-
Stephan Bergmann yazdı
...as nFrmType need not match pTmpFrm->GetType() exactly, but can e.g. be USHORT_MAX when GetFrmOfModify is called from SwFrmFmt::FindLayoutRect (sw/source/core/layout/atrfrm.cxx). It is probably good luck that the two comparisons against FAR_AWAY made it too unlikely for the if's true branch to ever be taken for a pTmpFrm that is not actually a SwFlyFrm. Found the bug when running CppunitTest_sw_ooxmlexport2 under -fsanitize=undefined, where ((SwFlyFrm*)pTmpFrm)->GetAnchorFrm() was called for a pTmpFrm of type SwTabFrm. Change-Id: Ia886a809bdb82488c3f410be66cf827b3f723c55
98fba3ab