sw/source/uibase/utlui/navipi.cxx | 13 ++++++++----- vcl/source/app/salvtables.cxx | 7 ++++++- 2 files changed, 14 insertions(+), 6 deletions(-)
New commits: commit e3d2df964dc62af46a9da391b770f8f3385d260a Author: Andras Timar <[email protected]> AuthorDate: Thu Feb 26 14:46:45 2026 +0100 Commit: Miklos Vajna <[email protected]> CommitDate: Fri Feb 27 09:46:50 2026 +0100 Fix SIGSEGV in SalInstanceEntry::set_text() on disposed Edit widget Guard against calling SetText() on a disposed VCL Edit widget whose mpWindowImpl has been reset to null. This crash was observed in COOL multi-view scenarios where Navigator/QuickFind commands from multiple sessions caused the underlying VCL widget to be disposed while weld wrappers still held references to it. - Add isDisposed() check in SalInstanceEntry::set_text() - Move binding listener disposal before widget destruction in SwNavigationPI destructor to prevent NotifyItemUpdate() from firing on already-destroyed weld wrappers - Add null check on m_xGotoPageSpinButton in NotifyItemUpdate() Change-Id: Iff8d9f2d0d1a7fffdf99ddb21efb79e264bbae64 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/200435 Tested-by: Jenkins CollaboraOffice <[email protected]> Reviewed-by: Miklos Vajna <[email protected]> diff --git a/sw/source/uibase/utlui/navipi.cxx b/sw/source/uibase/utlui/navipi.cxx index 11b732114acb..0c47e4a471d5 100644 --- a/sw/source/uibase/utlui/navipi.cxx +++ b/sw/source/uibase/utlui/navipi.cxx @@ -849,6 +849,12 @@ SwNavigationPI::~SwNavigationPI() EndListening(*SfxGetpApp()); + // disconnect binding listeners before destroying widgets, so that + // NotifyItemUpdate() can't be called on already-destroyed weld wrappers + m_aDocFullName.dispose(); + m_aPageStats.dispose(); + m_aNavElement.dispose(); + if (m_oObjectShell) { if (m_oObjectShell->Is()) @@ -874,10 +880,6 @@ SwNavigationPI::~SwNavigationPI() m_xContent4ToolBox.reset(); m_xContent5ToolBox.reset(); m_xContent6ToolBox.reset(); - - m_aDocFullName.dispose(); - m_aPageStats.dispose(); - m_aNavElement.dispose(); } void SwNavigationPI::NotifyItemUpdate(sal_uInt16 nSID, SfxItemState /*eState*/, @@ -920,7 +922,8 @@ void SwNavigationPI::NotifyItemUpdate(sal_uInt16 nSID, SfxItemState /*eState*/, break; SwVisiblePageNumbers aVisiblePageNumbers; rSh.GetFirstLastVisPageNumbers(aVisiblePageNumbers, *pView); - m_xGotoPageSpinButton->set_text(OUString::number(aVisiblePageNumbers.nFirstPhy)); + if (m_xGotoPageSpinButton) + m_xGotoPageSpinButton->set_text(OUString::number(aVisiblePageNumbers.nFirstPhy)); } } } diff --git a/vcl/source/app/salvtables.cxx b/vcl/source/app/salvtables.cxx index cbae738545ad..26b3771eef00 100644 --- a/vcl/source/app/salvtables.cxx +++ b/vcl/source/app/salvtables.cxx @@ -3293,7 +3293,12 @@ SalInstanceEntry::SalInstanceEntry(Edit* pEntry, SalInstanceBuilder* pBuilder, b m_xEntry->SetTextFilter(&m_aTextFilter); } -void SalInstanceEntry::do_set_text(const OUString& rText) { m_xEntry->SetText(rText); } +void SalInstanceEntry::do_set_text(const OUString& rText) +{ + if (m_xEntry->isDisposed()) + return; + m_xEntry->SetText(rText); +} OUString SalInstanceEntry::get_text() const { return m_xEntry->GetText(); }
