commit a9fce4cd52c880a0024fb3c921110a1da5400972
author Michael Stahl <Michael.Stahl@cib.de> Tue Jun 25 14:11:46 2019 +0200
committer Xisco Faulí <xiscofauli@libreoffice.org> Wed Jun 26 09:18:04 2019 +0200
tree 2e683e4077cca7db78625d4ca2ecdb2a81b17218
parent 861ee491b0bf3ca1c18336924017911a1823cc31

tdf#126017 sw: do not restore SwFormatContent in SwUndoFormatAttr

This is a very unusual item that only contains a SwNodeIndex, which may
"go stale" because the node it's pointing to may be deleted, moving it
to whatever node may be next.  Restoring such a moved item causes
crashes like this, where the SwSectionFormat's item does not point to
its SwSectionNode.

(crash is a regression from 4f0b568ef35353b276ae560fb43502b6f6b2bfdb,
 previously the Undo stack was cleared so you couldn't Undo)

Change-Id: I41a9ed9acc72df5b4b3852875a50e51c29eabe95
Reviewed-on: https://gerrit.libreoffice.org/74693
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl@cib.de>
(cherry picked from commit 4999c99529f1b1543ef110da9e6c0dcbd9f73032)
Reviewed-on: https://gerrit.libreoffice.org/74715
Reviewed-by: Xisco Faulí <xiscofauli@libreoffice.org>

sw/source/core/undo/unattr.cxx

diff --git a/sw/source/core/undo/unattr.cxx b/sw/source/core/undo/unattr.cxx
index ff54f61..e389d43 100644
--- a/sw/source/core/undo/unattr.cxx
+++ b/sw/source/core/undo/unattr.cxx
@@ -128,6 +128,8 @@ SwUndoFormatAttr::SwUndoFormatAttr( const SfxPoolItem& rItem, SwFormat& rChgForm

void SwUndoFormatAttr::Init()
{
    // tdf#126017 never save SwNodeIndex, it will go stale
    m_pOldSet->ClearItem(RES_CNTNT);
    // treat change of anchor specially
    if ( SfxItemState::SET == m_pOldSet->GetItemState( RES_ANCHOR, false )) {
        SaveFlyAnchor( m_bSaveDrawPt );
@@ -353,6 +355,10 @@ SwRewriter SwUndoFormatAttr::GetRewriter() const

void SwUndoFormatAttr::PutAttr( const SfxPoolItem& rItem )
{
    if (RES_CNTNT == rItem.Which())
    {
        return; // tdf#126017 never save SwNodeIndex, it will go stale
    }
    m_pOldSet->Put( rItem );
    if ( RES_ANCHOR == rItem.Which() ) {
        SaveFlyAnchor( m_bSaveDrawPt );