++++++++++----
 cui/uiconfig/ui/widgettestdialog.ui           |   21 +++++++++++++++++++--
 desktop/source/app/app.cxx                    |    7 ++++++-
 desktop/source/app/cmdlineargs.hxx            |    7 +++++++
 desktop/source/app/dispatchwatcher.cxx        |   13 ++++++++++++-
 desktop/source/app/dispatchwatcher.hxx        |   20 +++++++++++++++++++-
 desktop/source/app/officeipcthread.cxx        |   12 +++++-------
 desktop/source/app/officeipcthread.hxx        |    6 ++++--
 desktop/source/lib/init.cxx                   |   15 ++++++++++++---
 sal/osl/unx/profile.cxx                       |    3 ++-
 sd/source/ui/unoidl/unomodel.cxx              |    2 +-
 sw/source/core/view/viewsh.cxx                |    6 +++---
 13 files changed, 108 insertions(+), 26 deletions(-)

New commits:
commit 8d9664e370092126bafade51be19262093adb7ce
Author:     Caolán McNamara <[email protected]>
AuthorDate: Sun Jul 13 16:14:29 2025 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Mon Jul 14 19:26:09 2025 +0200

    cid#1659049 Resource leak
    
    Change-Id: I60637a01ff7cbe50e4df264d3c401799772743f0
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/187808
    Reviewed-by: Stephan Bergmann <[email protected]>
    Tested-by: Jenkins CollaboraOffice <[email protected]>

diff --git a/sal/osl/unx/profile.cxx b/sal/osl/unx/profile.cxx
index b769b0ae90b3..05026da5e6fb 100644
--- a/sal/osl/unx/profile.cxx
+++ b/sal/osl/unx/profile.cxx
@@ -935,12 +935,13 @@ static bool OslProfile_lockFile(const osl_TFile* pFile, 
osl_TLockMode eMode)
 static osl_TFile* openFileImpl(const char* pszFilename, oslProfileOption 
ProfileFlags )
 {
     int        Flags;
-    osl_TFile* pFile = static_cast<osl_TFile*>(calloc(1, sizeof(osl_TFile)));
     bool       bWriteable = false;
 
     if ( isForbidden( pszFilename, osl_File_OpenFlag_Write ) )
         return nullptr;
 
+    osl_TFile* pFile = static_cast<osl_TFile*>(calloc(1, sizeof(osl_TFile)));
+
     if ( ProfileFlags & ( osl_Profile_WRITELOCK | osl_Profile_FLUSHWRITE ) )
     {
         bWriteable = true;
commit a2b80a6d40f37788c5b2b7e340469b273c5e9023
Author:     Caolán McNamara <[email protected]>
AuthorDate: Thu Jul 10 12:48:40 2025 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Mon Jul 14 19:26:09 2025 +0200

    null deref of SfxViewShell
    
     #0  desktop::CallbackFlushHandler::enqueueUpdatedType 
(this=this@entry=0x34f1a860, type=3, viewShell=viewShell@entry=0x0, viewId=9) 
at libreoffice/desktop/source/lib/init.cxx:2474
     #1  0x00007f1d866182a4 in 
desktop::CallbackFlushHandler::enqueueUpdatedTypes (this=0x34f1a860) at 
libreoffice/desktop/source/lib/init.cxx:2437
     #2  0x00007f1d866184a0 in desktop::CallbackFlushHandler::invoke 
(this=0x34f1a860) at libreoffice/desktop/source/lib/init.cxx:2503
     #3  0x00007f1d87648db0 in Link<void*, void>::Call (data=<optimized out>, 
this=0x30d537e8) at libreoffice/include/tools/link.hxx:111
     #4  ImplHandleUserEvent (pSVEvent=0x30d537e0) at 
libreoffice/vcl/source/window/winproc.cxx:2285
     #5  ImplWindowFrameProc (_pWindow=<optimized out>, 
nEvent=SalEvent::UserEvent, pEvent=0x30d537e0) at 
libreoffice/vcl/source/window/winproc.cxx:2849
     #6  0x00007f1d87b3accc in SalFrame::CallCallback (pEvent=0x30d537e0, 
nEvent=SalEvent::UserEvent, this=0x38abd50) at 
libreoffice/vcl/inc/salframe.hxx:311
     #7  SvpSalInstance::ProcessEvent (this=0xe87940, aEvent=...) at 
libreoffice/vcl/headless/svpinst.cxx:272
     #8  0x00007f1d87937029 in operator() (__closure=<synthetic pointer>) at 
libreoffice/vcl/source/app/salusereventlist.cxx:119
     #9  SalUserEventList::DispatchUserEvents (this=this@entry=0xe87968, 
bHandleAllCurrentEvents=bHandleAllCurrentEvents@entry=false) at 
libreoffice/vcl/source/app/salusereventlist.cxx:120
     #10 0x00007f1d87b3b4d9 in SvpSalInstance::ImplYield 
(this=this@entry=0xe87940, bWait=bWait@entry=true, 
bHandleAllCurrentEvents=bHandleAllCurrentEvents@entry=false)
         at libreoffice/vcl/headless/svpinst.cxx:425
    
    Change-Id: Id6961b300ce67f5cfcbb91284a84bf02edc6aec3
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/187632
    Tested-by: Jenkins CollaboraOffice <[email protected]>
    Reviewed-by: Miklos Vajna <[email protected]>

diff --git a/desktop/source/lib/init.cxx b/desktop/source/lib/init.cxx
index 0f567e014a2b..46763773d2f4 100644
--- a/desktop/source/lib/init.cxx
+++ b/desktop/source/lib/init.cxx
@@ -2430,13 +2430,22 @@ void CallbackFlushHandler::enqueueUpdatedTypes()
         LOK_CALLBACK_INVALIDATE_VIEW_CURSOR,
         LOK_CALLBACK_TEXT_VIEW_SELECTION };
 
-    for( int type : orderedUpdatedTypes )
+    if (viewShell)
     {
-        if(o3tl::make_unsigned( type ) < updatedTypes.size() && updatedTypes[ 
type ])
+        for( int type : orderedUpdatedTypes )
         {
-            enqueueUpdatedType( type, viewShell, m_viewId );
+            if(o3tl::make_unsigned( type ) < updatedTypes.size() && 
updatedTypes[ type ])
+            {
+                enqueueUpdatedType( type, viewShell, m_viewId );
+            }
         }
     }
+    else
+    {
+        // View removed, probably cleaning up.
+        SAL_INFO("lok", "View #" << m_viewId << " no longer found for updated 
events");
+    }
+
     for( const auto& it : updatedTypesPerViewId )
     {
         int viewId = it.first;
commit 68cb8c4e98fd737d375262e22f647c68bf40c616
Author:     Szymon Kłos <[email protected]>
AuthorDate: Fri Jul 4 08:11:19 2025 +0000
Commit:     Andras Timar <[email protected]>
CommitDate: Mon Jul 14 19:26:09 2025 +0200

    Fix out-of-bound crash in test dialog 2
    
    It is visible in LOK case (only some backends).
    TreeView requires width declaration for columns to not
    fail on "you have only 2 columns" in GetTabs() call
    we introduced recently.
    
    Change-Id: Iae07f0813e962e413054794afc0228933af00dec
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/187373
    Tested-by: Caolán McNamara <[email protected]>
    Reviewed-by: Caolán McNamara <[email protected]>
    Tested-by: Jenkins CollaboraOffice <[email protected]>

diff --git a/cui/source/dialogs/widgettestdlg.cxx 
b/cui/source/dialogs/widgettestdlg.cxx
index 0d9eca2bd73a..690e474ded09 100644
--- a/cui/source/dialogs/widgettestdlg.cxx
+++ b/cui/source/dialogs/widgettestdlg.cxx
@@ -38,6 +38,17 @@ void WidgetTestDialog::FillTreeView()
     OUString aImage1(RID_SVXBMP_CELL_LR);
     OUString aImage2(RID_SVXBMP_SHADOW_BOT_LEFT);
 
+    // some backends might crash without proper widths set
+    std::vector<int> aWidths;
+    aWidths.push_back(m_xTreeView2->get_checkbox_column_width());
+    for (int i = 0; i < 3 - 1; ++i)
+    {
+        int nWidth = m_xTreeView2->get_column_width(i);
+        assert(nWidth > 0 && "suspicious to get a value like this");
+        aWidths.push_back(nWidth);
+    }
+    m_xTreeView2->set_column_fixed_widths(aWidths);
+
     for (size_t nCount = 0; nCount < 4; nCount++)
     {
         OUString sText = OUString::Concat("Test ") + 
OUString::Concat(OUString::number(nCount));
@@ -45,13 +56,13 @@ void WidgetTestDialog::FillTreeView()
         m_xTreeView->insert(nullptr, -1, &sText, &sText, nullptr, nullptr, 
false, xEntry.get());
         m_xTreeView->set_image(*xEntry, (nCount % 2 == 0) ? aImage1 : aImage2);
 
+        int nRow = m_xTreeView2->n_children();
         m_xTreeView2->append();
-        m_xTreeView2->set_image(nCount, (nCount % 2 == 0) ? aImage1 : aImage2);
-        m_xTreeView2->set_text(nCount, u"First Column"_ustr, 0);
-        // FIXME: crash out-of-bound
-        //m_xTreeView2->set_text(
-        //    nCount, OUString::Concat("Row ") + 
OUString::Concat(OUString::number(nCount)), 1);
-        m_xTreeView2->set_id(nCount, OUString::number(nCount));
+        m_xTreeView2->set_image(nRow, (nCount % 2 == 0) ? aImage1 : aImage2);
+        m_xTreeView2->set_text(nRow, u"First Column"_ustr, 0);
+        m_xTreeView2->set_text(
+            nRow, OUString::Concat("Row ") + 
OUString::Concat(OUString::number(nCount)), 1);
+        m_xTreeView2->set_id(nRow, OUString::number(nCount));
     }
 }
 
diff --git a/cui/uiconfig/ui/widgettestdialog.ui 
b/cui/uiconfig/ui/widgettestdialog.ui
index 0441ae7c77b8..6308a83370b7 100644
--- a/cui/uiconfig/ui/widgettestdialog.ui
+++ b/cui/uiconfig/ui/widgettestdialog.ui
@@ -45,6 +45,8 @@
   </object>
   <object class="GtkTreeStore" id="liststore3">
     <columns>
+      <!-- column-name icon -->
+      <column type="GdkPixbuf"/>
       <!-- column-name text -->
       <column type="gchararray"/>
       <!-- column-name text1 -->
@@ -613,6 +615,21 @@
                         <property name="reorderable">True</property>
                         <property name="search-column">1</property>
                         <property name="enable-tree-lines">True</property>
+                        <child>
+                          <object class="GtkTreeViewColumn" 
id="treeviewcolumn0">
+                            <property name="resizable">True</property>
+                            <property name="spacing">6</property>
+                            <property name="sort-indicator">True</property>
+                            <property name="clickable">True</property>
+                            <property name="title" 
translatable="no">.</property>
+                            <child>
+                              <object class="GtkCellRendererPixbuf" 
id="cellrenderer0"/>
+                              <attributes>
+                                <attribute name="pixbuf">0</attribute>
+                              </attributes>
+                            </child>
+                          </object>
+                        </child>
                         <child>
                           <object class="GtkTreeViewColumn" 
id="treeviewcolumn1">
                             <property name="resizable">True</property>
@@ -623,7 +640,7 @@
                             <child>
                               <object class="GtkCellRendererText" 
id="cellrenderer1"/>
                               <attributes>
-                                <attribute name="text">0</attribute>
+                                <attribute name="text">1</attribute>
                               </attributes>
                             </child>
                           </object>
@@ -638,7 +655,7 @@
                             <child>
                               <object class="GtkCellRendererText" 
id="cellrenderer2"/>
                               <attributes>
-                                <attribute name="text">1</attribute>
+                                <attribute name="text">2</attribute>
                               </attributes>
                             </child>
                           </object>
commit 45dc1152f5c10cc6052e7db6a034b93d4bdc8a54
Author:     Szymon Kłos <[email protected]>
AuthorDate: Thu Jul 3 10:44:37 2025 +0000
Commit:     Andras Timar <[email protected]>
CommitDate: Mon Jul 14 19:26:09 2025 +0200

    Fix out-of-bound crash in test dialog
    
    It is visible in LOK case
    I think issue is with the model in widgettestdialog.ui
    but merge it to keep CI green first.
    
    Change-Id: Ife12e7b9e067aae65ca38b66f353aad49e869eec
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/187308
    Reviewed-by: Caolán McNamara <[email protected]>
    Tested-by: Caolán McNamara <[email protected]>
    Tested-by: Jenkins CollaboraOffice <[email protected]>

diff --git a/cui/source/dialogs/widgettestdlg.cxx 
b/cui/source/dialogs/widgettestdlg.cxx
index 0de81751d35d..0d9eca2bd73a 100644
--- a/cui/source/dialogs/widgettestdlg.cxx
+++ b/cui/source/dialogs/widgettestdlg.cxx
@@ -48,8 +48,9 @@ void WidgetTestDialog::FillTreeView()
         m_xTreeView2->append();
         m_xTreeView2->set_image(nCount, (nCount % 2 == 0) ? aImage1 : aImage2);
         m_xTreeView2->set_text(nCount, u"First Column"_ustr, 0);
-        m_xTreeView2->set_text(
-            nCount, OUString::Concat("Row ") + 
OUString::Concat(OUString::number(nCount)), 1);
+        // FIXME: crash out-of-bound
+        //m_xTreeView2->set_text(
+        //    nCount, OUString::Concat("Row ") + 
OUString::Concat(OUString::number(nCount)), 1);
         m_xTreeView2->set_id(nCount, OUString::number(nCount));
     }
 }
commit f1e08c4d184af646f02c4c77be4d3df8cd0ba1d7
Author:     Caolán McNamara <[email protected]>
AuthorDate: Wed Jul 2 12:06:00 2025 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Mon Jul 14 19:26:09 2025 +0200

    null-deref of m_xChartDoc seen
    
     #0  0x00007d2c10f56497 in rtl::Reference<chart::Diagram>::Reference 
(handle=..., this=<optimized out>)
         at include/rtl/ref.hxx:79
     #1  chart::ReferenceSizeProvider::setValuesAtAllDataSeries 
(this=0x7ffce60d8d70)
         at chart2/source/tools/ReferenceSizeProvider.cxx:95
     #2  0x00007d2c10cd6a1f in 
chart::ChartController::impl_adaptDataSeriesAutoResize (this=<optimized out>)
         at chart2/source/controller/main/ChartController_Tools.cxx:192
     #3  0x00007d2c10cb3cec in operator() (nResult=<optimized out>, 
__closure=<optimized out>)
         at chart2/source/controller/main/ChartController.cxx:1672
     #4  std::__invoke_impl<void, 
chart::ChartController::executeDispatch_SourceData()::<lambda(int)>&, int> 
(__f=...)
         at /opt/rh/devtoolset-12/root/usr/include/c++/12/bits/invoke.h:61
     #5  std::__invoke_r<void, 
chart::ChartController::executeDispatch_SourceData()::<lambda(int)>&, int> 
(__fn=...)
         at /opt/rh/devtoolset-12/root/usr/include/c++/12/bits/invoke.h:111
     #6  std::_Function_handler<void(int), 
chart::ChartController::executeDispatch_SourceData()::<lambda(int)> 
>::_M_invoke(const std::_Any_data &, int &&) (__functor=..., 
__args#0=<optimized out>) at 
/opt/rh/devtoolset-12/root/usr/include/c++/12/bits/std_function.h:290
     #7  0x00007d2c134e2268 in std::function<void (int)>::operator()(int) const 
(__args#0=<optimized out>, this=0x7ffce60d8de0)
         at 
/opt/rh/devtoolset-12/root/usr/include/c++/12/bits/std_function.h:591
     #8  Dialog::EndDialog (this=0x4abc7140, nResult=<optimized out>)
         at vcl/source/window/dialog.cxx:1213
    
    (gdb) print m_xChartDoc
    $3 = {m_pBody = 0x0}
    
    Change-Id: I6f2cdb176cf1acc7b000e24fa314a6cbe344a525
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/187276
    Reviewed-by: Michael Stahl <[email protected]>
    Tested-by: Jenkins CollaboraOffice <[email protected]>

diff --git a/chart2/source/tools/ReferenceSizeProvider.cxx 
b/chart2/source/tools/ReferenceSizeProvider.cxx
index 6135724dca5d..d7ae7f76a2fd 100644
--- a/chart2/source/tools/ReferenceSizeProvider.cxx
+++ b/chart2/source/tools/ReferenceSizeProvider.cxx
@@ -92,6 +92,8 @@ void ReferenceSizeProvider::setValuesAtTitle(
 
 void ReferenceSizeProvider::setValuesAtAllDataSeries()
 {
+    if (!m_xChartDoc)
+        return;
     rtl::Reference< Diagram > xDiagram( m_xChartDoc->getFirstChartDiagram());
     if (!xDiagram)
         return;
commit f34887f4547246a3809e44633b29d9240c315eee
Author:     Caolán McNamara <[email protected]>
AuthorDate: Tue Jul 1 20:36:18 2025 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Mon Jul 14 19:26:09 2025 +0200

    use-after-free on deleted ViewShell
    
     #0  0x00007eef974b992d in __dynamic_cast () from 
/lib/x86_64-linux-gnu/libstdc++.so.6
     #1  0x00007eef83ffb326 in SdXImpressDocument::GetViewShell 
(this=this@entry=0x5511adc0)
         at sd/source/ui/unoidl/unomodel.cxx:3848
     #2  0x00007eef83ffb6dc in SdXImpressDocument::setClipboard 
(this=0x5511adc0, xClipboard=...)
         at sd/source/ui/unoidl/unomodel.cxx:4457
     #3  0x00007eef9336a4f8 in (anonymous 
namespace)::forceSetClipboardForCurrentView (pThis=<optimized out>)
         at desktop/source/lib/init.cxx:1379
    
    3848        DrawViewShell* pViewSh = 
dynamic_cast<DrawViewShell*>(mpDocShell->GetViewShell());
    (gdb) print mbDisposed
    $1 = true
    
    an earlier sanitizer trace is:
    
    program/../program/libsdlo.so
        sd::DrawDocShell::GetViewShell()
            libreoffice/sd/source/ui/inc/DrawDocShell.hxx:109
    program/../program/libsdlo.so
        SdXImpressDocument::GetViewShell()
            libreoffice/sd/source/ui/unoidl/unomodel.cxx:3105
    program/../program/libsdlo.so
        
SdXImpressDocument::setClipboard(com::sun::star::uno::Reference<com::sun::star::datatransfer::clipboard::XClipboard>
 const&)
            libreoffice/sd/source/ui/unoidl/unomodel.cxx:3676
    program/libmergedlo.so
        (anonymous 
namespace)::forceSetClipboardForCurrentView(_LibreOfficeKitDocument*)
            libreoffice/desktop/source/lib/init.cxx:1324
    program/libmergedlo.so
        doc_createViewWithOptions(_LibreOfficeKitDocument*, char const*)
            libreoffice/desktop/source/lib/init.cxx:6895
    /usr/bin/coolforkit
        lok::Document::createView(char const*)
            libreoffice/include/LibreOfficeKit/LibreOfficeKit.hxx:549
    /usr/bin/coolforkit
        Document::load(std::shared_ptr<ChildSession> const&, 
std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > 
const&)
            kit/Kit.cpp:1912
    /usr/bin/coolforkit
        Document::onLoad(std::__cxx11::basic_string<char, 
std::char_traits<char>, std::allocator<char> > const&, 
std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > 
const&, std::__cxx11::basic_string<char, std::char_traits<char>, 
std::allocator<char> > const&)
            kit/Kit.cpp:1230
    /usr/bin/coolforkit
        ChildSession::loadDocument(StringVector const&)
            kit/ChildSession.cpp:905
    /usr/bin/coolforkit
        ChildSession::_handleInput(char const*, int)
            kit/ChildSession.cpp:297
    /usr/bin/coolforkit
        Session::handleMessage(std::vector<char, std::allocator<char> > const&)
            common/Session.cpp:288
    /usr/bin/coolforkit
        Document::forwardToChild(std::__cxx11::basic_string<char, 
std::char_traits<char>, std::allocator<char> > const&, std::vector<char, 
std::allocator<char> > const&)
            kit/Kit.cpp:2048
    /usr/bin/coolforkit
        Document::drainQueue()
            kit/Kit.cpp:2271
    /usr/bin/coolforkit
        KitSocketPoll::drainQueue()
            kit/Kit.cpp:2668
    /usr/bin/coolforkit
        KitSocketPoll::kitPoll(int)
            kit/Kit.cpp:2747
    /usr/bin/coolforkit
        pollCallback(void*, int)
            kit/Kit.cpp:2838
    program/libmergedlo.so
        SvpSalInstance::ImplYield(bool, bool)
            libreoffice/vcl/headless/svpinst.cxx:430
    program/libmergedlo.so
        SvpSalInstance::DoYield(bool, bool)
            libreoffice/vcl/headless/svpinst.cxx:471
    program/libmergedlo.so
        ImplYield(bool, bool)
            libreoffice/vcl/source/app/svapp.cxx:396
    program/libmergedlo.so
        Application::Yield()
            libreoffice/vcl/source/app/svapp.cxx:480
    program/libmergedlo.so
        Application::Execute()
            libreoffice/vcl/source/app/svapp.cxx:374
    program/libmergedlo.so
        desktop::Desktop::Main()
            libreoffice/desktop/source/app/app.cxx:1605
    program/libmergedlo.so
        ImplSVMain()
            libreoffice/vcl/source/app/svmain.cxx:229
    program/libmergedlo.so
        soffice_main
            libreoffice/desktop/source/app/sofficemain.cxx:94
    program/libmergedlo.so
        lo_runLoop(_LibreOfficeKit*, int (*)(void*, int), void (*)(void*), 
void*)
            libreoffice/desktop/source/lib/init.cxx:7735
    /usr/bin/coolforkit
        lok::Office::runLoop(int (*)(void*, int), void (*)(void*), void*)
            libreoffice/include/LibreOfficeKit/LibreOfficeKit.hxx:1128
    /usr/bin/coolforkit
        lokit_main(std::__cxx11::basic_string<char, std::char_traits<char>, 
std::allocator<char> > const&, std::__cxx11::basic_string<char, 
std::char_traits<char>, std::allocator<char> > const&, 
std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > 
const&, std::__cxx11::basic_string<char, std::char_traits<char>, 
std::allocator<char> > const&, bool, bool, bool, bool, bool, bool, unsigned 
long)
            kit/Kit.cpp:3495
    /usr/bin/coolforkit
        createLibreOfficeKit(std::__cxx11::basic_string<char, 
std::char_traits<char>, std::allocator<char> > const&, 
std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > 
const&, std::__cxx11::basic_string<char, std::char_traits<char>, 
std::allocator<char> > const&, bool, bool)
            kit/ForKit.cpp:450
    /usr/bin/coolforkit
        forkLibreOfficeKit(std::__cxx11::basic_string<char, 
std::char_traits<char>, std::allocator<char> > const&, 
std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > 
const&, std::__cxx11::basic_string<char, std::char_traits<char>, 
std::allocator<char> > const&, bool)
            kit/ForKit.cpp:500
    /usr/bin/coolforkit
        forkit_main(int, char**)
            kit/ForKit.cpp:876
    /usr/bin/coolforkit
        main
            kit/forkit-main.cpp:19
    /lib64/libc.so.6
        __libc_start_main
            ??:?
    /usr/bin/coolforkit
        _start
            ??:?
    
    freed by thread T0 (kitbroker_011) here:
    /usr/bin/coolforkit
        operator delete(void*, unsigned long)
            
/home/collabora/lode/packages/llvm-llvmorg-12.0.1.src/compiler-rt/lib/asan/asan_new_delete.cpp:172
 (discriminator 5)
    program/libmergedlo.so
        SfxViewFrame::ReleaseObjectShell_Impl()
            libreoffice/sfx2/source/view/viewfrm.cxx:1167
    program/libmergedlo.so
        ~SfxViewFrame
            libreoffice/sfx2/source/view/viewfrm.cxx:1977
    program/libmergedlo.so
        SfxViewFrame::Close()
            libreoffice/sfx2/source/view/viewfrm.cxx:1189
    program/libmergedlo.so
        SfxFrame::DoClose_Impl()
            libreoffice/sfx2/source/view/frame.cxx:138
    
    Change-Id: Iec746b4473a20ba9c6b5e338f64f9f2380e2db13
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/187257
    Tested-by: Jenkins CollaboraOffice <[email protected]>
    Reviewed-by: Michael Stahl <[email protected]>

diff --git a/sd/source/ui/unoidl/unomodel.cxx b/sd/source/ui/unoidl/unomodel.cxx
index f4cba7ea57be..0cbcf36b74ff 100644
--- a/sd/source/ui/unoidl/unomodel.cxx
+++ b/sd/source/ui/unoidl/unomodel.cxx
@@ -4986,9 +4986,9 @@ void SAL_CALL SdXImpressDocument::dispose()
     mxTransGradientTable = nullptr;
     mxMarkerTable = nullptr;
     mxDrawingPool = nullptr;
+    mpDocShell = nullptr;
 }
 
-
 SdDrawPagesAccess::SdDrawPagesAccess( SdXImpressDocument& rMyModel )  noexcept
 :   mpModel( &rMyModel)
 {
commit 4fa92507162c36f696ac955dd4ea321229ddbe06
Author:     Caolán McNamara <[email protected]>
AuthorDate: Tue Jul 1 09:24:54 2025 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Mon Jul 14 19:26:09 2025 +0200

    null GetSfxViewShell() deref
    
     #0  0x00007d2c05299b40 in SwViewShell::SizeChgNotify 
(this=this@entry=0x3cd9f220) at sw/source/core/view/viewsh.cxx:1264
     #1  0x00007d2c04e7bfb8 in AdjustSizeChgNotify 
(pRoot=pRoot@entry=0x3c9a1af0) at sw/source/core/layout/pagechg.cxx:894
     #2  0x00007d2c04e7fa5d in SwRootFrame::CheckViewLayout (this=0x3c9a1af0, 
pViewOpt=pViewOpt@entry=0x0, pVisArea=pVisArea@entry=0x0)
         at sw/source/core/layout/pagechg.cxx:2490
     #3  0x00007d2c04e81819 in SwPageFrame::Paste (this=this@entry=0x3cf5c9b0, 
pParent=pParent@entry=0x3c9a1af0, pSibling=pSibling@entry=0x3cebf0d0)
         at sw/source/core/layout/pagechg.cxx:1010
     #4  0x00007d2c04e8498b in (anonymous namespace)::doInsertPage 
(pRoot=0x3c9a1af0, pRefSibling=0x7ffce60d5450, pFormat=<optimized out>, 
pDesc=<optimized out>, bFootnote=<optimized out>, pRefPage=0x7ffce60d5458)
         at sw/source/core/layout/pagechg.cxx:1396
     #5  0x00007d2c04e852a4 in SwFrame::InsertPage (this=this@entry=0x3cebe640, 
pPrevPage=0x3cebb780, bFootnote=bFootnote@entry=false)
         at sw/source/core/layout/pagechg.cxx:1475
     #6  0x00007d2c04eb3787 in SwFrame::GetNextSctLeaf (this=0x3cebe640, 
eMakePage=MAKEPAGE_INSERT) at sw/source/core/layout/sectfrm.cxx:1853
     #7  0x00007d2c04e35530 in SwFlowFrame::MoveFwd 
(this=this@entry=0x3cebe720, bMakePage=<optimized out>, 
bPageBreak=bPageBreak@entry=false, bMoveAlways=bMoveAlways@entry=false)
         at sw/source/core/layout/flowfrm.cxx:2148
     #8  0x00007d2c04e24732 in SwContentFrame::MakeAll (this=0x3cebe640) at 
sw/source/core/layout/calcmove.cxx:1930
     #9  0x00007d2c04e2184c in SwFrame::PrepareMake (this=0x3cebe640, 
pRenderContext=0x3c95db30) at sw/source/core/layout/calcmove.cxx:396
     #10 0x00007d2c04e3abe4 in CalcContent (pLay=pLay@entry=0x3ce01530, 
bNoColl=bNoColl@entry=false) at sw/source/core/layout/fly.cxx:1764
     #11 0x00007d2c04ee2079 in SwLayoutFrame::FormatWidthCols 
(this=this@entry=0x3ce01530, rAttrs=..., nBorder=nBorder@entry=0, 
nMinHeight=nMinHeight@entry=23)
         at sw/source/core/layout/wsfrm.cxx:4013
    
    (gdb) print mpSfxViewShell
    $3 = (SfxViewShell *) 0x0
    
    Change-Id: I2e0f21a442791260e8b79e38965c8da7e41656cc
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/187225
    Reviewed-by: Michael Stahl <[email protected]>
    Tested-by: Jenkins CollaboraOffice <[email protected]>

diff --git a/sw/source/core/view/viewsh.cxx b/sw/source/core/view/viewsh.cxx
index 656a957a8ea3..bf543ddf89d3 100644
--- a/sw/source/core/view/viewsh.cxx
+++ b/sw/source/core/view/viewsh.cxx
@@ -1255,14 +1255,14 @@ void SwViewShell::SizeChgNotify()
         {
             PageNumNotify(this);
 
-            if (comphelper::LibreOfficeKit::isActive())
+            if (SfxViewShell* pNotifySh = 
comphelper::LibreOfficeKit::isActive() ? GetSfxViewShell() : nullptr)
             {
                 Size aDocSize = GetDocSize();
                 OString sPayload = OString::number(aDocSize.Width() + 2 * 
DOCUMENTBORDER) +
                     ", " + OString::number(aDocSize.Height() + 2 * 
DOCUMENTBORDER);
 
-                SwXTextDocument* pModel = 
comphelper::getFromUnoTunnel<SwXTextDocument>(GetSfxViewShell()->GetCurrentDocument());
-                SfxLokHelper::notifyDocumentSizeChanged(GetSfxViewShell(), 
sPayload, pModel);
+                SwXTextDocument* pModel = 
comphelper::getFromUnoTunnel<SwXTextDocument>(pNotifySh->GetCurrentDocument());
+                SfxLokHelper::notifyDocumentSizeChanged(pNotifySh, sPayload, 
pModel);
             }
         }
     }
commit 4f84a0beb58a0a010d153a0aeb0a115192f8b051
Author:     Justin Luth <[email protected]>
AuthorDate: Thu Jun 26 10:12:20 2025 -0400
Commit:     Andras Timar <[email protected]>
CommitDate: Mon Jul 14 19:23:48 2025 +0200

    tdf#148275: EXIT_FAILURE if any cmdline operation fails
    
    While by no means comprehensive,
    this patch fulfills the bug request
    by returning error status 1 (instead of 0)
    if REQUEST_CONVERSION (and some others) fail for various reasons.
    
    instdir/program/soffice  --convert-to junk  non-existant-file.ods
    echo "status is $?"
    
    -EXIT_FAILURE b/c non-existant-file.ods not found
    -EXIT_FAILURE b/c junk is not a valid filter
    -EXIT_FAILURE if xStorable->storeToURL raises an exception
    
    Change-Id: Ic1d25034fa152cdc4933ce3cca06def204f764a6
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/187075
    Reviewed-by: Mike Kaganski <[email protected]>
    Reviewed-by: Justin Luth <[email protected]>
    Tested-by: Jenkins
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/187278
    Tested-by: Jenkins CollaboraOffice <[email protected]>

diff --git a/desktop/source/app/app.cxx b/desktop/source/app/app.cxx
index 2461a05fa145..adc254da541e 100644
--- a/desktop/source/app/app.cxx
+++ b/desktop/source/app/app.cxx
@@ -1788,7 +1788,7 @@ int Desktop::doShutdown()
 
         return EXITHELPER_NORMAL_RESTART;
     }
-    return EXIT_SUCCESS;
+    return rCmdLineArgs.GetAllSucceeded() ? EXIT_SUCCESS : EXIT_FAILURE;
 }
 
 IMPL_STATIC_LINK( Desktop, ImplInitFilterHdl, ::ConvertData&, rData, bool )
@@ -2215,8 +2215,13 @@ void Desktop::OpenClients()
         }
 #endif
         // Process request
+        DispatchRequestFlags eFlags = DispatchRequestFlags::NONE;
+        aRequest.mpFlags = &eFlags;
         if ( RequestHandler::ExecuteCmdLineRequests(aRequest, false) )
         {
+            if (eFlags & DispatchRequestFlags::WithError)
+                Desktop::GetCommandLineArgs().SetAllSucceeded(false);
+
             // Don't do anything if we have successfully called terminate at 
desktop:
             return;
         }
diff --git a/desktop/source/app/cmdlineargs.hxx 
b/desktop/source/app/cmdlineargs.hxx
index d5d94abd67f2..2f533e728dd0 100644
--- a/desktop/source/app/cmdlineargs.hxx
+++ b/desktop/source/app/cmdlineargs.hxx
@@ -122,6 +122,9 @@ class CommandLineArgs
 
         void setHeadless() { m_headless = true; }
 
+        bool GetAllSucceeded() const { return m_bAllSucceeded; }
+        void SetAllSucceeded(bool bSet) { m_bAllSucceeded = bSet; }
+
     private:
         void                    ParseCommandLine_Impl( Supplier& supplier );
         void                    InitParamValues();
@@ -182,6 +185,10 @@ class CommandLineArgs
         std::vector< OUString > m_infilter;
         OUString m_language;
         OUString m_pidfile;
+
+        // If any argument fails, this may be set to false so that the app 
exits with EXIT_FAILURE.
+        // NOTE: only items of interest are setting this to false - can be 
extended to more cases...
+        bool m_bAllSucceeded = true;
 };
 
 }
diff --git a/desktop/source/app/dispatchwatcher.cxx 
b/desktop/source/app/dispatchwatcher.cxx
index faf830ffae3c..39bd64db53f7 100644
--- a/desktop/source/app/dispatchwatcher.cxx
+++ b/desktop/source/app/dispatchwatcher.cxx
@@ -334,7 +334,9 @@ DispatchWatcher::~DispatchWatcher()
 }
 
 
-bool DispatchWatcher::executeDispatchRequests( const 
std::vector<DispatchRequest>& aDispatchRequestsList, bool bNoTerminate )
+bool DispatchWatcher::executeDispatchRequests(
+    const std::vector<DispatchRequest>& aDispatchRequestsList, bool 
bNoTerminate,
+    DispatchRequestFlags* pFlags)
 {
     Reference< XDesktop2 > xDesktop = css::frame::Desktop::create( 
::comphelper::getProcessComponentContext() );
 
@@ -636,6 +638,8 @@ bool DispatchWatcher::executeDispatchRequests( const 
std::vector<DispatchRequest
                             if (aFilter.isEmpty())
                             {
                                 std::cerr << "Error: no export filter" << 
std::endl;
+                                if (pFlags)
+                                    *pFlags |= DispatchRequestFlags::WithError;
                             }
                             else
                             {
@@ -720,6 +724,8 @@ bool DispatchWatcher::executeDispatchRequests( const 
std::vector<DispatchRequest
                                     if (!rException.Message.isEmpty())
                                         std::cerr << " (" << 
rException.Message << ")";
                                     std::cerr << std::endl;
+                                    if (pFlags)
+                                        *pFlags |= 
DispatchRequestFlags::WithError;
                                 }
 
                                 if (fileForCat && fileForCat->IsValid())
@@ -768,6 +774,8 @@ bool DispatchWatcher::executeDispatchRequests( const 
std::vector<DispatchRequest
                 else
                 {
                     std::cerr << "Error: source file could not be loaded" << 
std::endl;
+                    if (pFlags)
+                        *pFlags |= DispatchRequestFlags::WithError;
                 }
 
                 // remove the document
@@ -815,6 +823,9 @@ bool DispatchWatcher::executeDispatchRequests( const 
std::vector<DispatchRequest
         }
     }
 
+    if (pFlags)
+        *pFlags |= DispatchRequestFlags::Finished;
+
     bool bEmpty = (m_nRequestCount == 0);
 
     // No more asynchronous requests?
diff --git a/desktop/source/app/dispatchwatcher.hxx 
b/desktop/source/app/dispatchwatcher.hxx
index 9a970cf82dce..a6b53a74d2a1 100644
--- a/desktop/source/app/dispatchwatcher.hxx
+++ b/desktop/source/app/dispatchwatcher.hxx
@@ -28,6 +28,23 @@
 namespace desktop
 {
 
+enum class DispatchRequestFlags
+{
+    NONE = 0x0000,
+    Finished = 0x0001,
+    WithError = 0x0002, // one or more requests reported an error condition
+};
+
+}
+
+namespace o3tl
+{
+    template<> struct typed_flags<desktop::DispatchRequestFlags> : 
is_typed_flags<desktop::DispatchRequestFlags, 0x3> {};
+}
+
+namespace desktop
+{
+
 /*
     Class for controls dispatching of command URL through office command line. 
There
     are "dangerous" command URLs, that can result in a running office without 
UI. To prevent
@@ -74,7 +91,8 @@ class DispatchWatcher : public ::cppu::WeakImplHelper< 
css::frame::XDispatchResu
         virtual void SAL_CALL dispatchFinished( const 
css::frame::DispatchResultEvent& aEvent ) override;
 
         // execute new dispatch request
-        bool executeDispatchRequests( const std::vector<DispatchRequest>& 
aDispatches, bool bNoTerminate );
+        bool executeDispatchRequests(const std::vector<DispatchRequest>& 
aDispatches,
+                                     bool bNoTerminate, DispatchRequestFlags* 
pFlags);
 
     private:
 
diff --git a/desktop/source/app/officeipcthread.cxx 
b/desktop/source/app/officeipcthread.cxx
index 4029546fd666..6a18a6e6fb48 100644
--- a/desktop/source/app/officeipcthread.cxx
+++ b/desktop/source/app/officeipcthread.cxx
@@ -26,7 +26,6 @@
 #include <app.hxx>
 #include "officeipcthread.hxx"
 #include "cmdlineargs.hxx"
-#include "dispatchwatcher.hxx"
 #include <com/sun/star/frame/TerminationVetoException.hpp>
 #include <salhelper/thread.hxx>
 #include <sal/log.hxx>
@@ -970,8 +969,8 @@ bool IpcThread::process(OString const & arguments, bool * 
waitProcessed) {
             aCmdLineArgs->getCwdUrl()));
         m_handler->cProcessed.reset();
         pRequest->pcProcessed = &m_handler->cProcessed;
-        m_handler->mbSuccess = false;
-        pRequest->mpbSuccess = &m_handler->mbSuccess;
+        m_handler->mFlags = DispatchRequestFlags::NONE;
+        pRequest->mpFlags = &m_handler->mFlags;
 
         // Print requests are not dependent on the --invisible cmdline 
argument as they are
         // loaded with the "hidden" flag! So they are always checked.
@@ -1175,7 +1174,7 @@ void PipeIpcThread::execute()
             if (waitProcessed)
             {
                 m_handler->cProcessed.wait();
-                bSuccess = m_handler->mbSuccess;
+                bSuccess = static_cast<bool>(m_handler->mFlags & 
DispatchRequestFlags::Finished);
             }
             if (bSuccess)
             {
@@ -1344,9 +1343,8 @@ bool RequestHandler::ExecuteCmdLineRequests(
         aGuard.clear();
 
         // Execute dispatch requests
-        bShutdown = dispatchWatcher->executeDispatchRequests( aTempList, 
noTerminate);
-        if (aRequest.mpbSuccess)
-            *aRequest.mpbSuccess = true; // signal that we have actually 
succeeded
+        bShutdown
+            = dispatchWatcher->executeDispatchRequests(aTempList, noTerminate, 
aRequest.mpFlags);
     }
 
     return bShutdown;
diff --git a/desktop/source/app/officeipcthread.hxx 
b/desktop/source/app/officeipcthread.hxx
index fc95b42668bc..3f7f4c00d602 100644
--- a/desktop/source/app/officeipcthread.hxx
+++ b/desktop/source/app/officeipcthread.hxx
@@ -34,6 +34,8 @@
 #include <osl/conditn.hxx>
 #include <optional>
 
+#include "dispatchwatcher.hxx"
+
 namespace desktop
 {
 
@@ -63,7 +65,7 @@ struct ProcessDocumentsRequest
     OUString aStartListParams;
     std::vector< OUString > aInFilter;
     ::osl::Condition *pcProcessed;  // pointer condition to be set when the 
request has been processed
-    bool* mpbSuccess = nullptr; // pointer to boolean receiving if the 
processing was successful
+    DispatchRequestFlags* mpFlags = nullptr; // pointer to 
DispatchRequestFlags receiving if the processing was successful
     bool bTextCat; // boolean flag indicating whether to dump text content to 
console
     bool bScriptCat; // boolean flag indicating whether to dump script content 
to console
 };
@@ -92,7 +94,7 @@ class RequestHandler: public salhelper::SimpleReferenceObject
     /* condition to be set when the request has been processed */
     ::osl::Condition cProcessed;
     /* receives if the processing was successful (may be false e.g. when 
shutting down) */
-    bool mbSuccess = false;
+    DispatchRequestFlags mFlags = DispatchRequestFlags::NONE;
 
     /* condition to be set when the main event loop is ready
        otherwise an error dialogs event loop could eat away

Reply via email to