basegfx/source/polygon/b2dpolygontools.cxx                 |   51 
 chart2/source/controller/chartapiwrapper/TitleWrapper.cxx  |    7 
 configmgr/source/xcsparser.cxx                             |    4 
 configure.ac                                               |    2 
 download.lst                                               |   20 
 drawinglayer/source/processor2d/vclmetafileprocessor2d.cxx |    1 
 external/expat/0001-Fix-compiler-warnings.patch            |   47 
 external/expat/UnpackedTarball_expat.mk                    |    3 
 external/gpgmepp/UnpackedTarball_gpgmepp.mk                |    1 
 external/gpgmepp/macos-tdf152524.patch                     |  102 
 include/basegfx/polygon/b2dpolygontools.hxx                |    2 
 include/svtools/scrolladaptor.hxx                          |    2 
 include/vcl/toolkit/scrbar.hxx                             |    3 
 include/vcl/weld.hxx                                       |    1 
 readlicense_oo/license/CREDITS.fodt                        | 3754 ++++++-------
 sc/qa/extras/scpdfexport.cxx                               |   14 
 sc/qa/extras/testdocuments/tdf159094.ods                   |binary
 sc/source/filter/html/htmlpars.cxx                         |   75 
 sc/source/filter/inc/htmlpars.hxx                          |    8 
 sc/source/ui/docshell/docfunc.cxx                          |   25 
 sc/source/ui/inc/tabview.hxx                               |    2 
 sc/source/ui/inc/undoblk.hxx                               |    6 
 sc/source/ui/undo/undoblk.cxx                              |   26 
 sc/source/ui/unoobj/docuno.cxx                             |  192 
 sc/source/ui/view/tabview.cxx                              |   22 
 sc/source/ui/view/tabview4.cxx                             |   45 
 svgio/inc/svgstyleattributes.hxx                           |    9 
 svgio/qa/cppunit/SvgImportTest.cxx                         |   14 
 svgio/qa/cppunit/data/tdf160373.svg                        |   14 
 svgio/source/svgreader/svgstyleattributes.cxx              |   36 
 svl/qa/unit/svl.cxx                                        |   20 
 svl/source/numbers/zformat.cxx                             |    2 
 svtools/source/control/scrolladaptor.cxx                   |    2 
 svx/source/sdr/properties/textproperties.cxx               |   60 
 sw/inc/doc.hxx                                             |    1 
 sw/qa/core/unocore/unocore.cxx                             |   27 
 sw/qa/extras/uiwriter/uiwriter5.cxx                        |    2 
 sw/qa/extras/unowriter/unowriter.cxx                       |   21 
 sw/source/core/doc/docfly.cxx                              |   19 
 sw/source/core/docnode/ndtbl.cxx                           |   43 
 sw/source/core/layout/paintfrm.cxx                         |    3 
 sw/source/core/tox/tox.cxx                                 |    8 
 sw/source/core/undo/untbl.cxx                              |   15 
 sw/source/core/unocore/unocrsrhelper.cxx                   |    2 
 sw/source/core/unocore/unoframe.cxx                        |   13 
 sw/source/core/unocore/unoobj.cxx                          |   12 
 sw/source/ui/index/cnttab.cxx                              |    4 
 sw/source/ui/index/swuiidxmrk.cxx                          |   37 
 sw/source/uibase/index/toxmgr.cxx                          |    3 
 ucb/source/ucp/webdav-curl/CurlSession.cxx                 |   37 
 vcl/source/app/salvtables.cxx                              |    2 
 vcl/source/control/scrbar.cxx                              |    6 
 vcl/unx/gtk3/gtkinst.cxx                                   |    5 
 wizards/source/scriptforge/SF_Session.xba                  |    2 
 writerfilter/source/dmapper/DomainMapper.cxx               |    3 
 writerfilter/source/dmapper/PropertyIds.cxx                |    1 
 writerfilter/source/dmapper/PropertyIds.hxx                |    1 
 57 files changed, 2678 insertions(+), 2161 deletions(-)

New commits:
commit f70b5d7f217dd84c6afdedde1bc5f981e2f58026
Author:     Noel Grandin <noel.gran...@collabora.co.uk>
AuthorDate: Tue Mar 26 13:35:53 2024 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:04 2024 +0100

    tdf#159805 Printing line style dotted lines (horizontal) turns into dashes.
    
    I could not find a good place to distinguish between the dragging
    visualisation (where we could safely use approximation), and the
    non-dragging case, so just revert.
    
    Revert
        commit 9f4ccc63346b26d8d774b22124da0842ef18e0bc
        Author: Noel Grandin <noel.gran...@collabora.co.uk>
        Date:   Wed Sep 13 14:27:02 2023 +0200
        tdf#156995 speed up dragging complex group objects
    
    Change-Id: I2ba52f07ea7299643c0f145459038e368a17dea8
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165332
    Tested-by: Jenkins
    Reviewed-by: Noel Grandin <noel.gran...@collabora.co.uk>
    (cherry picked from commit fc5d84681d5d898b56171a9622294ecb23623bfd)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165320
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/basegfx/source/polygon/b2dpolygontools.cxx 
b/basegfx/source/polygon/b2dpolygontools.cxx
index b3f43669ddf4..d33c752008b4 100644
--- a/basegfx/source/polygon/b2dpolygontools.cxx
+++ b/basegfx/source/polygon/b2dpolygontools.cxx
@@ -475,7 +475,7 @@ namespace basegfx::utils
             return fRetval;
         }
 
-        double getLength(const B2DPolygon& rCandidate, bool 
bApproximateBezierLength)
+        double getLength(const B2DPolygon& rCandidate)
         {
             double fRetval(0.0);
             const sal_uInt32 nPointCount(rCandidate.count());
@@ -486,45 +486,18 @@ namespace basegfx::utils
 
                 if(rCandidate.areControlPointsUsed())
                 {
-                    if (bApproximateBezierLength)
-                    {
-                        B2DPoint aStartPoint = rCandidate.getB2DPoint(0);
-
-                        for(sal_uInt32 a(0); a < nEdgeCount; a++)
-                        {
-                            // An approximate length of a cubic Bezier curve 
is the average
-                            // of its chord length and the sum of the lengths 
of its control net sides.
-                            const sal_uInt32 nNextIndex((a + 1) % nPointCount);
-                            const B2DPoint& aControlPoint1 = 
rCandidate.getNextControlPoint(a);
-                            const B2DPoint& aControlPoint2 = 
rCandidate.getPrevControlPoint(nNextIndex);
-                            const B2DPoint& aEndPoint = 
rCandidate.getB2DPoint(nNextIndex);
-
-                            double chord_length = B2DVector(aEndPoint - 
aStartPoint).getLength();
-                            double control_net_length = B2DVector(aStartPoint 
- aControlPoint1).getLength()
-                                + B2DVector(aControlPoint2 - 
aControlPoint1).getLength()
-                                + B2DVector(aEndPoint - 
aControlPoint2).getLength();
-                            double approximate_arc_length = 
(control_net_length + chord_length) / 2;
-
-                            fRetval += approximate_arc_length;
-                            aStartPoint = aEndPoint;
-                        }
+                    B2DCubicBezier aEdge;
+                    aEdge.setStartPoint(rCandidate.getB2DPoint(0));
 
-                    }
-                    else
+                    for(sal_uInt32 a(0); a < nEdgeCount; a++)
                     {
-                        B2DCubicBezier aEdge;
-                        aEdge.setStartPoint(rCandidate.getB2DPoint(0));
-
-                        for(sal_uInt32 a(0); a < nEdgeCount; a++)
-                        {
-                            const sal_uInt32 nNextIndex((a + 1) % nPointCount);
-                            
aEdge.setControlPointA(rCandidate.getNextControlPoint(a));
-                            
aEdge.setControlPointB(rCandidate.getPrevControlPoint(nNextIndex));
-                            
aEdge.setEndPoint(rCandidate.getB2DPoint(nNextIndex));
+                        const sal_uInt32 nNextIndex((a + 1) % nPointCount);
+                        
aEdge.setControlPointA(rCandidate.getNextControlPoint(a));
+                        
aEdge.setControlPointB(rCandidate.getPrevControlPoint(nNextIndex));
+                        aEdge.setEndPoint(rCandidate.getB2DPoint(nNextIndex));
 
-                            fRetval += aEdge.getLength();
-                            aEdge.setStartPoint(aEdge.getEndPoint());
-                        }
+                        fRetval += aEdge.getLength();
+                        aEdge.setStartPoint(aEdge.getEndPoint());
                     }
                 }
                 else
@@ -1259,9 +1232,9 @@ namespace basegfx::utils
             // precalculate maximal acceptable length of candidate polygon 
assuming
             // we want to create a maximum of fNumberOfAllowedSnippets. For
             // fNumberOfAllowedSnippets use ca. 65536, double due to line & 
gap.
-            static const double fNumberOfAllowedSnippets(100.0 * 2.0);
+            static const double fNumberOfAllowedSnippets(65535.0 * 2.0);
             const double fAllowedLength((fNumberOfAllowedSnippets * 
fDotDashLength) / double(rDotDashArray.size()));
-            const double 
fCandidateLength(basegfx::utils::getLength(rCandidate, 
/*bApproximateBezierLength*/true));
+            const double 
fCandidateLength(basegfx::utils::getLength(rCandidate));
             std::vector<double> aDotDashArray(rDotDashArray);
 
             if(fCandidateLength > fAllowedLength)
diff --git a/include/basegfx/polygon/b2dpolygontools.hxx 
b/include/basegfx/polygon/b2dpolygontools.hxx
index d21d0bb63bfe..a29d1fd06a52 100644
--- a/include/basegfx/polygon/b2dpolygontools.hxx
+++ b/include/basegfx/polygon/b2dpolygontools.hxx
@@ -113,7 +113,7 @@ namespace basegfx::utils
         BASEGFX_DLLPUBLIC double getEdgeLength(const B2DPolygon& rCandidate, 
sal_uInt32 nIndex);
 
         /** get length of polygon */
-        BASEGFX_DLLPUBLIC double getLength(const B2DPolygon& rCandidate, bool 
bApproximateBezierLength = false);
+        BASEGFX_DLLPUBLIC double getLength(const B2DPolygon& rCandidate);
 
         // get position on polygon for absolute given distance. If
         // length is given, it is assumed the correct polygon length, if 0.0 
it is calculated
commit 7efeb1559d3a04dd810b60f12271f7302baaa692
Author:     Xisco Fauli <xiscofa...@libreoffice.org>
AuthorDate: Tue Mar 26 14:13:21 2024 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:04 2024 +0100

    tdf#160373: Iterate over all parents to check whether it's a clipPath 
content
    
    Change-Id: I383ec264e4c88ebcee2ae6a839b762bba8abfc12
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165347
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>
    (cherry picked from commit 261985b6936ede212852e806c4b140ea634a5af3)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165317
    Reviewed-by: Stéphane Guillou <stephane.guil...@libreoffice.org>

diff --git a/svgio/inc/svgstyleattributes.hxx b/svgio/inc/svgstyleattributes.hxx
index bf921f8b1bb0..c5c095462f3d 100644
--- a/svgio/inc/svgstyleattributes.hxx
+++ b/svgio/inc/svgstyleattributes.hxx
@@ -243,10 +243,6 @@ namespace svgio::svgreader
 
             mutable std::vector<sal_uInt16> maResolvingParent;
 
-            // defines if this attributes are part of a ClipPath. If yes,
-            // rough geometry will be created on decomposition by patching
-            // values for fill, stroke, strokeWidth and others
-            bool                        mbIsClipPathContent : 1;
 
             // #121221# Defines if evtl. an empty array *is* set
             bool                        mbStrokeDasharraySet : 1;
@@ -318,6 +314,11 @@ namespace svgio::svgreader
             SvgStyleAttributes(SvgNode& rOwner);
             ~SvgStyleAttributes();
 
+            // Check if this attribute is part of a ClipPath.
+            // If so, rough geometry will be created on decomposition by 
patching
+            // values for fill, stroke, strokeWidth and others
+            bool isClipPathContent() const;
+
             /// fill content
             bool isFillSet() const; // #i125258# ask if fill is a direct hard 
attribute (no hierarchy)
             const basegfx::BColor* getFill() const;
diff --git a/svgio/qa/cppunit/SvgImportTest.cxx 
b/svgio/qa/cppunit/SvgImportTest.cxx
index 0c088baf2ab3..75d42adf4397 100644
--- a/svgio/qa/cppunit/SvgImportTest.cxx
+++ b/svgio/qa/cppunit/SvgImportTest.cxx
@@ -457,6 +457,20 @@ CPPUNIT_TEST_FIXTURE(Test, testTdf156168)
     assertXPath(pDocument, 
"/primitive2D/transform/polypolygonstroke[4]/line"_ostr, "color"_ostr, 
"#00ff00");
 }
 
+CPPUNIT_TEST_FIXTURE(Test, testTdf160373)
+{
+    Primitive2DSequence aSequence = 
parseSvg(u"/svgio/qa/cppunit/data/tdf160373.svg");
+    CPPUNIT_ASSERT_EQUAL(1, static_cast<int>(aSequence.getLength()));
+
+    drawinglayer::Primitive2dXmlDump dumper;
+    xmlDocUniquePtr pDocument = dumper.dumpAndParse(aSequence);
+
+    CPPUNIT_ASSERT (pDocument);
+
+    // Without the fix in place, nothing would be displayed
+    assertXPath(pDocument, 
"/primitive2D/transform/transform/polypolygoncolor"_ostr, "color"_ostr, 
"#0000ff");
+}
+
 CPPUNIT_TEST_FIXTURE(Test, testTdf129356)
 {
     Primitive2DSequence aSequence = 
parseSvg(u"/svgio/qa/cppunit/data/tdf129356.svg");
diff --git a/svgio/qa/cppunit/data/tdf160373.svg 
b/svgio/qa/cppunit/data/tdf160373.svg
new file mode 100644
index 000000000000..73b18bb2ea61
--- /dev/null
+++ b/svgio/qa/cppunit/data/tdf160373.svg
@@ -0,0 +1,14 @@
+<?xml version='1.0' encoding='UTF-8' ?>
+<svg xmlns='http://www.w3.org/2000/svg' 
xmlns:xlink='http://www.w3.org/1999/xlink' width='503.75pt' height='503.25pt' 
viewBox='0 0 503.75 503.25'>
+<defs>
+  <style type='text/css'><![CDATA[
+     rect { fill: none; }
+  ]]></style>
+</defs>
+  <clipPath id='cpMC4wMHw1MDMuNzV8MC4wMHw1MDMuMjU='>
+    <rect x='0.00' y='0.00' width='503.75' height='503.25' />
+  </clipPath>
+<g clip-path='url(#cpMC4wMHw1MDMuNzV8MC4wMHw1MDMuMjU=)'>
+<rect class="r5" x="10" y="0" height="50" width="50" style="fill:blue"></rect>
+</g>
+</svg>
diff --git a/svgio/source/svgreader/svgstyleattributes.cxx 
b/svgio/source/svgreader/svgstyleattributes.cxx
index 19070989bb55..58bdb9add84b 100644
--- a/svgio/source/svgreader/svgstyleattributes.cxx
+++ b/svgio/source/svgreader/svgstyleattributes.cxx
@@ -1287,18 +1287,9 @@ namespace svgio::svgreader
             maBaselineShift(BaselineShift::Baseline),
             maBaselineShiftNumber(0),
             maDominantBaseline(DominantBaseline::Auto),
-            maResolvingParent(31, 0),
-            mbIsClipPathContent(SVGToken::ClipPathNode == mrOwner.getType()),
+            maResolvingParent(32, 0),
             mbStrokeDasharraySet(false)
         {
-            const SvgStyleAttributes* pParentStyle = getParentStyle();
-            if(!mbIsClipPathContent)
-            {
-                if(pParentStyle)
-                {
-                    mbIsClipPathContent = pParentStyle->mbIsClipPathContent;
-                }
-            }
         }
 
         SvgStyleAttributes::~SvgStyleAttributes()
@@ -2005,10 +1996,27 @@ namespace svgio::svgreader
             }
         }
 
+        bool SvgStyleAttributes::isClipPathContent() const
+        {
+            if (SVGToken::ClipPathNode == mrOwner.getType())
+                return true;
+
+            const SvgStyleAttributes* pSvgStyleAttributes = getParentStyle();
+            if (pSvgStyleAttributes && maResolvingParent[31] < 
nStyleDepthLimit)
+            {
+                ++maResolvingParent[31];
+                bool ret = pSvgStyleAttributes->isClipPathContent();
+                --maResolvingParent[31];
+                return ret;
+            }
+
+            return false;
+        }
+
         // #i125258# ask if fill is a direct hard attribute (no hierarchy)
         bool SvgStyleAttributes::isFillSet() const
         {
-            if(mbIsClipPathContent)
+            if(isClipPathContent())
             {
                 return false;
             }
@@ -2042,7 +2050,7 @@ namespace svgio::svgreader
                 {
                     return &maFill.getBColor();
                 }
-                else if(mbIsClipPathContent)
+                else if(isClipPathContent())
                 {
                     const SvgStyleAttributes* pSvgStyleAttributes = 
getParentStyle();
 
@@ -2066,7 +2074,7 @@ namespace svgio::svgreader
                     const basegfx::BColor* pFill = 
pSvgStyleAttributes->getFill();
                     --maResolvingParent[0];
 
-                    if(mbIsClipPathContent)
+                    if(isClipPathContent())
                     {
                         if (pFill)
                         {
@@ -2269,7 +2277,7 @@ namespace svgio::svgreader
                 return ret;
             }
 
-            if(mbIsClipPathContent)
+            if(isClipPathContent())
             {
                 return SvgNumber(0.0);
             }
commit 9b002955a5b99e4e5693223edbab9b19c2a24ad0
Author:     Justin Luth <justin.l...@collabora.com>
AuthorDate: Mon Mar 25 19:20:32 2024 -0400
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:04 2024 +0100

    tdf#129905 tdf#160365 sw: don't always draw text boundary on frames
    
    This fixes a 7.6 regression caused by
    commit 79811c27f34d3e752de1bc3959605c5d58ac2365
        tdf#129905 Create toggle for Section boundaries
    
    This fixes the toggle for View - Text boundaries,
    so now images can have their thin gray border removed.
    
    This also fixes the toggle for View - Table boundaries.
    
    Change-Id: Idb75debf173d64b14a6864c61b4524e46898975f
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165297
    Reviewed-by: Justin Luth <jl...@mail.com>
    Tested-by: Jenkins
    Reviewed-by: Rafael Lima <rafael.palma.l...@gmail.com>
    Reviewed-by: Miklos Vajna <vmik...@collabora.com>
    (cherry picked from commit 47af9e64a573684eb42faa097e327e31777a2b58)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165311

diff --git a/sw/source/core/layout/paintfrm.cxx 
b/sw/source/core/layout/paintfrm.cxx
index e0e1f41f54ad..46c9189f0dfd 100644
--- a/sw/source/core/layout/paintfrm.cxx
+++ b/sw/source/core/layout/paintfrm.cxx
@@ -7012,7 +7012,8 @@ void SwPageFrame::RefreshSubsidiary( const SwRect &rRect 
) const
 void SwLayoutFrame::RefreshLaySubsidiary( const SwPageFrame *pPage,
                                         const SwRect &rRect ) const
 {
-    const bool bSubsOpt = isSubsidiaryLinesEnabled() || 
isSubsidiaryLinesForSectionsEnabled();
+    const bool bSubsOpt
+        = isSubsidiaryLinesEnabled() || (IsSctFrame() && 
isSubsidiaryLinesForSectionsEnabled());
     if ( bSubsOpt )
         PaintSubsidiaryLines( pPage, rRect );
 
commit 8d520c8040f434152c3b22ca6987391c22e51bd0
Author:     Julien Nabet <serval2...@yahoo.fr>
AuthorDate: Mon Mar 25 13:59:06 2024 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:04 2024 +0100

    Related tdf#160351: the field name can be shorter than two symbols
    
    Change-Id: Ieb6b78b3f9802e66de642a9e708b11c55c0d9a11
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165285
    Tested-by: Jenkins
    Reviewed-by: Julien Nabet <serval2...@yahoo.fr>
    (cherry picked from commit 02609da5ee8188cb00fc0b97052d2cc8d2576900)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165249
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/sw/source/ui/index/cnttab.cxx b/sw/source/ui/index/cnttab.cxx
index f07cf8ab2883..535dc298dd5a 100644
--- a/sw/source/ui/index/cnttab.cxx
+++ b/sw/source/ui/index/cnttab.cxx
@@ -3140,7 +3140,7 @@ void SwTokenWindow::InsertAtSelection(const SwFormToken& 
rToken)
         //use the first two chars as symbol
         OUString sTmp(SwAuthorityFieldType::GetAuthFieldName(
                     
static_cast<ToxAuthorityField>(aToInsertToken.nAuthorityField)));
-        pButton->SetText(sTmp.copy(0, 2));
+        pButton->SetText(sTmp.copy(0, std::min(sTmp.getLength(), 
sal_Int32(2))));
     }
 
     pButton->Check();
commit 9090b7f8f7e9c43db11f3b46b0ce097de2f9d416
Author:     Mike Kaganski <mike.kagan...@collabora.com>
AuthorDate: Mon Mar 25 17:41:24 2024 +0500
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:04 2024 +0100

    tdf#160351: the field name can be shorter than two symbols
    
    Change-Id: Id834ae2919661752b921510f766c9e9ff7fc16fd
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165282
    Reviewed-by: Julien Nabet <serval2...@yahoo.fr>
    Tested-by: Jenkins
    Reviewed-by: Mike Kaganski <mike.kagan...@collabora.com>
    (cherry picked from commit 4a14bad7232ecf23d23c1997dc20922d0b4892cb)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165246
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/sw/source/ui/index/cnttab.cxx b/sw/source/ui/index/cnttab.cxx
index a5d3bf92ddef..f07cf8ab2883 100644
--- a/sw/source/ui/index/cnttab.cxx
+++ b/sw/source/ui/index/cnttab.cxx
@@ -2933,7 +2933,7 @@ SwTOXWidget* SwTokenWindow::InsertItem(const OUString& 
rText, const SwFormToken&
             //use the first two chars as symbol
             OUString sTmp(SwAuthorityFieldType::GetAuthFieldName(
                         
static_cast<ToxAuthorityField>(rToken.nAuthorityField)));
-            pButton->SetText(sTmp.copy(0, 2));
+            pButton->SetText(sTmp.copy(0, std::min(sTmp.getLength(), 
sal_Int32(2))));
         }
 
         sal_uInt32 nIndex = GetControlIndex( rToken.eTokenType );
commit 95ba1309b6d8215be89304ecaedecd6abcb1caa2
Author:     Xisco Fauli <xiscofa...@libreoffice.org>
AuthorDate: Mon Mar 25 12:14:07 2024 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:04 2024 +0100

    openldap: upgrade to release 2.6.7
    
    Change-Id: I7716a41114442ba7a57d81192b01cbeaaeca08b6
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165280
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>
    (cherry picked from commit 9a0b37a5337faee5634cc9fce4955da204b95bf4)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165247
    Reviewed-by: Taichi Haradaguchi <20001...@ymail.ne.jp>

diff --git a/download.lst b/download.lst
index 0dd07605294e..d5654272cd2d 100644
--- a/download.lst
+++ b/download.lst
@@ -566,8 +566,8 @@ ONLINEUPDATE_TARBALL := 
onlineupdate-c003be8b9727672e7d30972983b375f4c200233f-2.
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-OPENLDAP_SHA256SUM := 
082e998cf542984d43634442dbe11da860759e510907152ea579bdc42fe39ea0
-OPENLDAP_TARBALL := openldap-2.6.6.tgz
+OPENLDAP_SHA256SUM := 
cd775f625c944ed78a3da18a03b03b08eea73c8aabc97b41bb336e9a10954930
+OPENLDAP_TARBALL := openldap-2.6.7.tgz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
commit 8a09463d2c5408b6f5a7a7b4aece6aa1ecc1462b
Author:     Xisco Fauli <xiscofa...@libreoffice.org>
AuthorDate: Wed Mar 20 10:26:11 2024 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:04 2024 +0100

    libxml2: upgrade to release 2.12.6
    
    Change-Id: I7372b276f74bc760c99580ffc509fde1031cb3a6
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165049
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>
    (cherry picked from commit 832b98cedda2cd1631651f9397a871fb50d9cb1f)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165183
    Reviewed-by: Taichi Haradaguchi <20001...@ymail.ne.jp>

diff --git a/download.lst b/download.lst
index 659bdb33d52f..0dd07605294e 100644
--- a/download.lst
+++ b/download.lst
@@ -487,8 +487,8 @@ XMLSEC_TARBALL := xmlsec1-1.3.2.tar.gz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBXML_SHA256SUM := 
a972796696afd38073e0f59c283c3a2f5a560b5268b4babc391b286166526b21
-LIBXML_VERSION_MICRO := 5
+LIBXML_SHA256SUM := 
889c593a881a3db5fdd96cc9318c87df34eb648edfc458272ad46fd607353fbb
+LIBXML_VERSION_MICRO := 6
 LIBXML_TARBALL := libxml2-2.12.$(LIBXML_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
commit b803d49298528005c2ff895e1474c122cab0f762
Author:     Xisco Fauli <xiscofa...@libreoffice.org>
AuthorDate: Wed Mar 20 10:49:53 2024 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:04 2024 +0100

    libpng: upgrade to 1.6.43
    
    Change-Id: Ia1ddc21dc521cf97b75a64d806417cbfe5dec623
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165050
    Tested-by: Xisco Fauli <xiscofa...@libreoffice.org>
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>
    (cherry picked from commit f29222eaf385891620d4868827b27e734752018e)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165182
    Tested-by: Jenkins
    Reviewed-by: Taichi Haradaguchi <20001...@ymail.ne.jp>

diff --git a/download.lst b/download.lst
index ac5450d33473..659bdb33d52f 100644
--- a/download.lst
+++ b/download.lst
@@ -596,8 +596,8 @@ PIXMAN_TARBALL := pixman-0.42.2.tar.gz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBPNG_SHA256SUM := 
c919dbc11f4c03b05aba3f8884d8eb7adfe3572ad228af972bb60057bdb48450
-LIBPNG_TARBALL := libpng-1.6.42.tar.xz
+LIBPNG_SHA256SUM := 
6a5ca0652392a2d7c9db2ae5b40210843c0bbc081cbd410825ab00cc59f14a6c
+LIBPNG_TARBALL := libpng-1.6.43.tar.xz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
commit 1e922aa97d6b04c105310ddb0c167c14388ece01
Author:     Michael Stahl <michael.st...@allotropia.de>
AuthorDate: Thu Mar 14 12:14:28 2024 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:04 2024 +0100

    sw: fix ~SwIndexReg assert in testTdf149498
    
    The problem is that a SwNavigationMgr thingy has a cursor in one of the
    table cells, and the text node is moved to the undo nodes array in
    SwUndoTableCpyTable::AddBoxBefore() and deleted in
    SwUndoTableCpyTable::UndoImpl().
    
    SwUndoTableCpyTable needs to move the cursors out of the way because
    SwUndoDelete doesn't do it.
    
    Change-Id: I75e271c84a6624ffb0df151b171acb1e1f743928
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/164807
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit 873af30a36504751c6923d4235abd4de040e0001)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/164820
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/sw/qa/extras/uiwriter/uiwriter5.cxx 
b/sw/qa/extras/uiwriter/uiwriter5.cxx
index c6353f980d29..702f6d7dd30e 100644
--- a/sw/qa/extras/uiwriter/uiwriter5.cxx
+++ b/sw/qa/extras/uiwriter/uiwriter5.cxx
@@ -3007,7 +3007,6 @@ CPPUNIT_TEST_FIXTURE(SwUiWriterTest5, testTdf156487)
     assertXPath(pXmlDoc, "/metafile/push/push/push/textarray/text"_ostr, 1);
 }
 
-#ifndef DBG_UTIL
 CPPUNIT_TEST_FIXTURE(SwUiWriterTest5, testTdf149498)
 {
     // load a table, and delete the first column with enabled change tracking:
@@ -3023,7 +3022,6 @@ CPPUNIT_TEST_FIXTURE(SwUiWriterTest5, testTdf149498)
     // this would crash due to bookmark over cell boundary
     dispatchCommand(mxComponent, ".uno:Undo", {});
 }
-#endif
 
 CPPUNIT_TEST_FIXTURE(SwUiWriterTest5, 
testTdf150673_RedlineTableColumnDeletionWithExport)
 {
diff --git a/sw/source/core/undo/untbl.cxx b/sw/source/core/undo/untbl.cxx
index 72f1c809e227..52157df0cae1 100644
--- a/sw/source/core/undo/untbl.cxx
+++ b/sw/source/core/undo/untbl.cxx
@@ -2599,11 +2599,17 @@ void SwUndoTableCpyTable::AddBoxBefore( const 
SwTableBox& rBox, bool bDelContent
     if( bDelContent )
     {
         SwNodeIndex aInsIdx( *rBox.GetSttNd(), 1 );
-        pDoc->GetNodes().MakeTextNode( aInsIdx.GetNode(), 
pDoc->GetDfltTextFormatColl() );
+        SwTextNode *const 
pNewNode(pDoc->GetNodes().MakeTextNode(aInsIdx.GetNode(), 
pDoc->GetDfltTextFormatColl()));
         SwPaM aPam( aInsIdx.GetNode(), *rBox.GetSttNd()->EndOfSectionNode() );
 
         if( !pDoc->getIDocumentRedlineAccess().IsRedlineOn() )
+        {
+            {   // move cursors to new node which precedes aPam
+                SwPosition const pos(*pNewNode, 0);
+                ::PaMCorrAbs(aPam, pos);
+            }
             pEntry->pUndo = std::make_unique<SwUndoDelete>(aPam, 
SwDeleteFlags::Default, true);
+        }
     }
 
     pEntry->pBoxNumAttr = std::make_unique<SfxItemSetFixed<
@@ -2627,6 +2633,13 @@ void SwUndoTableCpyTable::AddBoxAfter( const SwTableBox& 
rBox, const SwNodeIndex
         SwDoc* pDoc = rBox.GetFrameFormat()->GetDoc();
         DEBUG_REDLINE( pDoc )
 
+        {   // move cursors to first node which was inserted
+            SwPaM pam(SwNodeIndex(*rBox.GetSttNd(), 1));
+            assert(pam.GetPoint()->GetNode().IsTextNode());
+            pam.SetMark();
+            pam.Move(fnMoveForward, GoInContent);
+            ::PaMCorrAbs(pam, *pam.GetPoint());
+        }
         if( pDoc->getIDocumentRedlineAccess().IsRedlineOn() )
         {
             SwPosition aTmpPos( rIdx );
commit a8490c587ec4a4d3c56e8cce59bc456eabae3ab7
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Tue Mar 19 08:46:45 2024 +0000
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:04 2024 +0100

    null deref in initial sc html fuzzing
    
    Change-Id: I368db8fec4cfd9409197d17f2892153aca2ba502
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165019
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    (cherry picked from commit 85c40af4e9d4c679f66e7f7e004c018dd28994ee)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165005
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/sc/source/filter/html/htmlpars.cxx 
b/sc/source/filter/html/htmlpars.cxx
index 77511137258b..e5bcc4d2891b 100644
--- a/sc/source/filter/html/htmlpars.cxx
+++ b/sc/source/filter/html/htmlpars.cxx
@@ -914,7 +914,8 @@ void ScHTMLLayoutParser::CloseEntry( const HtmlImportInfo* 
pInfo )
     if ( bTabInTabCell )
     {   // From the stack in TableOff
         bTabInTabCell = false;
-        NewActEntry(maList.back().get()); // New free flying mxActEntry
+        SAL_WARN_IF(maList.empty(), "sc", "unexpected close entry without 
open");
+        NewActEntry(maList.empty() ? nullptr : maList.back().get()); // New 
free flying mxActEntry
         return ;
     }
     if (mxActEntry->nTab == 0)
commit e11ddac80dd98e8d75050d9ea5ada529feb61ae3
Author:     Patrick Luby <guibmac...@gmail.com>
AuthorDate: Fri Mar 22 09:44:51 2024 -0400
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:04 2024 +0100

    tdf#152524 fix crash by changing the macOS fork() and exec() process
    
    This fix backports commit 839cf255e2670fdf8e974af38432aacf63be4e90
    and commit 3c6c5ef5d1c4f555b465bf56cf9d99e4d67224cc.
    
    Change-Id: I5dd397a1ab624a048c8892c870b991b381a94f9c
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165174
    Reviewed-by: Patrick Luby <guibomac...@gmail.com>
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    Tested-by: Jenkins
    Reviewed-by: Christian Lohmaier <lohmaier+libreoff...@googlemail.com>

diff --git a/external/gpgmepp/UnpackedTarball_gpgmepp.mk 
b/external/gpgmepp/UnpackedTarball_gpgmepp.mk
index d7b7a8ab4dbe..dcbda38d591d 100644
--- a/external/gpgmepp/UnpackedTarball_gpgmepp.mk
+++ b/external/gpgmepp/UnpackedTarball_gpgmepp.mk
@@ -34,5 +34,6 @@ $(eval $(call gb_UnpackedTarball_add_patches,gpgmepp, \
     external/gpgmepp/w32-include.patch \
     external/gpgmepp/Wincompatible-function-pointer-types.patch \
     external/gpgmepp/macos-macports-path.patch \
+    external/gpgmepp/macos-tdf152524.patch \
 ))
 # vim: set noet sw=4 ts=4:
diff --git a/external/gpgmepp/macos-tdf152524.patch 
b/external/gpgmepp/macos-tdf152524.patch
new file mode 100644
index 000000000000..c1cdd047dba8
--- /dev/null
+++ b/external/gpgmepp/macos-tdf152524.patch
@@ -0,0 +1,102 @@
+--- src/posix-io.c     2023-02-01 11:50:48
++++ src/posix-io.c     2024-03-21 09:50:24
+@@ -67,6 +67,13 @@
+ #include "priv-io.h"
+ #include "sema.h"
+ #include "debug.h"
++
++#if HAVE_MACOS_SYSTEM
++#include <dispatch/dispatch.h>
++#include <spawn.h>
++
++extern char **environ;
++#endif
+ 
+ 
+ #ifdef USE_LINUX_GETDENTS
+@@ -515,6 +522,15 @@
+     }
+   return 0;
+ }
++
++
++#if HAVE_MACOS_SYSTEM
++static int
++_gpgme_io_spawn_macos (const char *path, char *const argv[], unsigned int 
flags,
++                     struct spawn_fd_item_s *fd_list,
++                     void (*atfork) (void *opaque, int reserved),
++                     void *atforkvalue, pid_t *r_pid);
++#endif /*HAVE_MACOS_SYSTEM*/
+ 
+ 
+ /* Returns 0 on success, -1 on error.  */
+@@ -523,6 +539,35 @@
+                struct spawn_fd_item_s *fd_list,
+                void (*atfork) (void *opaque, int reserved),
+                void *atforkvalue, pid_t *r_pid)
++#if HAVE_MACOS_SYSTEM
++{
++      /* tdf#152524 fork() and exec() in a separate libdispatch queue
++       * This is another attempt to stop the crashing in libdispatch by
++       * running fork() and exec() within a libdispatch task that will
++       * run in a sequential queue in a non-main thread.  */
++      static dispatch_queue_t queue = NULL;
++      if (!queue)
++              queue = dispatch_queue_create ("gpgmepp",
++                                             DISPATCH_QUEUE_CONCURRENT);
++      if (!queue)
++              return -1;
++
++      __block int ret = -1;
++      dispatch_sync(queue, ^{
++              ret = _gpgme_io_spawn_macos (path, argv, flags,
++                                           fd_list, atfork,
++                                           atforkvalue, r_pid);
++      });
++
++      return ret;
++}
++
++static int
++_gpgme_io_spawn_macos (const char *path, char *const argv[], unsigned int 
flags,
++                     struct spawn_fd_item_s *fd_list,
++                     void (*atfork) (void *opaque, int reserved),
++                     void *atforkvalue, pid_t *r_pid)
++#endif /*HAVE_MACOS_SYSTEM*/
+ {
+   pid_t pid;
+   int i;
+@@ -552,8 +597,15 @@
+   if (!pid)
+     {
+       /* Intermediate child to prevent zombie processes.  */
++#if HAVE_MACOS_SYSTEM
++      /* tdf#152524 fix crash by skipping second fork()
++       * Instead of calling a second fork() in the child process, replace
++       * execv() with posix_spawn(). posix_spawn() does not call any atfork
++       * handlers so the atfork handler that crashes will be skipped.  */
++#else /*HAVE_MACOS_SYSTEM*/
+       if ((pid = fork ()) == 0)
+       {
++#endif /*HAVE_MACOS_SYSTEM*/
+         /* Child.  */
+           int max_fds = -1;
+           int fd;
+@@ -664,6 +716,9 @@
+               close (fd);
+           }
+ 
++#if HAVE_MACOS_SYSTEM
++        _exit(posix_spawn(NULL, path, NULL, NULL, argv, environ));
++#else /*HAVE_MACOS_SYSTEM*/
+         execv (path, (char *const *) argv);
+         /* Hmm: in that case we could write a special status code to the
+            status-pipe.  */
+@@ -674,6 +729,7 @@
+       _exit (1);
+       else
+       _exit (0);
++#endif /*HAVE_MACOS_SYSTEM*/
+     }
+ 
+   TRACE_LOG  ("waiting for child process pid=%i", pid);
commit c655339916679ef6ebeb32a41d31fd2c8682b62f
Author:     Michael Stahl <michael.st...@allotropia.de>
AuthorDate: Fri Mar 22 12:28:43 2024 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:04 2024 +0100

    sw: GetSelectableFromAny() broken for SwXTextRange
    
    The function unnecessarily uses an intermediate XUnoTunnel variable to
    handle SwXTextRange, but the implementation of XUnoTunnel was removed.
    
    (regression from commit 635448a996714a81cb15b41ac4bb0c73cabfb74f)
    
    Change-Id: I90dd7acbd259e8ca562a534ad0bc9a5b85356553
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165162
    Reviewed-by: Noel Grandin <noel.gran...@collabora.co.uk>
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit 8f2de92b3da99346f7282e623d47912f40f92b7b)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165170
    Reviewed-by: Christian Lohmaier <lohmaier+libreoff...@googlemail.com>

diff --git a/sw/qa/core/unocore/unocore.cxx b/sw/qa/core/unocore/unocore.cxx
index 381fe0dab3e2..3e52b12a363c 100644
--- a/sw/qa/core/unocore/unocore.cxx
+++ b/sw/qa/core/unocore/unocore.cxx
@@ -78,6 +78,33 @@ CPPUNIT_TEST_FIXTURE(SwCoreUnocoreTest, testTdf119081)
     CPPUNIT_ASSERT_EQUAL(OUString("x"), 
pWrtShell->GetCurrentShellCursor().GetText());
 }
 
+CPPUNIT_TEST_FIXTURE(SwCoreUnocoreTest, selectTextRange)
+{
+    createSwDoc();
+    uno::Reference<text::XTextDocument> const xTD(mxComponent, 
uno::UNO_QUERY_THROW);
+    uno::Reference<text::XText> const xText(xTD->getText());
+    uno::Reference<text::XTextCursor> const xCursor(xText->createTextCursor());
+    xText->insertString(xCursor, "test", /*bAbsorb=*/false);
+    xCursor->gotoStart(false);
+    xCursor->gotoEnd(true);
+    CPPUNIT_ASSERT_EQUAL(OUString("test"), xCursor->getString());
+    uno::Reference<lang::XMultiServiceFactory> const xMSF(mxComponent, 
uno::UNO_QUERY_THROW);
+    uno::Reference<text::XTextSection> const xSection(
+        xMSF->createInstance("com.sun.star.text.TextSection"), 
uno::UNO_QUERY_THROW);
+    xText->insertTextContent(xCursor, xSection, true);
+    uno::Reference<text::XTextRange> const xAnchor(xSection->getAnchor());
+    uno::Reference<view::XSelectionSupplier> const 
xView(xTD->getCurrentController(),
+                                                         uno::UNO_QUERY);
+    CPPUNIT_ASSERT_EQUAL(OUString("test"), xAnchor->getString());
+    CPPUNIT_ASSERT(xView->select(uno::Any(xAnchor)));
+    uno::Reference<container::XIndexAccess> xSel;
+    CPPUNIT_ASSERT(xView->getSelection() >>= xSel);
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(1), xSel->getCount());
+    uno::Reference<text::XTextRange> xSelRange;
+    CPPUNIT_ASSERT(xSel->getByIndex(0) >>= xSelRange);
+    CPPUNIT_ASSERT_EQUAL(OUString("test"), xSelRange->getString());
+}
+
 CPPUNIT_TEST_FIXTURE(SwCoreUnocoreTest, flyAtParaAnchor)
 {
     createSwDoc();
diff --git a/sw/source/core/unocore/unocrsrhelper.cxx 
b/sw/source/core/unocore/unocrsrhelper.cxx
index 70a724814cc6..30f6d6e6190e 100644
--- a/sw/source/core/unocore/unocrsrhelper.cxx
+++ b/sw/source/core/unocore/unocrsrhelper.cxx
@@ -225,7 +225,7 @@ void GetSelectableFromAny(uno::Reference<uno::XInterface> 
const& xIfc,
         return;
     }
 
-    uno::Reference<text::XTextRange> const xTextRange(xTunnel, UNO_QUERY);
+    uno::Reference<text::XTextRange> const xTextRange(xIfc, UNO_QUERY);
     if (xTextRange.is())
     {
         SwUnoInternalPaM aPam(rTargetDoc);
commit ef41e6a7b1dbbdf2f538ecd0b2ab800d62e6a663
Author:     Taichi Haradaguchi <20001...@ymail.ne.jp>
AuthorDate: Fri Mar 22 13:43:14 2024 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:03 2024 +0100

    Expat: upgrade to release 2.6.2
    
    Fixes CVE-2024-28757
    
    Change-Id: Id85044fa9d8eda922425e580e9d6979f6563e98a
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165129
    Tested-by: Taichi Haradaguchi <20001...@ymail.ne.jp>
    Reviewed-by: Taichi Haradaguchi <20001...@ymail.ne.jp>
    (cherry picked from commit 370ca73a45b291e172918b4c8fcbc37ccaa434cf)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165175
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/download.lst b/download.lst
index 67e531e65b0b..ac5450d33473 100644
--- a/download.lst
+++ b/download.lst
@@ -111,8 +111,8 @@ ETONYEK_TARBALL := 
libetonyek-0.1.$(ETONYEK_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-EXPAT_SHA256SUM := 
cb5f5a8ea211e1cabd59be0a933a52e3c02cc326e86a4d387d8d218e7ee47a3e
-EXPAT_TARBALL := expat-2.6.0.tar.xz
+EXPAT_SHA256SUM := 
ee14b4c5d8908b1bec37ad937607eab183d4d9806a08adee472c3c3121d27364
+EXPAT_TARBALL := expat-2.6.2.tar.xz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
diff --git a/external/expat/0001-Fix-compiler-warnings.patch 
b/external/expat/0001-Fix-compiler-warnings.patch
deleted file mode 100644
index adec5ed0d9be..000000000000
--- a/external/expat/0001-Fix-compiler-warnings.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 3f60a47cb5716bb810789a12ef6024c1dc448164 Mon Sep 17 00:00:00 2001
-From: Taichi Haradaguchi <20001...@ymail.ne.jp>
-Date: Fri, 9 Feb 2024 19:28:35 +0900
-Subject: [PATCH] Fix compiler warnings
-
-> In file included from ./../lib/internal.h:149,
->                  from codepage.c:38:
-> ./../lib/expat.h:1045:5: warning: "XML_GE" is not defined, evaluates to 0 
[-Wundef]
->  1045 | #if XML_GE == 1
->       |     ^~~~~~
-> ./../lib/internal.h:158:5: warning: "XML_GE" is not defined, evaluates to 0 
[-Wundef]
->   158 | #if XML_GE == 1
->       |     ^~~~~~
----
- expat/lib/expat.h    | 2 +-
- expat/lib/internal.h | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/expat/lib/expat.h b/expat/lib/expat.h
-index 95464b0d..79bbfb61 100644
---- a/expat/lib/expat.h
-+++ b/expat/lib/expat.h
-@@ -1042,7 +1042,7 @@ typedef struct {
- XMLPARSEAPI(const XML_Feature *)
- XML_GetFeatureList(void);
- 
--#if XML_GE == 1
-+#if defined(XML_GE) && XML_GE == 1
- /* Added in Expat 2.4.0 for XML_DTD defined and
-  * added in Expat 2.6.0 for XML_GE == 1. */
- XMLPARSEAPI(XML_Bool)
-diff --git a/expat/lib/internal.h b/expat/lib/internal.h
-index cce71e4c..208c6b67 100644
---- a/expat/lib/internal.h
-+++ b/expat/lib/internal.h
-@@ -155,7 +155,7 @@ extern "C" {
- void _INTERNAL_trim_to_complete_utf8_characters(const char *from,
-                                                 const char **fromLimRef);
- 
--#if XML_GE == 1
-+#if defined(XML_GE) && XML_GE == 1
- unsigned long long testingAccountingGetCountBytesDirect(XML_Parser parser);
- unsigned long long testingAccountingGetCountBytesIndirect(XML_Parser parser);
- const char *unsignedCharToPrintable(unsigned char c);
--- 
-2.43.1
-
diff --git a/external/expat/UnpackedTarball_expat.mk 
b/external/expat/UnpackedTarball_expat.mk
index 465105f2ca8c..5d4f41f6d147 100644
--- a/external/expat/UnpackedTarball_expat.mk
+++ b/external/expat/UnpackedTarball_expat.mk
@@ -13,10 +13,7 @@ $(eval $(call 
gb_UnpackedTarball_set_tarball,expat,$(EXPAT_TARBALL)))
 
 $(eval $(call gb_UnpackedTarball_update_autoconf_configs,expat,conftools))
 
-# * external/expat/0001-Fix-compiler-warnings.patch was sent to upstream as
-#   <https://github.com/libexpat/libexpat/pull/819> "Fix compiler warnings":
 $(eval $(call gb_UnpackedTarball_add_patches,expat,\
-       external/expat/0001-Fix-compiler-warnings.patch \
        external/expat/expat-winapi.patch \
 ))
 
commit 824879d61f50c2ff6af73923bfdb820ca1ec4cda
Author:     Michael Stahl <michael.st...@allotropia.de>
AuthorDate: Fri Mar 22 14:27:01 2024 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:03 2024 +0100

    tdf#157241 sw: assert when importing ToX in table in rhbz589883-2.docx
    
    ndtbl.cxx:1417: SwNodes::TextToTable(): Assertion `!rNode.IsSectionNode()' 
failed.
    
    (regression from commit 62cb3b8b8d6106c6aeb073b12d84973a107182ef)
    
    Change-Id: Iec12282573cb914d1924f4da4a28e26e01b866df
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165164
    Tested-by: Michael Stahl <michael.st...@allotropia.de>
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit df6fdb0041f8bfd251a4b03030b8bc47f0614c36)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165173
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/sw/source/core/docnode/ndtbl.cxx b/sw/source/core/docnode/ndtbl.cxx
index d052ed7eda4b..f3b3a07d63b5 100644
--- a/sw/source/core/docnode/ndtbl.cxx
+++ b/sw/source/core/docnode/ndtbl.cxx
@@ -1413,16 +1413,19 @@ SwTableNode* SwNodes::TextToTable( const 
SwNodes::TableRanges_t & rTableNodes,
     // delete frames of all contained content nodes
     for( nLines = 0; aNodeIndex <= rTableNodes.rbegin()->rbegin()->aEnd; 
++aNodeIndex,++nLines )
     {
-        SwNode& rNode = aNodeIndex.GetNode();
-        assert(!rNode.IsSectionNode()); // not possible in writerfilter import
-        if (rNode.IsTableNode())
+        SwNode* pNode(&aNodeIndex.GetNode());
+        while (pNode->IsSectionNode()) // could be ToX field in table
         {
-            lcl_RemoveBreaksTable(static_cast<SwTableNode&>(rNode),
+            pNode = pNode->GetNodes()[pNode->GetIndex()+1];
+        }
+        if (pNode->IsTableNode())
+        {
+            lcl_RemoveBreaksTable(static_cast<SwTableNode&>(*pNode),
                     (0 == nLines) ? pTableFormat : nullptr);
         }
-        else if (rNode.IsContentNode())
+        else if (pNode->IsContentNode())
         {
-            lcl_RemoveBreaks(static_cast<SwContentNode&>(rNode),
+            lcl_RemoveBreaks(static_cast<SwContentNode&>(*pNode),
                     (0 == nLines) ? pTableFormat : nullptr);
         }
     }
commit c9b092d41c5f4d30adbb781d0a1572dca7575a84
Author:     Mike Kaganski <mike.kagan...@collabora.com>
AuthorDate: Thu Mar 21 22:46:26 2024 +0500
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:03 2024 +0100

    tdf#160306: make sure that SvNumberFormatter agrees with ROUND output
    
    After commit 9eb9083ff2fdaeb96399a0830a4394de4e29ef64 (Use Dragonbox
    to implement doubleTo*String*, 2022-02-18), the rounding that is used
    in SvNumberFormatter became strictly more correct; however, it now
    differed from what ROUND spreadsheet function returned, because the
    latter uses rtl_math_round, which calls rtl::math::approxFloor.
    
    To make the visual number representation consistent, this change uses
    rtl_math_round in SvNumberformat::ImpGetNumberOutput.
    
    Change-Id: I05b0bed7d3a6c73584a77adbae2835c95be249fa
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165142
    Tested-by: Jenkins
    Reviewed-by: Mike Kaganski <mike.kagan...@collabora.com>
    (cherry picked from commit 805dd6bee49164d9a77de4ea9e0d53b416daca7a)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165124
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/svl/qa/unit/svl.cxx b/svl/qa/unit/svl.cxx
index 4fa56f4bccd4..969dfa166bae 100644
--- a/svl/qa/unit/svl.cxx
+++ b/svl/qa/unit/svl.cxx
@@ -1993,6 +1993,26 @@ CPPUNIT_TEST_FIXTURE(Test, testLanguageNone)
     CPPUNIT_ASSERT_EQUAL(OUString("dd.mm.yyyy"), 
pFormat->GetMappedFormatstring(keywords, ldw));
 }
 
+CPPUNIT_TEST_FIXTURE(Test, testTdf160306)
+{
+    // Check some cases, where the output of ROUND and of number formatter 
differed
+    SvNumberFormatter aFormatter(m_xContext, LANGUAGE_ENGLISH_US);
+    sal_uInt32 format = aFormatter.GetEntryKey(u"0.00", LANGUAGE_ENGLISH_US);
+    CPPUNIT_ASSERT(format != NUMBERFORMAT_ENTRY_NOT_FOUND);
+    OUString output;
+    const Color* color;
+    aFormatter.GetOutputString(2697.0649999999996, format, output, &color);
+    // Without the fix in place, this would fail with
+    // - Expected: 2697.07
+    // - Actual  : 2697.06
+    CPPUNIT_ASSERT_EQUAL(u"2697.07"_ustr, output);
+    aFormatter.GetOutputString(57.374999999999993, format, output, &color);
+    // Without the fix in place, this would fail with
+    // - Expected: 57.38
+    // - Actual  : 57.37
+    CPPUNIT_ASSERT_EQUAL(u"57.38"_ustr, output);
+}
+
 CPPUNIT_TEST_SUITE_REGISTRATION(Test);
 
 }
diff --git a/svl/source/numbers/zformat.cxx b/svl/source/numbers/zformat.cxx
index b5c8757ef2e6..313a59827947 100644
--- a/svl/source/numbers/zformat.cxx
+++ b/svl/source/numbers/zformat.cxx
@@ -4407,6 +4407,8 @@ bool SvNumberformat::ImpGetNumberOutput(double fNumber,
         {
             nPrecExp = 0;
         }
+        // Make sure that Calc's ROUND and formatted output agree
+        fNumber = rtl_math_round(fNumber, rInfo.nCntPost, 
rtl_math_RoundingMode_Corrected);
         if (rInfo.nCntPost) // Decimal places
         {
             if ((rInfo.nCntPost + nPrecExp) > 15 && nPrecExp < 15)
commit 89458bfe1a1f1a183f8d5e36668cf36907701d15
Author:     Jean-Pierre Ledure <j...@ledure.be>
AuthorDate: Thu Mar 21 15:54:55 2024 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:03 2024 +0100

    ScriptForge (session).RunApplication() crash fix tdf#160222
    
    Use
     com.sun.star.system.SystemShellExecuteFlags.DEFAULTS
    i.o.
     com.sun.star.system.SystemShellExecuteFlags.URIS_ONLY
    
    as argument of
     com.sun.star.system.SystemShellExecute.execute()
    
    Change-Id: I3919777cf9442387aec6ed694a2883519e4a7910
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165105
    Reviewed-by: Jean-Pierre Ledure <j...@ledure.be>
    Tested-by: Jenkins
    (cherry picked from commit ec2d0fceedec8aa775940d496eb86c40f958a10c)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165127

diff --git a/wizards/source/scriptforge/SF_Session.xba 
b/wizards/source/scriptforge/SF_Session.xba
index aeca1133e346..307fb7a8f4bf 100644
--- a/wizards/source/scriptforge/SF_Session.xba
+++ b/wizards/source/scriptforge/SF_Session.xba
@@ -587,7 +587,7 @@ Check:
 Try:
        Set oShell = SF_Utils._GetUNOService(&quot;SystemShellExecute&quot;)
        sCommand = SF_FileSystem._ConvertToUrl(Command)
-       oShell.execute(sCommand, Parameters, 
com.sun.star.system.SystemShellExecuteFlags.URIS_ONLY)
+       oShell.execute(sCommand, Parameters, 
com.sun.star.system.SystemShellExecuteFlags.DEFAULTS)
        bReturn = True
 
 Finally:
commit 1f94d7523376db17a7cbf5ef4bd246b967cbb1a6
Author:     Michael Stahl <michael.st...@allotropia.de>
AuthorDate: Thu Mar 21 18:47:03 2024 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:03 2024 +0100

    configmgr: fix parse error if subelements of <info> used
    
    The unused but valid child elements of <info> such as <author> may be
    used by exentions. This fails with:
    
      warn:configmgr:15104:10916:configmgr/source/components.cxx:660: error 
reading 
"file:///instdir/program/../share/uno_packages/cache/uno_packages/....xcs" 
com.sun.star.uno.RuntimeException message: "bad member <component> in ....xcs 
at configmgr/source/xcsparser.cxx:289"
    
    Because ending the first such element sets bIsParsingInfo_ to false.
    
    This fix just concatenates all the characters in all the children,
    should work well enough for extensions.
    
    (regression from commit db3078bd8c8e3ce3a99fc3987bb6e93b609990c1)
    
    Change-Id: I17a3fb7014cd34c1d546701036550085365432a4
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165143
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit 8350404ec1c02df8b4f6b4f48947ddbff53d91e5)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165126
    Reviewed-by: Stephan Bergmann <stephan.bergm...@allotropia.de>

diff --git a/configmgr/source/xcsparser.cxx b/configmgr/source/xcsparser.cxx
index e70ddac6a6c9..35f61fa1959e 100644
--- a/configmgr/source/xcsparser.cxx
+++ b/configmgr/source/xcsparser.cxx
@@ -129,7 +129,9 @@ bool XcsParser::startElement(
     // illegal content):
     if (ignoring_ > 0
         || (nsId == xmlreader::XmlReader::NAMESPACE_NONE
-            && (name == "import" || name == "uses" || name == "constraints" || 
name == "desc")))
+            && (name == "import" || name == "uses" || name == "constraints" || 
name == "desc"
+                // the following are unused by LO but valid
+                || name == "deprecated" || name == "author" || name == 
"label")))
     {
         assert(ignoring_ < LONG_MAX);
         ++ignoring_;
commit 3f19ea210c1d4d1b5d3618127a79f47cf3313fb6
Author:     Oliver Specht <oliver.spe...@cib.de>
AuthorDate: Wed Mar 20 16:25:17 2024 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:03 2024 +0100

    Revert "tdf#159730 add compatibility option in RTF import"
    
    This reverts commit 3b04e74503ec6d07dc4befdb756e6abdc3de4e58.
    
    Reason for revert: The compatibility option is the wrong approach. This 
results in wrong line calculation as seen in tdf#159730#c6.
    The problem that really needs to be fixed is the 9pt attribute of the 
hidden line breaks in the first paragraph that are used to calculate the height 
of the first paragraph.
    Only the 1pt font attribute of the remaining visible space should define 
the line height.
    
    Change-Id: I6e0a1a499adaf2df9f68afbcfd6afcd6677e8f76
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165006
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit 44e4ada23dfc8655ec7ddccfd027f02d22684d60)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165118
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/writerfilter/source/dmapper/DomainMapper.cxx 
b/writerfilter/source/dmapper/DomainMapper.cxx
index 50f47439af27..2ee5d71d02a6 100644
--- a/writerfilter/source/dmapper/DomainMapper.cxx
+++ b/writerfilter/source/dmapper/DomainMapper.cxx
@@ -131,9 +131,6 @@ DomainMapper::DomainMapper( const uno::Reference< 
uno::XComponentContext >& xCon
         m_pImpl->SetDocumentSettingsProperty(
             getPropertyName(PROP_APPLY_PARAGRAPH_MARK_FORMAT_TO_NUMBERING),
             uno::Any(true));
-        m_pImpl->SetDocumentSettingsProperty(
-            getPropertyName(PROP_TABS_AND_BLANKS_FOR_LINE_CALCULATION),
-            uno::Any(true));
 
         // Don't load the default style definitions to avoid weird mix
         m_pImpl->SetDocumentSettingsProperty("StylesNoDefault", 
uno::Any(true));
diff --git a/writerfilter/source/dmapper/PropertyIds.cxx 
b/writerfilter/source/dmapper/PropertyIds.cxx
index 8a83ca0bb064..b8b4efc06222 100644
--- a/writerfilter/source/dmapper/PropertyIds.cxx
+++ b/writerfilter/source/dmapper/PropertyIds.cxx
@@ -384,7 +384,6 @@ namespace
         { PROP_PARA_CONNECT_BORDERS, u"ParaIsConnectBorder"},
         { PROP_DECORATIVE, u"Decorative"},
         { PROP_PAPER_TRAY, u"PrinterPaperTray"},
-        { PROP_TABS_AND_BLANKS_FOR_LINE_CALCULATION, 
u"IgnoreTabsAndBlanksForLineCalculation"},
     });
 } // end anonymous ns
 
diff --git a/writerfilter/source/dmapper/PropertyIds.hxx 
b/writerfilter/source/dmapper/PropertyIds.hxx
index bb2fb833516c..b39fcd24fa49 100644
--- a/writerfilter/source/dmapper/PropertyIds.hxx
+++ b/writerfilter/source/dmapper/PropertyIds.hxx
@@ -383,7 +383,6 @@ enum PropertyIds
         ,PROP_RTL_GUTTER
         ,PROP_CURSOR_NOT_IGNORE_TABLES_IN_HF
         ,PROP_PARA_CONNECT_BORDERS
-        ,PROP_TABS_AND_BLANKS_FOR_LINE_CALCULATION
     };
 
 //Returns the UNO string equivalent to eId.
commit c36d7e07f94cfdfe03e516f1b0147e38690ef9fe
Author:     Mike Kaganski <mike.kagan...@collabora.com>
AuthorDate: Wed Mar 20 16:24:07 2024 +0500
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:03 2024 +0100

    tdf#160278: restore cursor bounds properly
    
    The passed string length is not a correct measure of how many steps
    should the selection expand in the resulting text: the cursor goes
    over glyphs, not over UTF-16 code units. Thus, it's easier to store
    the position prior to insertion, and restore it from the indexes.
    
    Change-Id: I1d592ff30199007ba3a99d7e1a6d2db2da35f1cb
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165056
    Tested-by: Jenkins
    Reviewed-by: Mike Kaganski <mike.kagan...@collabora.com>
    Signed-off-by: Xisco Fauli <xiscofa...@libreoffice.org>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165145

diff --git a/sw/qa/extras/unowriter/unowriter.cxx 
b/sw/qa/extras/unowriter/unowriter.cxx
index 8bcadbaf4227..80b9e556f73b 100644
--- a/sw/qa/extras/unowriter/unowriter.cxx
+++ b/sw/qa/extras/unowriter/unowriter.cxx
@@ -1201,6 +1201,27 @@ CPPUNIT_TEST_FIXTURE(SwUnoWriter, testTdf129841)
     CPPUNIT_ASSERT_EQUAL(aRefColor, aColor);
 }
 
+CPPUNIT_TEST_FIXTURE(SwUnoWriter, testTdf160278)
+{
+    createSwDoc();
+    auto xTextDocument(mxComponent.queryThrow<css::text::XTextDocument>());
+    auto xText(xTextDocument->getText());
+    xText->setString(u"123"_ustr);
+    CPPUNIT_ASSERT_EQUAL(u"123"_ustr, xText->getString());
+    auto xCursor = xText->createTextCursorByRange(xText->getEnd());
+    xCursor->goLeft(1, true);
+    CPPUNIT_ASSERT_EQUAL(u"3"_ustr, xCursor->getString());
+    // Insert an SMP character U+1f702 (so it's two UTF-16 code units, 0xd83d 
0xdf02):
+    xCursor->setString(u"🜂"_ustr);
+    // Without the fix, the replacement would expand the cursor one too many 
characters to the left,
+    // and the cursor text would become "2🜂", failing the next test:
+    CPPUNIT_ASSERT_EQUAL(u"🜂"_ustr, xCursor->getString());
+    xCursor->setString(u"test"_ustr);
+    CPPUNIT_ASSERT_EQUAL(u"test"_ustr, xCursor->getString());
+    // This test would fail, too; the text would be "1test":
+    CPPUNIT_ASSERT_EQUAL(u"12test"_ustr, xText->getString());
+}
+
 CPPUNIT_PLUGIN_IMPLEMENT();
 
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/sw/source/core/unocore/unoobj.cxx 
b/sw/source/core/unocore/unoobj.cxx
index 49562c1d0284..df02c4773a15 100644
--- a/sw/source/core/unocore/unoobj.cxx
+++ b/sw/source/core/unocore/unoobj.cxx
@@ -752,13 +752,19 @@ void SwXTextCursor::DeleteAndInsert(std::u16string_view 
aText,
         }
         if(nTextLen)
         {
+            // Store node and content indexes prior to insertion: to select 
the inserted text,
+            // we need to account for possible surrogate pairs, combining 
characters, etc.; it
+            // is easier to just restore the correct position from the indexes.
+            const auto start = pCurrent->Start();
+            const auto nodeIndex = start->GetNodeIndex();
+            const auto contentIndex = start->GetContentIndex();
             const bool bSuccess(
                 SwUnoCursorHelper::DocInsertStringSplitCR(
-                    rDoc, *pCurrent, aText, bool(eMode & 
::sw::DeleteAndInsertMode::ForceExpandHints)));
+                    rDoc, SwPaM(*start, pCurrent), aText, bool(eMode & 
::sw::DeleteAndInsertMode::ForceExpandHints)));
             OSL_ENSURE( bSuccess, "Doc->Insert(Str) failed." );
 
-            SwUnoCursorHelper::SelectPam(*pUnoCursor, true);
-            pCurrent->Left(aText.size());
+            pCurrent->SetMark();
+            pCurrent->GetPoint()->Assign(nodeIndex, contentIndex);
         }
         pCurrent = pCurrent->GetNext();
     } while (pCurrent != pUnoCursor);
commit 2984e4853c5f5a442f9033225a3584759bbb4878
Author:     Patrick Luby <guibmac...@gmail.com>
AuthorDate: Sun Mar 17 19:04:21 2024 -0400
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:03 2024 +0100

    tdf#93352 Fix horizontal swiping and scrolling when using an RTL UI
    
    Starting with commit bfa21ce5fa08f2c634ccb6162914be55aef9f3c2,
    horizontal swiping in Calc moved in the wrong direction scrollbars
    were drawn mirrored.
    
    So, revert parts of commit bfa21ce5fa08f2c634ccb6162914be55aef9f3c2
    so that we are using Calc's previous "negative scrollbar range"
    implementation for RTL UIs, but only for horizontal scrollbars since
    vertical scrollbars are the same in LTR and RTL UIs.
    
    Also, always disable RTL for scrollbars. Enabling RTL causes the
    following bugs when clicking or dragging the mouse in scrollbars in
    Calc's RTL UI:
    - Click or drag events get mirrored so you must click or drag in
      unexpected locations to move the scrollbar thumb in the desired
      direction
    - Repeatedly dragging the scrollbar thumb leftward can only move
      no highter than the R, S, or T columns
    
    Note: even though RTL is always disabled for Calc scrollbars, the arrows
    must still be swapped in vcl's ScrollBar class.
    
    Change-Id: I85aac94ffaf7df2eeb251a3ff150cc0363b5d770
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/164959
    Reviewed-by: Stéphane Guillou <stephane.guil...@libreoffice.org>
    Tested-by: Jenkins
    Reviewed-by: Patrick Luby <guibomac...@gmail.com>
    (cherry picked from commit ac1024765d203496bc7d28cb3ed3a6d2215c53ad)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165116
    Reviewed-by: Adolfo Jayme Barrientos <fit...@ubuntu.com>

diff --git a/include/svtools/scrolladaptor.hxx 
b/include/svtools/scrolladaptor.hxx
index cdc507078cf8..1eba1dfdf844 100644
--- a/include/svtools/scrolladaptor.hxx
+++ b/include/svtools/scrolladaptor.hxx
@@ -71,6 +71,8 @@ public:
 
     void SetThickness(int nThickness);
 
+    void SetSwapArrows(bool bSwap = true);
+
     ScrollAdaptor(vcl::Window* pParent, bool bHori);
     virtual void dispose() override;
 };
diff --git a/include/vcl/toolkit/scrbar.hxx b/include/vcl/toolkit/scrbar.hxx
index 6981b64fa622..363755fc4168 100644
--- a/include/vcl/toolkit/scrbar.hxx
+++ b/include/vcl/toolkit/scrbar.hxx
@@ -57,6 +57,7 @@ private:
     ScrollType      meScrollType;
     bool            mbCalcSize;
     bool            mbFullDrag;
+    bool            mbSwapArrows;
     Link<ScrollBar*,void>       maScrollHdl;
     Link<ScrollBar*,void>       maEndScrollHdl;
 
@@ -132,6 +133,8 @@ public:
     void            SetEndScrollHdl( const Link<ScrollBar*,void>& rLink ) { 
maEndScrollHdl = rLink; }
 
     virtual Size    GetOptimalSize() const override;
+
+    void            SetSwapArrows( bool bSwap ) { mbSwapArrows = bSwap; }
 };
 
 
diff --git a/include/vcl/weld.hxx b/include/vcl/weld.hxx
index 2d8c4db085d6..fc585bdb1071 100644
--- a/include/vcl/weld.hxx
+++ b/include/vcl/weld.hxx
@@ -2576,6 +2576,7 @@ public:
 
     virtual int get_scroll_thickness() const = 0;
     virtual void set_scroll_thickness(int nThickness) = 0;
+    virtual void set_scroll_swap_arrows(bool bSwap) = 0;
 
     virtual ScrollType get_scroll_type() const = 0;
 
diff --git a/sc/source/ui/inc/tabview.hxx b/sc/source/ui/inc/tabview.hxx
index 2bf71e00eea1..1873a525e9dd 100644
--- a/sc/source/ui/inc/tabview.hxx
+++ b/sc/source/ui/inc/tabview.hxx
@@ -242,7 +242,7 @@ private:
     void            UpdateVarZoom();
 
     static void     SetScrollBar( ScrollAdaptor& rScroll, tools::Long 
nRangeMax, tools::Long nVisible, tools::Long nPos, bool bLayoutRTL );
-    static tools::Long     GetScrollBarPos( const ScrollAdaptor& rScroll );
+    static tools::Long     GetScrollBarPos( const ScrollAdaptor& rScroll, bool 
bLayoutRTL );
 
     void            GetAreaMoveEndPosition(SCCOL nMovX, SCROW nMovY, 
ScFollowMode eMode,
                                            SCCOL& rAreaX, SCROW& rAreaY, 
ScFollowMode& rMode,
diff --git a/sc/source/ui/view/tabview.cxx b/sc/source/ui/view/tabview.cxx
index 6c6f174278bf..75bdd7ed5042 100644
--- a/sc/source/ui/view/tabview.cxx
+++ b/sc/source/ui/view/tabview.cxx
@@ -1097,7 +1097,7 @@ void ScTabView::ScrollHdl(ScrollAdaptor* pScroll)
         nViewPos = aViewData.GetPosY( (pScroll == aVScrollTop.get()) ?
                                         SC_SPLIT_TOP : SC_SPLIT_BOTTOM );
 
-    bool bLayoutRTL = aViewData.GetDocument().IsLayoutRTL( 
aViewData.GetTabNo() );
+    bool bLayoutRTL = bHoriz && aViewData.GetDocument().IsLayoutRTL( 
aViewData.GetTabNo() );
 
     ScrollType eType = pScroll->GetScrollType();
     if ( eType == ScrollType::Drag )
@@ -1135,7 +1135,7 @@ void ScTabView::ScrollHdl(ScrollAdaptor* pScroll)
                 nScrollMin = aViewData.GetFixPosX();
             if ( aViewData.GetVSplitMode()==SC_SPLIT_FIX && pScroll == 
aVScrollBottom.get() )
                 nScrollMin = aViewData.GetFixPosY();
-            tools::Long nScrollPos = GetScrollBarPos( *pScroll ) + nScrollMin;
+            tools::Long nScrollPos = GetScrollBarPos( *pScroll, bLayoutRTL ) + 
nScrollMin;
 
             OUString aHelpStr;
             tools::Rectangle aRect;
@@ -1168,6 +1168,22 @@ void ScTabView::ScrollHdl(ScrollAdaptor* pScroll)
     else
         bDragging = false;
 
+    if ( bHoriz && bLayoutRTL )
+    {
+        // change scroll type so visible/previous cells calculation below 
remains the same
+        switch ( eType )
+        {
+            case ScrollType::LineUp:   eType = ScrollType::LineDown; break;
+            case ScrollType::LineDown: eType = ScrollType::LineUp;   break;
+            case ScrollType::PageUp:   eType = ScrollType::PageDown; break;
+            case ScrollType::PageDown: eType = ScrollType::PageUp;   break;
+            default:
+            {
+                // added to avoid warnings
+            }
+        }
+    }
+
     tools::Long nDelta(0);
     switch ( eType )
     {
@@ -1200,7 +1216,7 @@ void ScTabView::ScrollHdl(ScrollAdaptor* pScroll)
                 if ( aViewData.GetVSplitMode()==SC_SPLIT_FIX && pScroll == 
aVScrollBottom.get() )
                     nScrollMin = aViewData.GetFixPosY();
 
-                tools::Long nScrollPos = GetScrollBarPos( *pScroll ) + 
nScrollMin;
+                tools::Long nScrollPos = GetScrollBarPos( *pScroll, bLayoutRTL 
) + nScrollMin;
                 nDelta = nScrollPos - nViewPos;
 
                 // tdf#152406 Disable anti-jitter code for scroll wheel events
diff --git a/sc/source/ui/view/tabview4.cxx b/sc/source/ui/view/tabview4.cxx
index a7de6bdf67d2..5c19b6cf0794 100644
--- a/sc/source/ui/view/tabview4.cxx
+++ b/sc/source/ui/view/tabview4.cxx
@@ -352,16 +352,45 @@ void ScTabView::SetScrollBar( ScrollAdaptor& rScroll, 
tools::Long nRangeMax, too
     if ( nVisible == 0 )
         nVisible = 1;       // #i59893# don't use visible size 0
 
-    rScroll.SetRange( Range( 0, nRangeMax ) );
-    rScroll.SetVisibleSize( nVisible );
-    rScroll.SetThumbPos( nPos );
+    //  RTL layout uses a negative range to simulate a mirrored scroll bar.
+    //  SetScrollBar/GetScrollBarPos hide this so outside of these functions 
normal cell
+    //  addresses can be used.
+    if ( bLayoutRTL )
+    {
+        rScroll.SetRange( Range( -nRangeMax, 0 ) );
+        rScroll.SetVisibleSize( nVisible );
+        rScroll.SetThumbPos( -nPos - nVisible );
+    }
+    else
+    {
+        rScroll.SetRange( Range( 0, nRangeMax ) );
+        rScroll.SetVisibleSize( nVisible );
+        rScroll.SetThumbPos( nPos );
+    }
 
-    rScroll.EnableRTL( bLayoutRTL );
+    // Related: tdf#93352 always disable RTL for scrollbars
+    // Enabling RTL causes the following bugs when clicking or
+    // dragging the mouse in scrollbars in Calc's RTL UI:
+    // - Click or drag events get mirrored so you must click or
+    //   drag in unexpected locations to move the scrollbar thumb
+    //   in the desired direction
+    // - Repeatedly dragging the scrollbar thumb leftward can only
+    //   move no highter than the R, S, or T columns
+    rScroll.EnableRTL( false );
+
+    // Related: tdf#93352 swap arrows if layout is RTL
+    // We cannot use EnableRTL(true) to signal that the arrows
+    // should be swapped (see comment above) so explicitly enable
+    // or disable arrow swapping.
+    rScroll.SetSwapArrows( bLayoutRTL );
 }
 
-tools::Long ScTabView::GetScrollBarPos( const ScrollAdaptor& rScroll )
+tools::Long ScTabView::GetScrollBarPos( const ScrollAdaptor& rScroll, bool 
bLayoutRTL )
 {
-    return rScroll.GetThumbPos();
+    if ( bLayoutRTL )
+        return -rScroll.GetThumbPos() - rScroll.GetVisibleSize();
+    else
+        return rScroll.GetThumbPos();
 }
 
 //  UpdateScrollBars - set visible area and scroll width of scroll bars
@@ -425,7 +454,7 @@ void ScTabView::UpdateScrollBars( HeaderType eHeaderType )
 
     nVisYB = aViewData.VisibleCellsY( SC_SPLIT_BOTTOM );
     tools::Long nMaxYB = lcl_GetScrollRange( nUsedY, 
aViewData.GetPosY(SC_SPLIT_BOTTOM), nVisYB, rDoc.MaxRow(), nStartY );
-    SetScrollBar( *aVScrollBottom, nMaxYB, nVisYB, aViewData.GetPosY( 
SC_SPLIT_BOTTOM ) - nStartY, bLayoutRTL );
+    SetScrollBar( *aVScrollBottom, nMaxYB, nVisYB, aViewData.GetPosY( 
SC_SPLIT_BOTTOM ) - nStartY, false );
 
     if (bRight)
     {
@@ -438,7 +467,7 @@ void ScTabView::UpdateScrollBars( HeaderType eHeaderType )
     {
         nVisYT = aViewData.VisibleCellsY( SC_SPLIT_TOP );
         tools::Long nMaxYT = lcl_GetScrollRange( nUsedY, 
aViewData.GetPosY(SC_SPLIT_TOP), nVisYT, rDoc.MaxRow(), 0 );
-        SetScrollBar( *aVScrollTop, nMaxYT, nVisYT, aViewData.GetPosY( 
SC_SPLIT_TOP ), bLayoutRTL );
+        SetScrollBar( *aVScrollTop, nMaxYT, nVisYT, aViewData.GetPosY( 
SC_SPLIT_TOP ), false );
     }
 
     //      test the range
diff --git a/svtools/source/control/scrolladaptor.cxx 
b/svtools/source/control/scrolladaptor.cxx
index 6d01e9d414d7..8c2725c1715d 100644
--- a/svtools/source/control/scrolladaptor.cxx
+++ b/svtools/source/control/scrolladaptor.cxx
@@ -122,4 +122,6 @@ tools::Long ScrollAdaptor::DoScroll(tools::Long nNewPos)
 
 void ScrollAdaptor::SetThickness(int nThickness) { 
m_xScrollBar->set_scroll_thickness(nThickness); }
 
+void ScrollAdaptor::SetSwapArrows(bool bSwap) { 
m_xScrollBar->set_scroll_swap_arrows(bSwap); }
+
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/vcl/source/app/salvtables.cxx b/vcl/source/app/salvtables.cxx
index 9ed790a2b6ec..46dbcd72f9d3 100644
--- a/vcl/source/app/salvtables.cxx
+++ b/vcl/source/app/salvtables.cxx
@@ -2591,6 +2591,8 @@ public:
         else
             m_xScrollBar->set_width_request(nThickness);
     }
+
+    virtual void set_scroll_swap_arrows(bool bSwap) override { 
m_xScrollBar->SetSwapArrows(bSwap); }
 };
 }
 
diff --git a/vcl/source/control/scrbar.cxx b/vcl/source/control/scrbar.cxx
index b652360139c4..7218b1485bbb 100644
--- a/vcl/source/control/scrbar.cxx
+++ b/vcl/source/control/scrbar.cxx
@@ -85,6 +85,7 @@ void ScrollBar::ImplInit( vcl::Window* pParent, WinBits 
nStyle )
     meScrollType        = ScrollType::DontKnow;
     mbCalcSize          = true;
     mbFullDrag          = false;
+    mbSwapArrows        = false;
 
     ImplInitStyle( nStyle );
     Control::ImplInit( pParent, nStyle, nullptr );
@@ -240,6 +241,7 @@ void ScrollBar::ImplCalc( bool bUpdate )
 
         const tools::Rectangle aControlRegion( Point(0,0), aSize );
         tools::Rectangle aBtn1Region, aBtn2Region, aTrackRegion, 
aBoundingRegion;
+        const bool bSwapArrows = mbSwapArrows || IsRTLEnabled();
 
         // reset rectangles to empty *and* (0,0) position
         maThumbRect = tools::Rectangle();
@@ -248,9 +250,9 @@ void ScrollBar::ImplCalc( bool bUpdate )
 
         if ( GetStyle() & WB_HORZ )
         {
-            if ( GetNativeControlRegion( ControlType::Scrollbar, 
IsRTLEnabled()? ControlPart::ButtonRight: ControlPart::ButtonLeft,
+            if ( GetNativeControlRegion( ControlType::Scrollbar, bSwapArrows? 
ControlPart::ButtonRight: ControlPart::ButtonLeft,
                         aControlRegion, ControlState::NONE, 
ImplControlValue(), aBoundingRegion, aBtn1Region ) &&
-                 GetNativeControlRegion( ControlType::Scrollbar, 
IsRTLEnabled()? ControlPart::ButtonLeft: ControlPart::ButtonRight,
+                 GetNativeControlRegion( ControlType::Scrollbar, bSwapArrows? 
ControlPart::ButtonLeft: ControlPart::ButtonRight,
                         aControlRegion, ControlState::NONE, 
ImplControlValue(), aBoundingRegion, aBtn2Region ) )
             {
                 maBtn1Rect = aBtn1Region;
diff --git a/vcl/unx/gtk3/gtkinst.cxx b/vcl/unx/gtk3/gtkinst.cxx
index b8da4f7b7a27..036493239217 100644
--- a/vcl/unx/gtk3/gtkinst.cxx
+++ b/vcl/unx/gtk3/gtkinst.cxx
@@ -8745,6 +8745,11 @@ public:
             gtk_widget_set_size_request(GTK_WIDGET(m_pScrollbar), nThickness, 
-1);
     }
 
+    virtual void set_scroll_swap_arrows(bool /* bSwap */) override
+    {
+        // Related: tdf#93352 do nothing since GtkScrollbar has no arrows
+    }
+
     virtual ~GtkInstanceScrollbar() override
     {
         g_signal_handler_disconnect(m_pAdjustment, m_nAdjustChangedSignalId);
commit 5ab1f66d87fe33f4e4a0af54e9c15e38339ca24a
Author:     Noel Grandin <noel.gran...@collabora.co.uk>
AuthorDate: Wed Mar 20 09:59:09 2024 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:03 2024 +0100

    tdf#158556 speedup docx load
    
    Avoid O(n^2) loop in SwXFrame::setPropertyValue, we even have an index
    to search for this stuff
    
    Reduces load time from 325s to 172s
    
    Change-Id: I6c6c03206ef81be1d7d7702a4313acd23d75442d
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165044
    Tested-by: Jenkins
    Reviewed-by: Noel Grandin <noel.gran...@collabora.co.uk>
    (cherry picked from commit 241e2d68664e0e53cf02fe9986462c4a9ecd8d42)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165110
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/sw/inc/doc.hxx b/sw/inc/doc.hxx
index ea95cef85636..99cb33c75826 100644
--- a/sw/inc/doc.hxx
+++ b/sw/inc/doc.hxx
@@ -838,6 +838,7 @@ public:
     std::vector<SwFrameFormat const*> GetFlyFrameFormats(
             FlyCntType eType,
             bool bIgnoreTextBoxes);
+    SwFrameFormat* GetFlyFrameFormatByName( const OUString& sFrameFormatName );
 
     // Copy formats in own arrays and return them.
     SwFrameFormat  *CopyFrameFormat ( const SwFrameFormat& );
diff --git a/sw/source/core/doc/docfly.cxx b/sw/source/core/doc/docfly.cxx
index c492212487c3..203894123007 100644
--- a/sw/source/core/doc/docfly.cxx
+++ b/sw/source/core/doc/docfly.cxx
@@ -149,6 +149,25 @@ SwFrameFormat* SwDoc::GetFlyNum( size_t nIdx, FlyCntType 
eType, bool bIgnoreText
     return pRetFormat;
 }
 
+SwFrameFormat* SwDoc::GetFlyFrameFormatByName( const OUString& 
rFrameFormatName )
+{
+    auto pFrameFormats = GetSpzFrameFormats();
+    auto it = pFrameFormats->findByTypeAndName( RES_FLYFRMFMT, 
rFrameFormatName );
+    auto endIt = pFrameFormats->typeAndNameEnd();
+    for ( ; it != endIt; ++it)
+    {
+        sw::SpzFrameFormat* pFlyFormat = *it;
+        const SwNodeIndex* pIdx = pFlyFormat->GetContent().GetContentIdx();
+        if( !pIdx || !pIdx->GetNodes().IsDocNodes() )
+            continue;
+
+        const SwNode* pNd = GetNodes()[ pIdx->GetIndex() + 1 ];
+        if( !pNd->IsNoTextNode())
+            return pFlyFormat;
+    }
+    return nullptr;
+}
+
 std::vector<SwFrameFormat const*> SwDoc::GetFlyFrameFormats(
     FlyCntType const eType, bool const bIgnoreTextBoxes)
 {
diff --git a/sw/source/core/unocore/unoframe.cxx 
b/sw/source/core/unocore/unoframe.cxx
index 7880a749b95c..62c4c76ac3ab 100644
--- a/sw/source/core/unocore/unoframe.cxx
+++ b/sw/source/core/unocore/unoframe.cxx
@@ -1713,18 +1713,7 @@ void SwXFrame::setPropertyValue(const OUString& 
rPropertyName, const ::uno::Any&
             }
             else
             {
-                const size_t nCount = pDoc->GetFlyCount(FLYCNTTYPE_FRM);
-
-                SwFrameFormat* pChain = nullptr;
-                for( size_t i = 0; i < nCount; ++i )
-                {
-                    SwFrameFormat* pFormat2 = pDoc->GetFlyNum(i, 
FLYCNTTYPE_FRM);
-                    if(sChainName == pFormat2->GetName() )
-                    {
-                        pChain = pFormat2;
-                        break;
-                    }
-                }
+                SwFrameFormat* pChain = 
pDoc->GetFlyFrameFormatByName(sChainName);
                 if(pChain)
                 {
                     SwFrameFormat* pSource = bNextFrame ? pFormat : pChain;
commit e001175cf0a2ae06e6eb15d24a2e630446097ca0
Author:     Noel Grandin <noel.gran...@collabora.co.uk>
AuthorDate: Wed Mar 6 14:12:51 2024 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:03 2024 +0100

    tdf#158773 reduce cost of TextProperties::Notify
    
    Shaves 30% off the load time here, by re-arranging the logic so we do th
    expensive dynamic_cast less often
    
    Change-Id: If7a1605994e620dbdb61010506c624cc738359a4
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/164466
    Tested-by: Jenkins
    Reviewed-by: Noel Grandin <noel.gran...@collabora.co.uk>
    (cherry picked from commit 3b784236d7c3bf386deeeadcf79d9e9b289bf991)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165112
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/svx/source/sdr/properties/textproperties.cxx 
b/svx/source/sdr/properties/textproperties.cxx
index 55b366bdc03b..17f63d044dcf 100644
--- a/svx/source/sdr/properties/textproperties.cxx
+++ b/svx/source/sdr/properties/textproperties.cxx
@@ -554,50 +554,44 @@ namespace sdr::properties
             if(!rObj.HasText())
                 return;
 
+            SfxHintId nId(rHint.GetId());
             const svx::ITextProvider& rTextProvider(getTextProvider());
-            if(dynamic_cast<const SfxStyleSheet *>(&rBC) != nullptr)
-            {
-                SfxHintId nId(rHint.GetId());
 
-                if(SfxHintId::DataChanged == nId)
+            if(SfxHintId::DataChanged == nId && dynamic_cast<const 
SfxStyleSheet *>(&rBC) != nullptr)
+            {
+                sal_Int32 nText = rTextProvider.getTextCount();
+                while (nText--)
                 {
-                    sal_Int32 nText = rTextProvider.getTextCount();
-                    while (nText--)
-                    {
-                        OutlinerParaObject* pParaObj = rTextProvider.getText( 
nText )->GetOutlinerParaObject();
-                        if( pParaObj )
-                            pParaObj->ClearPortionInfo();
-                    }
-                    rObj.SetTextSizeDirty();
-
-                    if(rObj.IsTextFrame() && 
rObj.NbcAdjustTextFrameWidthAndHeight())
-                    {
-                        // here only repaint wanted
-                        rObj.ActionChanged();
-                        //rObj.BroadcastObjectChange();
-                    }
+                    OutlinerParaObject* pParaObj = rTextProvider.getText( 
nText )->GetOutlinerParaObject();
+                    if( pParaObj )
+                        pParaObj->ClearPortionInfo();
+                }
+                rObj.SetTextSizeDirty();
 
-                    // #i101556# content of StyleSheet has changed -> new 
version
-                    maVersion++;
+                if(rObj.IsTextFrame() && 
rObj.NbcAdjustTextFrameWidthAndHeight())
+                {
+                    // here only repaint wanted
+                    rObj.ActionChanged();
+                    //rObj.BroadcastObjectChange();
                 }
 
-                if(SfxHintId::Dying == nId)
+                // #i101556# content of StyleSheet has changed -> new version
+                maVersion++;
+            }
+            else if(SfxHintId::Dying == nId && dynamic_cast<const 
SfxStyleSheet *>(&rBC) != nullptr)
+            {
+                sal_Int32 nText = rTextProvider.getTextCount();
+                while (nText--)
                 {
-                    sal_Int32 nText = rTextProvider.getTextCount();
-                    while (nText--)
-                    {
-                        OutlinerParaObject* pParaObj = rTextProvider.getText( 
nText )->GetOutlinerParaObject();
-                        if( pParaObj )
-                            pParaObj->ClearPortionInfo();
-                    }
+                    OutlinerParaObject* pParaObj = rTextProvider.getText( 
nText )->GetOutlinerParaObject();
+                    if( pParaObj )
+                        pParaObj->ClearPortionInfo();
                 }
             }
-            else if(dynamic_cast<const SfxStyleSheetBasePool *>(&rBC) != 
nullptr)
+            else if (nId == SfxHintId::StyleSheetModified && 
dynamic_cast<const SfxStyleSheetBasePool *>(&rBC) != nullptr)
             {
                 const SfxStyleSheetModifiedHint* pExtendedHint = 
dynamic_cast<const SfxStyleSheetModifiedHint*>(&rHint);
-
-                if(pExtendedHint
-                    && SfxHintId::StyleSheetModified == pExtendedHint->GetId())
+                if (pExtendedHint)
                 {
                     const OUString& aOldName(pExtendedHint->GetOldName());
                     OUString 
aNewName(pExtendedHint->GetStyleSheet()->GetName());
commit 2153c0f9d045ef2fc26f22d63abd5a4e5fb7068b
Author:     Michael Stahl <michael.st...@allotropia.de>
AuthorDate: Wed Mar 20 10:52:09 2024 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:02 2024 +0100

    python3: upgrade to release 3.8.19
    
    Fixes CVE-2023-6597 and also CVE-2024-0450
    
    Change-Id: Iebca2608e16a966356736201c63f1be5185430d4
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165053
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit 0633e4b4205334dd65ec64d7f3e306ee125e31be)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165008
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/configure.ac b/configure.ac
index 4fcc847630d2..13b3b0690941 100644
--- a/configure.ac
+++ b/configure.ac
@@ -10045,7 +10045,7 @@ if test \( "$cross_compiling" = yes -a -z 
"$PYTHON_FOR_BUILD" \) -o "$enable_pyt
     SYSTEM_PYTHON=
     PYTHON_VERSION_MAJOR=3
     PYTHON_VERSION_MINOR=8
-    PYTHON_VERSION=${PYTHON_VERSION_MAJOR}.${PYTHON_VERSION_MINOR}.18
+    PYTHON_VERSION=${PYTHON_VERSION_MAJOR}.${PYTHON_VERSION_MINOR}.19
     if ! grep -q -i python.*${PYTHON_VERSION} ${SRC_ROOT}/download.lst; then
         AC_MSG_ERROR([PYTHON_VERSION ${PYTHON_VERSION} but no matching file in 
download.lst])
     fi
diff --git a/download.lst b/download.lst
index f150ccf72255..67e531e65b0b 100644
--- a/download.lst
+++ b/download.lst
@@ -618,8 +618,8 @@ POSTGRESQL_TARBALL := postgresql-13.11.tar.bz2
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-PYTHON_SHA256SUM := 
3ffb71cd349a326ba7b2fadc7e7df86ba577dd9c4917e52a8401adbda7405e3f
-PYTHON_TARBALL := Python-3.8.18.tar.xz
+PYTHON_SHA256SUM := 
d2807ac69f69b84fd46a0b93bbd02a4fa48d3e70f4b2835ff0f72a2885040076
+PYTHON_TARBALL := Python-3.8.19.tar.xz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
commit 29dd0ed39812423a8abc5dfb8033a9282347ee84
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Mon Mar 18 19:32:26 2024 +0000
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:02 2024 +0100

    leaks in initial corpus for sc html import fuzzing
    
    Change-Id: Ia7a9d6b283dcf127dccf734fb45cf8ac3dde5478
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/164889
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>

diff --git a/sc/source/filter/html/htmlpars.cxx 
b/sc/source/filter/html/htmlpars.cxx
index 7b937bcf5b3e..77511137258b 100644
--- a/sc/source/filter/html/htmlpars.cxx
+++ b/sc/source/filter/html/htmlpars.cxx
@@ -304,7 +304,7 @@ ScHTMLLayoutParser::ScHTMLLayoutParser(
         aPageSize( aPageSizeP ),
         aBaseURL(std::move( _aBaseURL )),
         xLockedList( new ScRangeList ),
-        pLocalColOffset( new ScHTMLColOffset ),
+        xLocalColOffset( new ScHTMLColOffset ),
         nFirstTableCell(0),
         nTableLevel(0),
         nTable(0),
@@ -320,20 +320,15 @@ ScHTMLLayoutParser::ScHTMLLayoutParser(
         bInCell( false ),
         bInTitle( false )
 {
-    MakeColNoRef( pLocalColOffset, 0, 0, 0, 0 );
+    MakeColNoRef( xLocalColOffset.get(), 0, 0, 0, 0 );
     MakeColNoRef( &maColOffset, 0, 0, 0, 0 );
 }
 
 ScHTMLLayoutParser::~ScHTMLLayoutParser()
 {
-    while ( !aTableStack.empty() )
-    {
-        ScHTMLTableStackEntry * pS = aTableStack.top().get();
-        if ( pS->pLocalColOffset != pLocalColOffset )
-             delete pS->pLocalColOffset;
+    while (!aTableStack.empty())
         aTableStack.pop();
-    }
-    delete pLocalColOffset;
+    xLocalColOffset.reset();
     if ( pTables )
     {
         for( const auto& rEntry : *pTables)
@@ -716,9 +711,9 @@ sal_uInt16 ScHTMLLayoutParser::GetWidth( const 
ScEEParseEntry* pE )
         return pE->nWidth;
     sal_Int32 nTmp = std::min( static_cast<sal_Int32>( pE->nCol -
                 nColCntStart + pE->nColOverlap),
-            static_cast<sal_Int32>( pLocalColOffset->size() - 1));
+            static_cast<sal_Int32>( xLocalColOffset->size() - 1));
     SCCOL nPos = (nTmp < 0 ? 0 : static_cast<SCCOL>(nTmp));
-    sal_uInt16 nOff2 = static_cast<sal_uInt16>((*pLocalColOffset)[nPos]);
+    sal_uInt16 nOff2 = static_cast<sal_uInt16>((*xLocalColOffset)[nPos]);
     if ( pE->nOffset < nOff2 )
         return nOff2 - pE->nOffset;
     return 0;
@@ -732,22 +727,22 @@ void ScHTMLLayoutParser::SetWidths()
     SCCOL nColsPerRow = nMaxCol - nColCntStart;
     if ( nColsPerRow <= 0 )
         nColsPerRow = 1;
-    if ( pLocalColOffset->size() <= 2 )
+    if ( xLocalColOffset->size() <= 2 )
     {   // Only PageSize, there was no width setting
         sal_uInt16 nWidth = nTableWidth / static_cast<sal_uInt16>(nColsPerRow);
         sal_uInt16 nOff = nColOffsetStart;
-        pLocalColOffset->clear();
+        xLocalColOffset->clear();
         for ( nCol = 0; nCol <= nColsPerRow; ++nCol, nOff = nOff + nWidth )
         {
-            MakeColNoRef( pLocalColOffset, nOff, 0, 0, 0 );
+            MakeColNoRef( xLocalColOffset.get(), nOff, 0, 0, 0 );
         }
-        nTableWidth = static_cast<sal_uInt16>(pLocalColOffset->back() - 
pLocalColOffset->front());
+        nTableWidth = static_cast<sal_uInt16>(xLocalColOffset->back() - 
xLocalColOffset->front());
         for ( size_t i = nFirstTableCell, nListSize = maList.size(); i < 
nListSize; ++i )
         {
             auto& pE = maList[ i ];
             if ( pE->nTab == nTable )
             {
-                pE->nOffset = 
static_cast<sal_uInt16>((*pLocalColOffset)[pE->nCol - nColCntStart]);
+                pE->nOffset = 
static_cast<sal_uInt16>((*xLocalColOffset)[pE->nCol - nColCntStart]);
                 pE->nWidth = 0; // to be recalculated later
             }
         }
@@ -826,10 +821,10 @@ void ScHTMLLayoutParser::SetWidths()
             {
                 pOffsets[nCol] = pOffsets[nCol-1] + pWidths[nCol-1];
             }
-            pLocalColOffset->clear();
+            xLocalColOffset->clear();
             for ( nCol = 0; nCol <= nColsPerRow; nCol++ )
             {
-                MakeColNoRef( pLocalColOffset, pOffsets[nCol], 0, 0, 0 );
+                MakeColNoRef( xLocalColOffset.get(), pOffsets[nCol], 0, 0, 0 );
             }
             nTableWidth = pOffsets[nColsPerRow] - pOffsets[0];
 
@@ -855,15 +850,15 @@ void ScHTMLLayoutParser::SetWidths()
             }
         }
     }
-    if ( !pLocalColOffset->empty() )
+    if ( !xLocalColOffset->empty() )
     {
-        sal_uInt16 nMax = static_cast<sal_uInt16>(pLocalColOffset->back());
+        sal_uInt16 nMax = static_cast<sal_uInt16>(xLocalColOffset->back());
         if ( aPageSize.Width() < nMax )
             aPageSize.setWidth( nMax );
         if (nTableLevel == 0)
         {
             // Local table is very outer table, create missing offsets.
-            for (auto it = pLocalColOffset->begin(); it != 
pLocalColOffset->end(); ++it)
+            for (auto it = xLocalColOffset->begin(); it != 
xLocalColOffset->end(); ++it)
             {
                 // Only exact offsets, do not use MakeColNoRef().
                 maColOffset.insert(*it);
@@ -897,15 +892,15 @@ void ScHTMLLayoutParser::Colonize( ScEEParseEntry* pE )
     if ( nCol < pE->nCol )
     {   // Replaced
         nCol = pE->nCol - nColCntStart;
-        SCCOL nCount = static_cast<SCCOL>(pLocalColOffset->size());
+        SCCOL nCount = static_cast<SCCOL>(xLocalColOffset->size());
         if ( nCol < nCount )
-            nColOffset = static_cast<sal_uInt16>((*pLocalColOffset)[nCol]);
+            nColOffset = static_cast<sal_uInt16>((*xLocalColOffset)[nCol]);
         else
-            nColOffset = static_cast<sal_uInt16>((*pLocalColOffset)[nCount - 
1]);
+            nColOffset = static_cast<sal_uInt16>((*xLocalColOffset)[nCount - 
1]);
     }
     pE->nOffset = nColOffset;
     sal_uInt16 nWidth = GetWidth( pE );
-    MakeCol( pLocalColOffset, pE->nOffset, nWidth, nOffsetTolerance, 
nOffsetTolerance );
+    MakeCol( xLocalColOffset.get(), pE->nOffset, nWidth, nOffsetTolerance, 
nOffsetTolerance );
     if ( pE->nWidth )
         pE->nWidth = nWidth;
     nColOffset = pE->nOffset + nWidth;
@@ -1149,7 +1144,7 @@ void ScHTMLLayoutParser::TableOn( HtmlImportInfo* pInfo )
         sal_uInt16 nTmpColOffset = nColOffset; // Will be changed in Colonize()
         Colonize(mxActEntry.get());
         aTableStack.push( std::make_unique<ScHTMLTableStackEntry>(
-            mxActEntry, xLockedList, pLocalColOffset, nFirstTableCell,
+            mxActEntry, xLockedList, xLocalColOffset, nFirstTableCell,
             nRowCnt, nColCntStart, nMaxCol, nTable,
             nTableWidth, nColOffset, nColOffsetStart,
             bFirstRow ) );
@@ -1205,7 +1200,7 @@ void ScHTMLLayoutParser::TableOn( HtmlImportInfo* pInfo )
             NextRow( pInfo );
         }
         aTableStack.push( std::make_unique<ScHTMLTableStackEntry>(
-            mxActEntry, xLockedList, pLocalColOffset, nFirstTableCell,
+            mxActEntry, xLockedList, xLocalColOffset, nFirstTableCell,
             nRowCnt, nColCntStart, nMaxCol, nTable,
             nTableWidth, nColOffset, nColOffsetStart,
             bFirstRow ) );
@@ -1238,8 +1233,8 @@ void ScHTMLLayoutParser::TableOn( HtmlImportInfo* pInfo )
     bFirstRow = true;
     nFirstTableCell = maList.size();
 
-    pLocalColOffset = new ScHTMLColOffset;
-    MakeColNoRef( pLocalColOffset, nColOffsetStart, 0, 0, 0 );
+    xLocalColOffset.reset(new ScHTMLColOffset);
+    MakeColNoRef( xLocalColOffset.get(), nColOffsetStart, 0, 0, 0 );
 }
 
 void ScHTMLLayoutParser::TableOff( const HtmlImportInfo* pInfo )
@@ -1355,7 +1350,7 @@ void ScHTMLLayoutParser::TableOff( const HtmlImportInfo* 
pInfo )
             {
                 sal_uInt16 nOldOffset = pE->nOffset + pE->nWidth;
                 sal_uInt16 nNewOffset = pE->nOffset + nTableWidth;
-                ModifyOffset( pS->pLocalColOffset, nOldOffset, nNewOffset, 
nOffsetTolerance );
+                ModifyOffset( pS->xLocalColOffset.get(), nOldOffset, 
nNewOffset, nOffsetTolerance );
                 sal_uInt16 nTmp = nNewOffset - pE->nOffset - pE->nWidth;
                 pE->nWidth = nNewOffset - pE->nOffset;
                 pS->nTableWidth = pS->nTableWidth + nTmp;
@@ -1374,7 +1369,7 @@ void ScHTMLLayoutParser::TableOff( const HtmlImportInfo* 
pInfo )
             nColOffsetStart = pS->nColOffsetStart;
             bFirstRow = pS->bFirstRow;
             xLockedList = pS->xLockedList;
-            pLocalColOffset = pS->pLocalColOffset;
+            xLocalColOffset = pS->xLocalColOffset;
             // mxActEntry is kept around if a table is started in the same row
             // (anything's possible in HTML); will be deleted by CloseEntry
             mxActEntry = pE;
@@ -1390,8 +1385,7 @@ void ScHTMLLayoutParser::TableOff( const HtmlImportInfo* 
pInfo )
         if ( !aTableStack.empty() )
         {
             ScHTMLTableStackEntry* pS = aTableStack.top().get();
-            delete pLocalColOffset;
-            pLocalColOffset = pS->pLocalColOffset;
+            xLocalColOffset = std::move(pS->xLocalColOffset);
             aTableStack.pop();
         }
     }
@@ -1504,7 +1498,7 @@ void ScHTMLLayoutParser::ColOn( HtmlImportInfo* pInfo )
         if( rOption.GetToken() == HtmlOptionId::WIDTH )
         {
             sal_uInt16 nVal = GetWidthPixel( rOption );
-            MakeCol( pLocalColOffset, nColOffset, nVal, 0, 0 );
+            MakeCol( xLocalColOffset.get(), nColOffset, nVal, 0, 0 );
             nColOffset = nColOffset + nVal;
         }
     }
diff --git a/sc/source/filter/inc/htmlpars.hxx 
b/sc/source/filter/inc/htmlpars.hxx
index 1ac9aa000225..7043c9176182 100644
--- a/sc/source/filter/inc/htmlpars.hxx
+++ b/sc/source/filter/inc/htmlpars.hxx
@@ -102,7 +102,7 @@ struct ScHTMLTableStackEntry
 {
     ScRangeListRef      xLockedList;
     std::shared_ptr<ScEEParseEntry> xCellEntry;
-    ScHTMLColOffset*    pLocalColOffset;
+    std::shared_ptr<ScHTMLColOffset> xLocalColOffset;
     sal_uLong           nFirstTableCell;
     SCROW               nRowCnt;
     SCCOL               nColCntStart;
@@ -113,14 +113,14 @@ struct ScHTMLTableStackEntry
     sal_uInt16          nColOffsetStart;
     bool                bFirstRow;
                         ScHTMLTableStackEntry( std::shared_ptr<ScEEParseEntry> 
xE,
-                                ScRangeListRef xL, ScHTMLColOffset* pTO,
+                                ScRangeListRef xL, 
std::shared_ptr<ScHTMLColOffset> xTO,
                                 sal_uLong nFTC,
                                 SCROW nRow,
                                 SCCOL nStart, SCCOL nMax, sal_uInt16 nTab,
                                 sal_uInt16 nTW, sal_uInt16 nCO, sal_uInt16 
nCOS,
                                 bool bFR )
                             : xLockedList(std::move( xL )), 
xCellEntry(std::move(xE)),
-                            pLocalColOffset( pTO ),
+                            xLocalColOffset( std::move(xTO) ),
                             nFirstTableCell( nFTC ),
                             nRowCnt( nRow ),
                             nColCntStart( nStart ), nMaxCol( nMax ),
@@ -162,7 +162,7 @@ private:
     ScRangeListRef      xLockedList;        // per table
     std::unique_ptr<OuterMap> pTables;
     ScHTMLColOffset     maColOffset;
-    ScHTMLColOffset*    pLocalColOffset;    // per table
+    std::shared_ptr<ScHTMLColOffset> xLocalColOffset;    // per table
     sal_uLong           nFirstTableCell;    // per table
     short               nTableLevel;
     sal_uInt16          nTable;
commit 59e5104ad5979160ff8b8273c68fd8fa142c40ae
Author:     Armin Le Grand (allotropia) <armin.le.grand.ext...@allotropia.de>
AuthorDate: Fri Jan 12 11:22:04 2024 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:02 2024 +0100

    tdf#158783 Correct compares of SwTOXMark Items
    
    That item was never 'pooled', so operator== was not really
    ever used. It just compared the 'type', so pretty many
    instances were assumed to be equal, what is wrong.
    We discussed to implement it (there is quite some content),
    but we came to the point that it's only safe to say
    instances are equal when same instance -> fallback to ptr
    compare.
    This came into play since I identified/changed many (160?)
    places where SfxPoolItems were ptr-compared when doing that
    paradigm change in Items. This leads to the two methods
    'areSfxPoolItemPtrsEqual' which just makes ptr compare and
    'SfxPoolItem::areSame' which also will use op==. For the
    initial adaption I chose the wrong function adapting
    places where SwTOXMark were involved.
    
    Change-Id: I7df029ad4542719681b1455de17ed5990d248395
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/161963
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    Tested-by: Armin Le Grand <armin.le.gr...@me.com>
    (cherry picked from commit d22a86089edfcadbef5231525a2947b954f4784e)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/164996
    Tested-by: Jenkins
    Reviewed-by: Adolfo Jayme Barrientos <fit...@ubuntu.com>

diff --git a/sw/source/core/tox/tox.cxx b/sw/source/core/tox/tox.cxx
index 04f43e5d41f8..b29bafde11f6 100644
--- a/sw/source/core/tox/tox.cxx
+++ b/sw/source/core/tox/tox.cxx
@@ -148,7 +148,13 @@ void SwTOXMark::RegisterToTOXType(SwTOXType& rType)
 bool SwTOXMark::operator==( const SfxPoolItem& rAttr ) const
 {
     assert(SfxPoolItem::operator==(rAttr));
-    return m_pType == static_cast<const SwTOXMark&>(rAttr).m_pType;
+    // tdf#158783 this item was never 'pooled', so operator== was not really
+    // ever used. We discussed to implement it (there is quite some
+    // content), but we came to the point that it's only safe to say
+    // instances are equal when same instance -> fallback to ptr compare.
+    // NOTE: Do *not* use areSfxPoolItemPtrsEqual here, with DBG_UTIL
+    //   active the contol/test code there would again call operator==
+    return this == &rAttr;
 }
 
 SwTOXMark* SwTOXMark::Clone( SfxItemPool* ) const
diff --git a/sw/source/ui/index/swuiidxmrk.cxx 
b/sw/source/ui/index/swuiidxmrk.cxx
index 39443f7e7b04..8a6f74b86ee8 100644
--- a/sw/source/ui/index/swuiidxmrk.cxx
+++ b/sw/source/ui/index/swuiidxmrk.cxx
@@ -287,19 +287,20 @@ void SwIndexMarkPane::InitControls()
         bool bShow = false;
 
         pMoveMark = &m_pSh->GotoTOXMark( *pMark, TOX_PRV );
-        if (!SfxPoolItem::areSame( pMoveMark, pMark ))
+        // tdf#158783 ptr compare OK for SwTOXMark (more below)
+        if (!areSfxPoolItemPtrsEqual( pMoveMark, pMark ))
         {
             m_pSh->GotoTOXMark( *pMoveMark, TOX_NXT );
             bShow = true;
         }
-        m_xPrevBT->set_sensitive(!SfxPoolItem::areSame(pMoveMark, pMark));
+        m_xPrevBT->set_sensitive(!areSfxPoolItemPtrsEqual(pMoveMark, pMark));
         pMoveMark = &m_pSh->GotoTOXMark( *pMark, TOX_NXT );
-        if (!SfxPoolItem::areSame( pMoveMark, pMark ))
+        if (!areSfxPoolItemPtrsEqual( pMoveMark, pMark ))
         {
             m_pSh->GotoTOXMark( *pMoveMark, TOX_PRV );
             bShow = true;
         }
-        m_xNextBT->set_sensitive(!SfxPoolItem::areSame(pMoveMark, pMark));
+        m_xNextBT->set_sensitive(!areSfxPoolItemPtrsEqual(pMoveMark, pMark));
         if( bShow )
         {
             m_xPrevBT->show();
@@ -308,19 +309,19 @@ void SwIndexMarkPane::InitControls()
         }
 
         pMoveMark = &m_pSh->GotoTOXMark( *pMark, TOX_SAME_PRV );
-        if (!SfxPoolItem::areSame( pMoveMark, pMark ))
+        if (!areSfxPoolItemPtrsEqual( pMoveMark, pMark ))
         {
             m_pSh->GotoTOXMark( *pMoveMark, TOX_SAME_NXT );
             bShow = true;
         }
-        m_xPrevSameBT->set_sensitive(!SfxPoolItem::areSame(pMoveMark, pMark));
+        m_xPrevSameBT->set_sensitive(!areSfxPoolItemPtrsEqual(pMoveMark, 
pMark));
         pMoveMark = &m_pSh->GotoTOXMark( *pMark, TOX_SAME_NXT );
-        if (!SfxPoolItem::areSame( pMoveMark, pMark ))
+        if (!areSfxPoolItemPtrsEqual( pMoveMark, pMark ))
         {
             m_pSh->GotoTOXMark( *pMoveMark, TOX_SAME_PRV );
             bShow = true;
         }
-        m_xNextSameBT->set_sensitive(!SfxPoolItem::areSame(pMoveMark, pMark));
+        m_xNextSameBT->set_sensitive(!areSfxPoolItemPtrsEqual(pMoveMark, 
pMark));
         if( bShow )
         {
             m_xNextSameBT->show();
@@ -894,25 +895,26 @@ void SwIndexMarkPane::UpdateDialog()
     if( m_xPrevBT->get_visible() )
     {
         const SwTOXMark* pMoveMark = &m_pSh->GotoTOXMark( *pMark, TOX_PRV );
-        if (!SfxPoolItem::areSame( pMoveMark, pMark ))
+        // tdf#158783 ptr compare OK for SwTOXMark (more below)
+        if (!areSfxPoolItemPtrsEqual( pMoveMark, pMark ))
             m_pSh->GotoTOXMark( *pMoveMark, TOX_NXT );
-        m_xPrevBT->set_sensitive( !SfxPoolItem::areSame(pMoveMark, pMark) );
+        m_xPrevBT->set_sensitive( !areSfxPoolItemPtrsEqual(pMoveMark, pMark) );
         pMoveMark = &m_pSh->GotoTOXMark( *pMark, TOX_NXT );
-        if (!SfxPoolItem::areSame( pMoveMark, pMark ))
+        if (!areSfxPoolItemPtrsEqual( pMoveMark, pMark ))
             m_pSh->GotoTOXMark( *pMoveMark, TOX_PRV );
-        m_xNextBT->set_sensitive( !SfxPoolItem::areSame(pMoveMark, pMark) );
+        m_xNextBT->set_sensitive( !areSfxPoolItemPtrsEqual(pMoveMark, pMark) );
     }
 
     if (m_xPrevSameBT->get_visible())
     {
         const SwTOXMark* pMoveMark = &m_pSh->GotoTOXMark( *pMark, TOX_SAME_PRV 
);
-        if (!SfxPoolItem::areSame( pMoveMark, pMark ))
+        if (!areSfxPoolItemPtrsEqual( pMoveMark, pMark ))
             m_pSh->GotoTOXMark( *pMoveMark, TOX_SAME_NXT );
-        m_xPrevSameBT->set_sensitive( !SfxPoolItem::areSame(pMoveMark, pMark) 
);
+        m_xPrevSameBT->set_sensitive( !areSfxPoolItemPtrsEqual(pMoveMark, 
pMark) );
         pMoveMark = &m_pSh->GotoTOXMark( *pMark, TOX_SAME_NXT );
-        if (!SfxPoolItem::areSame( pMoveMark, pMark ))
+        if (!areSfxPoolItemPtrsEqual( pMoveMark, pMark ))
             m_pSh->GotoTOXMark( *pMoveMark, TOX_SAME_PRV );
-        m_xNextSameBT->set_sensitive( !SfxPoolItem::areSame(pMoveMark, pMark) 
);
+        m_xNextSameBT->set_sensitive( !areSfxPoolItemPtrsEqual(pMoveMark, 
pMark) );
     }
 
     const bool bEnable = !m_pSh->HasReadonlySel();
@@ -1013,7 +1015,8 @@ void SwIndexMarkPane::ReInitDlg(SwWrtShell& rWrtShell, 
SwTOXMark const * pCurTOX
     if(pCurTOXMark)
     {
         for(sal_uInt16 i = 0; i < m_pTOXMgr->GetTOXMarkCount(); i++)
-            if (SfxPoolItem::areSame(m_pTOXMgr->GetTOXMark(i), pCurTOXMark))
+            // tdf#158783 ptr compare OK for SwTOXMark (more below)
+            if (areSfxPoolItemPtrsEqual(m_pTOXMgr->GetTOXMark(i), pCurTOXMark))
             {
                 m_pTOXMgr->SetCurTOXMark(i);
                 break;
diff --git a/sw/source/uibase/index/toxmgr.cxx 
b/sw/source/uibase/index/toxmgr.cxx
index 8b8ff6dbd8ec..c7cd813eb428 100644
--- a/sw/source/uibase/index/toxmgr.cxx
+++ b/sw/source/uibase/index/toxmgr.cxx
@@ -47,7 +47,8 @@ void SwTOXMgr::DeleteTOXMark()
     if( m_pCurTOXMark )
     {
         pNext = const_cast<SwTOXMark*>(&m_pSh->GotoTOXMark( *m_pCurTOXMark, 
TOX_NXT ));
-        if (SfxPoolItem::areSame( pNext, m_pCurTOXMark ))
+        // tdf#158783 ptr compare OK for SwTOXMark (more below)
+        if (areSfxPoolItemPtrsEqual( pNext, m_pCurTOXMark ))
             pNext = nullptr;
 
         m_pSh->DeleteTOXMark( m_pCurTOXMark );
commit 4265b4aa33fab019ffa3c5f92d30ee02fae06d3e
Author:     Michael Stahl <michael.st...@allotropia.de>
AuthorDate: Wed Mar 13 18:57:21 2024 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Mar 27 11:35:02 2024 +0100

    tdf#157241 sw: fix crash on RTF paste or insert of nested tables
    
    The problem is that there are tables with only empty cell frames in the
    layout, which causes a crash in IsAllHiddenCell() added in commit
    ab7893544dc6be6dc192dffefd57cd5ddd421c35.
    
    This happens because first inner tables are created, with layout frames
    because the layout already exists.
    
    Then when SwNodes::TextToTable() is called for the outer table, it
    deletes the SwTextFrames, but not the SwTabFrames/SwCellFrames, so they
    remain uselessly in the layout.
    
    Delete these too, they will be recreated when the frame for the outer
    table is created.
    
    Also the transfer of any existing break to the outer table was missing.
    
    Change-Id: Idc2bc1d4c6572702510ae4355e4015c42770eb3e
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/164788
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit 62cb3b8b8d6106c6aeb073b12d84973a107182ef)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/164813
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>

diff --git a/sw/source/core/docnode/ndtbl.cxx b/sw/source/core/docnode/ndtbl.cxx
index a7a2bee478da..d052ed7eda4b 100644
--- a/sw/source/core/docnode/ndtbl.cxx
+++ b/sw/source/core/docnode/ndtbl.cxx
@@ -888,6 +888,34 @@ const SwTable* SwDoc::TextToTable( const 
SwInsertTableOptions& rInsTableOpts,
     return &rNdTable;
 }
 
+static void lcl_RemoveBreaksTable(SwTableNode & rNode, SwTableFormat *const 
pTableFormat)
+{
+    // delete old layout frames, new ones need to be created...
+    rNode.DelFrames(nullptr);
+
+    // remove PageBreaks/PageDesc/ColBreak
+    SwFrameFormat & rFormat(*rNode.GetTable().GetFrameFormat());
+
+    if (const SvxFormatBreakItem* pItem = rFormat.GetItemIfSet(RES_BREAK, 
false))
+    {
+        if (pTableFormat)
+        {
+            pTableFormat->SetFormatAttr(*pItem);
+        }
-e 
... etc. - the rest is truncated

Reply via email to