commit 1cb7e4899b5ada902e99a0c964ee047950c07044
author Michael Stahl <Michael.Stahl@cib.de> Thu Jun 27 13:04:51 2019 +0200
committer Michael Stahl <Michael.Stahl@cib.de> Thu Jun 27 15:04:15 2019 +0200
tree b3db27ca9748967bb1b1d240965233842e1637d1
parent ef801197fcad9461390806a9fb42dd4566e55918

sw: avoid deleting the iterated SwRowFrame on tdf104188-4.odt

The change in commit 1e6dec4b4313212a3bdc6bb06155fd65e795368b
was not enough to fix this problem.

SwContentFrame::CalcLowers() may move a SwTextFrame to the previous
page; in that case Calc() on the upper is a bad idea because it may then
call RemoveFollowFlowLine() and delete the SwRowFrame that is being
iterated.

There is one other (unknown) bugdoc with this problem, let's hope it's
fixed as well...

(regression from commit 18765b9fa739337d2d891513f6e2fb7c3ce23b50)

Change-Id: I3c55a0d7ef0350a482fb150d3e96c3b34853400d
Reviewed-on: https://gerrit.libreoffice.org/74793
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl@cib.de>

sw/source/core/inc/cntfrm.hxx

diff --git a/sw/source/core/inc/cntfrm.hxx b/sw/source/core/inc/cntfrm.hxx
index 4e57c41..5269384 100644
--- a/sw/source/core/inc/cntfrm.hxx
+++ b/sw/source/core/inc/cntfrm.hxx
@@ -91,7 +91,8 @@

    inline  SwContentFrame* GetNextContentFrame() const;
    inline  SwContentFrame* GetPrevContentFrame() const;
    static bool CalcLowers( SwLayoutFrame* pLay, const SwLayoutFrame* pDontLeave, long nBottom, bool bSkipRowSpanCells );
    static bool CalcLowers(SwLayoutFrame & rLay, SwLayoutFrame const& rDontLeave,
            long nBottom, bool bSkipRowSpanCells);
};

inline SwContentFrame* SwContentFrame::GetNextContentFrame() const

sw/source/core/layout/tabfrm.cxx

diff --git a/sw/source/core/layout/tabfrm.cxx b/sw/source/core/layout/tabfrm.cxx
index 5eea09d..0937a89 100644
--- a/sw/source/core/layout/tabfrm.cxx
+++ b/sw/source/core/layout/tabfrm.cxx
@@ -1465,25 +1465,22 @@
    }
}

bool SwContentFrame::CalcLowers( SwLayoutFrame* pLay, const SwLayoutFrame* pDontLeave,
bool SwContentFrame::CalcLowers(SwLayoutFrame & rLay, SwLayoutFrame const& rDontLeave,
                                 long nBottom, bool bSkipRowSpanCells )
{
    if ( !pLay )
        return true;

    vcl::RenderContext* pRenderContext = pLay->getRootFrame()->GetCurrShell()->GetOut();
    vcl::RenderContext* pRenderContext = rLay.getRootFrame()->GetCurrShell()->GetOut();
    // LONG_MAX == nBottom means we have to calculate all
    bool bAll = LONG_MAX == nBottom;
    bool bRet = false;
    SwContentFrame *pCnt = pLay->ContainsContent();
    SwRectFnSet aRectFnSet(pLay);
    SwContentFrame *pCnt = rLay.ContainsContent();
    SwRectFnSet aRectFnSet(&rLay);

    // FME 2007-08-30 #i81146# new loop control
    int nLoopControlRuns = 0;
    const int nLoopControlMax = 10;
    const SwModify* pLoopControlCond = nullptr;

    while ( pCnt && pDontLeave->IsAnLower( pCnt ) )
    while (pCnt && rDontLeave.IsAnLower(pCnt))
    {
        // #115759# - check, if a format of content frame is
        // possible. Thus, 'copy' conditions, found at the beginning of
@@ -1539,7 +1536,7 @@
                    if ( nLoopControlRuns < nLoopControlMax )
                    {
                        // restart format with first content
                        pCnt = pLay->ContainsContent();
                        pCnt = rLay.ContainsContent();
                        continue;
                    }

@@ -1548,6 +1545,11 @@
#endif
                }
            }
            if (!rDontLeave.IsAnLower(pCnt)) // moved backward?
            {
                pCnt = rLay.ContainsContent();
                continue; // avoid formatting new upper on different page
            }
            pCnt->GetUpper()->Calc(pRenderContext);
        }
        if( ! bAll && aRectFnSet.YDiff(aRectFnSet.GetTop(pCnt->getFrameArea()), nBottom) > 0 )
@@ -1603,7 +1605,7 @@
    return bRet;
}

static void lcl_RecalcRow( SwRowFrame* pRow, long nBottom )
static void lcl_RecalcRow(SwRowFrame *const pRow, long const nBottom)
{
    // FME 2007-08-30 #i81146# new loop control
    int nLoopControlRuns_1 = 0;
@@ -1643,7 +1645,7 @@
            OSL_ENSURE(pOriginalRow->GetUpper() && pOriginalRow->GetUpper()->IsTabFrame(), "No table");
            SwTabFrame* pOriginalTab = static_cast<SwTabFrame*>(pRow->GetUpper());

            bCheck = SwContentFrame::CalcLowers( pRow, pRow->GetUpper(), nBottom, true );
            bCheck = SwContentFrame::CalcLowers(*pRow, *pRow->GetUpper(), nBottom, true);

            bool bRowStillExists = false;
            SwFrame* pTestRow = pOriginalTab->Lower();
@@ -1682,7 +1684,7 @@
                        SwCellFrame& rToRecalc = 0 == i ?
                                               const_cast<SwCellFrame&>(pCellFrame->FindStartEndOfRowSpanCell( true )) :
                                               *pCellFrame;
                        bCheck  |= SwContentFrame::CalcLowers( &rToRecalc, &rToRecalc, nBottom, false );
                        bCheck |= SwContentFrame::CalcLowers(rToRecalc, rToRecalc, nBottom, false);
                    }

                    pCellFrame = static_cast<SwCellFrame*>(pCellFrame->GetNext());