sw: avoid deleting the iterated SwRowFrame on tdf104188-4.odt

The change in commit 1e6dec4b4313212a3bdc6bb06155fd65e795368b
was not enough to fix this problem.

SwContentFrame::CalcLowers() may move a SwTextFrame to the previous
page; in that case Calc() on the upper is a bad idea because it may then
call RemoveFollowFlowLine() and delete the SwRowFrame that is being
iterated.

There is one other (unknown) bugdoc with this problem, let's hope it's
fixed as well...

(regression from commit 18765b9fa739337d2d891513f6e2fb7c3ce23b50)

Change-Id: I3c55a0d7ef0350a482fb150d3e96c3b34853400d
Reviewed-on: https://gerrit.libreoffice.org/74793
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl@cib.de>

2 files changed, 16 insertions, 13 deletions

diff --git a/sw/source/core/inc/cntfrm.hxx b/sw/source/core/inc/cntfrm.hxx
index 4e57c4142ee3..526938433267 100644
--- a/sw/source/core/inc/cntfrm.hxx
+++ b/sw/source/core/inc/cntfrm.hxx
@@ -91,7 +91,8 @@ public:
 
     inline  SwContentFrame* GetNextContentFrame() const;
     inline  SwContentFrame* GetPrevContentFrame() const;
-    static bool CalcLowers( SwLayoutFrame* pLay, const SwLayoutFrame* pDontLeave, long nBottom, bool bSkipRowSpanCells );
+    static bool CalcLowers(SwLayoutFrame & rLay, SwLayoutFrame const& rDontLeave,
+            long nBottom, bool bSkipRowSpanCells);
 };
 
 inline SwContentFrame* SwContentFrame::GetNextContentFrame() const
diff --git a/sw/source/core/layout/tabfrm.cxx b/sw/source/core/layout/tabfrm.cxx
index 5eea09dd55f7..0937a8920023 100644
--- a/sw/source/core/layout/tabfrm.cxx
+++ b/sw/source/core/layout/tabfrm.cxx
@@ -1465,25 +1465,22 @@ static void lcl_InvalidateAllLowersPrt( SwLayoutFrame* pLayFrame )
     }
 }
 
-bool SwContentFrame::CalcLowers( SwLayoutFrame* pLay, const SwLayoutFrame* pDontLeave,
+bool SwContentFrame::CalcLowers(SwLayoutFrame & rLay, SwLayoutFrame const& rDontLeave,
                                  long nBottom, bool bSkipRowSpanCells )
 {
-    if ( !pLay )
-        return true;
-
-    vcl::RenderContext* pRenderContext = pLay->getRootFrame()->GetCurrShell()->GetOut();
+    vcl::RenderContext* pRenderContext = rLay.getRootFrame()->GetCurrShell()->GetOut();
     // LONG_MAX == nBottom means we have to calculate all
     bool bAll = LONG_MAX == nBottom;
     bool bRet = false;
-    SwContentFrame *pCnt = pLay->ContainsContent();
-    SwRectFnSet aRectFnSet(pLay);
+    SwContentFrame *pCnt = rLay.ContainsContent();
+    SwRectFnSet aRectFnSet(&rLay);
 
     // FME 2007-08-30 #i81146# new loop control
     int nLoopControlRuns = 0;
     const int nLoopControlMax = 10;
     const SwModify* pLoopControlCond = nullptr;
 
-    while ( pCnt && pDontLeave->IsAnLower( pCnt ) )
+    while (pCnt && rDontLeave.IsAnLower(pCnt))
     {
         // #115759# - check, if a format of content frame is
         // possible. Thus, 'copy' conditions, found at the beginning of
@@ -1539,7 +1536,7 @@ bool SwContentFrame::CalcLowers( SwLayoutFrame* pLay, const SwLayoutFrame* pDont
                     if ( nLoopControlRuns < nLoopControlMax )
                     {
                         // restart format with first content
-                        pCnt = pLay->ContainsContent();
+                        pCnt = rLay.ContainsContent();
                         continue;
                     }
 
@@ -1548,6 +1545,11 @@ bool SwContentFrame::CalcLowers( SwLayoutFrame* pLay, const SwLayoutFrame* pDont
 #endif
                 }
             }
+            if (!rDontLeave.IsAnLower(pCnt)) // moved backward?
+            {
+                pCnt = rLay.ContainsContent();
+                continue; // avoid formatting new upper on different page
+            }
             pCnt->GetUpper()->Calc(pRenderContext);
         }
         if( ! bAll && aRectFnSet.YDiff(aRectFnSet.GetTop(pCnt->getFrameArea()), nBottom) > 0 )
@@ -1603,7 +1605,7 @@ static bool lcl_InnerCalcLayout( SwFrame *pFrame,
     return bRet;
 }
 
-static void lcl_RecalcRow( SwRowFrame* pRow, long nBottom )
+static void lcl_RecalcRow(SwRowFrame *const pRow, long const nBottom)
 {
     // FME 2007-08-30 #i81146# new loop control
     int nLoopControlRuns_1 = 0;
@@ -1643,7 +1645,7 @@ static void lcl_RecalcRow( SwRowFrame* pRow, long nBottom )
             OSL_ENSURE(pOriginalRow->GetUpper() && pOriginalRow->GetUpper()->IsTabFrame(), "No table");
             SwTabFrame* pOriginalTab = static_cast<SwTabFrame*>(pRow->GetUpper());
 
-            bCheck = SwContentFrame::CalcLowers( pRow, pRow->GetUpper(), nBottom, true );
+            bCheck = SwContentFrame::CalcLowers(*pRow, *pRow->GetUpper(), nBottom, true);
 
             bool bRowStillExists = false;
             SwFrame* pTestRow = pOriginalTab->Lower();
@@ -1682,7 +1684,7 @@ static void lcl_RecalcRow( SwRowFrame* pRow, long nBottom )
                         SwCellFrame& rToRecalc = 0 == i ?
                                                const_cast<SwCellFrame&>(pCellFrame->FindStartEndOfRowSpanCell( true )) :
                                                *pCellFrame;
-                        bCheck  |= SwContentFrame::CalcLowers( &rToRecalc, &rToRecalc, nBottom, false );
+                        bCheck |= SwContentFrame::CalcLowers(rToRecalc, rToRecalc, nBottom, false);
                     }
 
                     pCellFrame = static_cast<SwCellFrame*>(pCellFrame->GetNext());