Resolves: rhbz#1582324 crash after merging writer table cells

0001-tdf-117601-a11y-crash-after-merging-cells.patch

@@ -0,0 +1,80 @@
+From 47b299c7de49edd3bddd743d6d9bdcf49a09ec39 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Fri, 25 May 2018 14:37:03 +0100
+Subject: [PATCH] tdf#117601 a11y crash after merging cells
+
+this is similar to tdf#87199, in this case the accessibiles for the merged
+cells are not visible so not removed when their frame is deleted, but remain
+in the cache pointing to invalid frames.
+
+Change-Id: Ibc5b9f27541683b8f3604839fa3d1431380a4039
+---
+ sw/inc/accmap.hxx                    |  3 +++
+ sw/source/core/access/acccontext.cxx |  6 +++++-
+ sw/source/core/access/accmap.cxx     | 11 ++++++++---
+ 3 files changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/sw/inc/accmap.hxx b/sw/inc/accmap.hxx
+index fc7f665da383..c78bea3e0e51 100644
+--- a/sw/inc/accmap.hxx
++++ b/sw/inc/accmap.hxx
+@@ -277,6 +277,9 @@ public:
+     Point PixelToCore (const Point& rPoint) const;
+     tools::Rectangle CoreToPixel (const tools::Rectangle& rRect) const;
+ 
++    // is there a known accessibility impl cached for the frame
++    bool Contains(const SwFrame *pFrame) const;
++
+ private:
+     /** get mapping mode for LogicToPixel and PixelToLogic conversions
+ 
+diff --git a/sw/source/core/access/acccontext.cxx b/sw/source/core/access/acccontext.cxx
+index 628ad727dc47..efb6b415d372 100644
+--- a/sw/source/core/access/acccontext.cxx
++++ b/sw/source/core/access/acccontext.cxx
+@@ -402,8 +402,12 @@ void SwAccessibleContext::DisposeChildren(const SwFrame *pFrame,
+         if( pLower )
+         {
+             ::rtl::Reference< SwAccessibleContext > xAccImpl;
+-            if( rLower.IsAccessible( GetShell()->IsPreview() ) )
++            if (rLower.IsAccessible(GetShell()->IsPreview())
++                       // tdf#117601 dispose the darn thing if it ever was accessible
++                    || GetMap()->Contains(pLower))
++            {
+                 xAccImpl = GetMap()->GetContextImpl( pLower, false );
++            }
+             if( xAccImpl.is() )
+                 xAccImpl->Dispose( bRecursive );
+             else
+diff --git a/sw/source/core/access/accmap.cxx b/sw/source/core/access/accmap.cxx
+index 712b70873507..43cc0974625e 100644
+--- a/sw/source/core/access/accmap.cxx
++++ b/sw/source/core/access/accmap.cxx
+@@ -2158,6 +2158,11 @@ void SwAccessibleMap::RemoveContext( const SdrObject *pObj )
+     }
+ }
+ 
++bool SwAccessibleMap::Contains(const SwFrame *pFrame) const
++{
++    return (pFrame && mpFrameMap && mpFrameMap->find(pFrame) != mpFrameMap->end());
++}
++
+ void SwAccessibleMap::A11yDispose( const SwFrame *pFrame,
+                                    const SdrObject *pObj,
+                                    vcl::Window* pWindow,
+@@ -2173,9 +2178,9 @@ void SwAccessibleMap::A11yDispose( const SwFrame *pFrame,
+     OSL_ENSURE( !aFrameOrObj.GetSwFrame() || aFrameOrObj.GetSwFrame()->IsAccessibleFrame(),
+             "non accessible frame should be disposed" );
+ 
+-    if (aFrameOrObj.IsAccessible( GetShell()->IsPreview() )
+-            // fdo#87199 dispose the darn thing if it ever was accessible
+-        || (pFrame && mpFrameMap && mpFrameMap->find(pFrame) != mpFrameMap->end()))
++    if (aFrameOrObj.IsAccessible(GetShell()->IsPreview())
++               // fdo#87199 dispose the darn thing if it ever was accessible
++            || Contains(pFrame))
+     {
+         ::rtl::Reference< SwAccessibleContext > xAccImpl;
+         ::rtl::Reference< SwAccessibleContext > xParentAccImpl;
+-- 
+2.14.3
+

libreoffice.spec

@@ -62,7 +62,7 @@ Summary:        Free Software Productivity Suite
 Name:           libreoffice
 Epoch:          1
 Version:        %{libo_version}.2
-Release:        1%{?libo_prerelease}%{?dist}
+Release:        2%{?libo_prerelease}%{?dist}
 License:        (MPLv1.1 or LGPLv3+) and LGPLv3 and LGPLv2+ and BSD and (MPLv1.1 or GPLv2 or LGPLv2 or Netscape) and Public Domain and ASL 2.0 and MPLv2.0 and CC0
 URL:            http://www.libreoffice.org/
 
@@ -277,6 +277,7 @@ Patch9: 0001-Resolves-tdf-116951-rhbz-1569331-start-is-G_MAXINT.patch
 Patch10: 0001-set-Referer-on-link-mediadescriptor.patch
 Patch11: 0001-Resolves-tdf-117413-char-doubling-appearing-under-X-.patch
 Patch12: 0001-Missing-template-clone-in-configmgr-dconf-mode.patch
+Patch13: 0001-tdf-117601-a11y-crash-after-merging-cells.patch
 
 %if 0%{?rhel}
 # not upstreamed
@@ -2325,6 +2326,9 @@ done
 %{_includedir}/LibreOfficeKit
 
 %changelog
+* Mon May 28 2018 Caolán McNamara <caolanm@redhat.com> - 1:6.0.4.2-2
+- Resolves: rhbz#1582324 crash after merging writer table cells
+
 * Fri May 25 2018 Caolán McNamara <caolanm@redhat.com> - 1:6.0.4.2-1
 - latest 6.0 release