diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2013-11-08 14:53:42 +0000 |
|---|---|---|
| committer | Michael Stahl <mstahl@redhat.com> | 2013-11-15 16:19:22 +0000 |
| commit | 7eae50f9ff5877ef880be9a85d3f7e52b1fec49f (patch) | |
| tree | 581fdca5b07cbad9f990a8363504e863357717d7 /sw/source/core/layout/ssfrm.cxx | |
| parent | 4edc3c0500acba23518ddc7c35f7aa81739b6b9b (diff) | |
Access by AnchoredObject of a deleted SwLayoutFrm
as demonstrated by abi10075-1.doc
just register the AnchoredObjects in the SwLayoutFrm and
inform them when the SwLayoutFrm goes away.
This crash was triggered by "1e113cb7604e1509e7d598a9be329f1f7b6e9322" import
different first page header/footer from doc. But that commit is blameless.
Change-Id: Ia079cc635a81dff1ccbf740641f441aa784328a4
(cherry picked from commit b376eacdfae11f5d39eb7011efe67390d9f495e7)
Reviewed-on: https://gerrit.libreoffice.org/6622
Reviewed-by: Michael Stahl <mstahl@redhat.com>
Tested-by: Michael Stahl <mstahl@redhat.com>
Diffstat (limited to 'sw/source/core/layout/ssfrm.cxx')
| -rw-r--r-- | sw/source/core/layout/ssfrm.cxx | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/sw/source/core/layout/ssfrm.cxx b/sw/source/core/layout/ssfrm.cxx index 4ae962ef751b..1fc5ff0fdcf3 100644 --- a/sw/source/core/layout/ssfrm.cxx +++ b/sw/source/core/layout/ssfrm.cxx @@ -557,6 +557,14 @@ void SwCntntFrm::DelFrms( const SwCntntNode& rNode ) void SwLayoutFrm::Destroy() { + while (!aVertPosOrientFrmsFor.empty()) + { + SwAnchoredObject *pObj = *aVertPosOrientFrmsFor.begin(); + pObj->ClearVertPosOrientFrm(); + } + + assert(aVertPosOrientFrmsFor.empty()); + SwFrm *pFrm = pLower; if( GetFmt() && !GetFmt()->GetDoc()->IsInDtor() ) |