commit c5e8780391acb1f9fd72f8956438a79dfa64ca53
author Michael Stahl <Michael.Stahl@cib.de> Thu Jun 27 13:04:51 2019 +0200
committer Thorsten Behrens <Thorsten.Behrens@CIB.de> Sat Jun 29 02:46:57 2019 +0200
tree 51de583ea287582b0b33303b3af4b72e259b8f6d
parent cb1c5ae7af997d7643da97235caf95789ba09416

sw: avoid deleting the iterated SwRowFrame on tdf104188-4.odt

The change in commit 1e6dec4b4313212a3bdc6bb06155fd65e795368b
was not enough to fix this problem.

SwContentFrame::CalcLowers() may move a SwTextFrame to the previous
page; in that case Calc() on the upper is a bad idea because it may then
call RemoveFollowFlowLine() and delete the SwRowFrame that is being
iterated.

There is one other (unknown) bugdoc with this problem, let's hope it's
fixed as well...

(regression from commit 18765b9fa739337d2d891513f6e2fb7c3ce23b50)

Change-Id: I3c55a0d7ef0350a482fb150d3e96c3b34853400d
Reviewed-on: https://gerrit.libreoffice.org/74793
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl@cib.de>
(cherry picked from commit 1cb7e4899b5ada902e99a0c964ee047950c07044)
Reviewed-on: https://gerrit.libreoffice.org/74835
Reviewed-by: Thorsten Behrens <Thorsten.Behrens@CIB.de>

sw/source/core/inc/cntfrm.hxx

diff --git a/sw/source/core/inc/cntfrm.hxx b/sw/source/core/inc/cntfrm.hxx
index aa28f58..998cf2e 100644
--- a/sw/source/core/inc/cntfrm.hxx
+++ b/sw/source/core/inc/cntfrm.hxx
@@ -92,7 +92,8 @@

    inline  SwContentFrame* GetNextContentFrame() const;
    inline  SwContentFrame* GetPrevContentFrame() const;
    static bool CalcLowers( SwLayoutFrame* pLay, const SwLayoutFrame* pDontLeave, long nBottom, bool bSkipRowSpanCells );
    static bool CalcLowers(SwLayoutFrame & rLay, SwLayoutFrame const& rDontLeave,
            long nBottom, bool bSkipRowSpanCells);
};

inline SwContentFrame* SwContentFrame::GetNextContentFrame() const

sw/source/core/layout/tabfrm.cxx

diff --git a/sw/source/core/layout/tabfrm.cxx b/sw/source/core/layout/tabfrm.cxx
index 694e1b7..141bc7e 100644
--- a/sw/source/core/layout/tabfrm.cxx
+++ b/sw/source/core/layout/tabfrm.cxx
@@ -1461,25 +1461,22 @@
    }
}

bool SwContentFrame::CalcLowers( SwLayoutFrame* pLay, const SwLayoutFrame* pDontLeave,
bool SwContentFrame::CalcLowers(SwLayoutFrame & rLay, SwLayoutFrame const& rDontLeave,
                                 long nBottom, bool bSkipRowSpanCells )
{
    if ( !pLay )
        return true;

    vcl::RenderContext* pRenderContext = pLay->getRootFrame()->GetCurrShell()->GetOut();
    vcl::RenderContext* pRenderContext = rLay.getRootFrame()->GetCurrShell()->GetOut();
    // LONG_MAX == nBottom means we have to calculate all
    bool bAll = LONG_MAX == nBottom;
    bool bRet = false;
    SwContentFrame *pCnt = pLay->ContainsContent();
    SwRectFnSet aRectFnSet(pLay);
    SwContentFrame *pCnt = rLay.ContainsContent();
    SwRectFnSet aRectFnSet(&rLay);

    // FME 2007-08-30 #i81146# new loop control
    int nLoopControlRuns = 0;
    const int nLoopControlMax = 10;
    const SwModify* pLoopControlCond = nullptr;

    while ( pCnt && pDontLeave->IsAnLower( pCnt ) )
    while (pCnt && rDontLeave.IsAnLower(pCnt))
    {
        // #115759# - check, if a format of content frame is
        // possible. Thus, 'copy' conditions, found at the beginning of
@@ -1535,7 +1532,7 @@
                    if ( nLoopControlRuns < nLoopControlMax )
                    {
                        // restart format with first content
                        pCnt = pLay->ContainsContent();
                        pCnt = rLay.ContainsContent();
                        continue;
                    }

@@ -1544,6 +1541,11 @@
#endif
                }
            }
            if (!rDontLeave.IsAnLower(pCnt)) // moved backward?
            {
                pCnt = rLay.ContainsContent();
                continue; // avoid formatting new upper on different page
            }
            pCnt->GetUpper()->Calc(pRenderContext);
        }
        if( ! bAll && aRectFnSet.YDiff(aRectFnSet.GetTop(pCnt->getFrameArea()), nBottom) > 0 )
@@ -1599,7 +1601,7 @@
    return bRet;
}

static void lcl_RecalcRow( SwRowFrame* pRow, long nBottom )
static void lcl_RecalcRow(SwRowFrame *const pRow, long const nBottom)
{
    // FME 2007-08-30 #i81146# new loop control
    int nLoopControlRuns_1 = 0;
@@ -1639,7 +1641,7 @@
            OSL_ENSURE(pOriginalRow->GetUpper() && pOriginalRow->GetUpper()->IsTabFrame(), "No table");
            SwTabFrame* pOriginalTab = static_cast<SwTabFrame*>(pRow->GetUpper());

            bCheck = SwContentFrame::CalcLowers( pRow, pRow->GetUpper(), nBottom, true );
            bCheck = SwContentFrame::CalcLowers(*pRow, *pRow->GetUpper(), nBottom, true);

            bool bRowStillExists = false;
            SwFrame* pTestRow = pOriginalTab->Lower();
@@ -1677,7 +1679,7 @@
                        SwCellFrame& rToRecalc = 0 == i ?
                                               const_cast<SwCellFrame&>(pCellFrame->FindStartEndOfRowSpanCell( true )) :
                                               *pCellFrame;
                        bCheck  |= SwContentFrame::CalcLowers( &rToRecalc, &rToRecalc, nBottom, false );
                        bCheck |= SwContentFrame::CalcLowers(rToRecalc, rToRecalc, nBottom, false);
                    }

                    pCellFrame = static_cast<SwCellFrame*>(pCellFrame->GetNext());