From f91a2789c385af25310ac5f0463d5bb3311ec089 Mon Sep 17 00:00:00 2001
From: Eskil Abrahamsen Blomfeldt <eblomfel@trolltech.com>
Date: Wed, 7 Jul 2010 16:06:11 +0200
Subject: Fix crash when removing columns in merged row

Change 4b709b41f5a7ae8dc6e537b644158f5201ce0a98 tried to make sure that
rows with merged cells would not be completely removed, as this would
cause a crash. However, when removing just a few columns from a merged
cell, the span of the cell should be reduced by the number of columns
removed. The "touched" guard would cause the span to be decreased a
maximum of one time, regardless of how many columns were removed,
leaving the table in an invalid state, as the column count would be
smaller than the span of the cell. This would assert later on.
To avoid this, we only guard against removal, not against decreasing
the span.

Task-number: QTBUG-11646
Reviewed-by: Thomas Zander
---
 src/gui/text/qtexttable.cpp              |  7 ++++---
 tests/auto/qtexttable/tst_qtexttable.cpp | 14 ++++++++++++++
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/src/gui/text/qtexttable.cpp b/src/gui/text/qtexttable.cpp
index 5100176..ada18c8 100644
--- a/src/gui/text/qtexttable.cpp
+++ b/src/gui/text/qtexttable.cpp
@@ -915,12 +915,13 @@ void QTextTable::removeColumns(int pos, int num)
     for (int r = 0; r < d->nRows; ++r) {
         for (int c = pos; c < pos + num; ++c) {
             int cell = d->grid[r*d->nCols + c];
-            if (touchedCells.contains(cell))
-                continue;
-            touchedCells << cell;
             QTextDocumentPrivate::FragmentIterator it(&p->fragmentMap(), cell);
             QTextCharFormat fmt = collection->charFormat(it->format);
             int span = fmt.tableCellColumnSpan();
+            if (touchedCells.contains(cell) && span <= 1)
+                continue;
+            touchedCells << cell;
+
             if (span > 1) {
                 fmt.setTableCellColumnSpan(span - 1);
                 p->setCharFormat(it.position(), 1, fmt);
diff --git a/tests/auto/qtexttable/tst_qtexttable.cpp b/tests/auto/qtexttable/tst_qtexttable.cpp
index 2e6007e..c6ead5a 100644
--- a/tests/auto/qtexttable/tst_qtexttable.cpp
+++ b/tests/auto/qtexttable/tst_qtexttable.cpp
@@ -93,6 +93,7 @@ private slots:
     void removeColumns3();
     void removeColumns4();
     void removeColumns5();
+	void removeColumnsInTableWithMergedRows();
 
 private:
     QTextTable *create2x2Table();
@@ -931,5 +932,18 @@ void tst_QTextTable::removeColumns5()
     QCOMPARE(table->cellAt(3, 2).firstPosition(), 11);
 }
 
+void tst_QTextTable::removeColumnsInTableWithMergedRows()
+{
+    QTextTable *table = cursor.insertTable(3, 4);
+    table->mergeCells(0, 0, 1, 4);
+    QCOMPARE(table->rows(), 3);
+    QCOMPARE(table->columns(), 4);
+
+    table->removeColumns(0, table->columns() - 1);
+
+    QCOMPARE(table->rows(), 3);
+    QCOMPARE(table->columns(), 1);
+}
+
 QTEST_MAIN(tst_QTextTable)
 #include "tst_qtexttable.moc"
-- 
cgit v0.12