Hi all,
I can now narrow down the error somewhat.
Look at method SwTextFrame::FormatImpl() in
https://opengrok.libreoffice.org/xref/core/sw/source/core/text/frmform.cxx?r=7d7ca347#1832
It creates
SwTextFormatInfo aInf( pRenderContext, this );
Later down in the for-loop, aInf is used. The for-loop iterates over
pObj = aInf.GetTextFly().GetAnchoredObjList()
and performs
aInf.GetTextFly().AnchoredObjToRect(pObj, aRect)
AnchoredObjToRect crashes then because of an invalid pObj.
You see the AnchoredObjList with these steps:
aInf > SwTextPaintInfo > m_aTextFly > mpAnchoredObjList
When aInf is created, mpAnchoredObjList is empty.
After line #1863
Format_( aLine, aInf );
you can see the invalid item in that list.
This happens not always. When you use the example file of the bug
report, first the text of the shape inside the group is handled. That
works. Then the line where the group is anchored is handled. And there
it happens.
If the inline anchored object is not a group but a simple shape with
text, first the line is handled and then the text of the shape.
Next I have examined Format_( aLine, aInf ) for the crash case. It is
void SwTextFrame::Format_( SwTextFormatter &rLine, SwTextFormatInfo
&rInf const bool bAdjust )
in
https://opengrok.libreoffice.org/xref/core/sw/source/core/text/frmform.cxx?r=7d7ca347#1431
Here watch parameter rInf.
It is OK till #1671. After line #1672
bFormat = FormatLine( rLine, bPrev );
rInf has the invalid object. That is surprising. The method does no have
rInf as parameter.
This method is
bool SwTextFrame::FormatLine( SwTextFormatter &rLine, const bool bPrev )
in
https://opengrok.libreoffice.org/xref/core/sw/source/core/text/frmform.cxx?r=7d7ca347#1296
The adding of the faulty object happens there in #1672
in bFormat = FormatLine( rLine, bPrev );
That method is
bool SwTextFrame::FormatLine( SwTextFormatter &rLine, const bool
bPrev )
in
https://opengrok.libreoffice.org/xref/core/sw/source/core/text/frmform.cxx?r=7d7ca347#1296
And there I'm now. I have no idea, how something there changes the
parameter rInfo of SwTextFrame::Format_().
And I still do not know, which object is really needed in the above
mentioned for-loop.
And I still don't know, whether the problem would be solved, when
somehow first the line and then the group would be handled.
I appreciate any help.
Kind regards,
Regina
Regina Henschel schrieb am 11.12.2023 um 03:15:
Hi all,
I need help for bug 158451. Problem: A group or a drawing canvas in a
docx file crashes Writer, in case it is anchored 'inline' and has a
child shape with text. The crash happens in
SwAnchoredObject::GetObjRectWithSpaces(). There is no crash, if such
group is in an odt file.
It is not a new problem, but it will effect more users now, because the
drawing canvas and not the VML fallback is imported now and the drawing
canvas is anchored 'inline' as default in Word.
Steps before the crash are
SwTextFormatter::NewPortion()
SwTextFormatter::CalcFlyWidth()
SwTextFly::GetFrame()
SwTextFly::ForEach()
SwAnchoredObject::GetObjRectWithSpaces()
I think the crash should be fixed till release, but I'm not familiar
with these frames. Do you have tips for me?
Do you have an idea why a group from docx is different from a group from
odt, for example?
Attila Bakos had worked in that area, but NISZ does no longer exist.
Kind regards,
Regina
