i#95698 sw: fix crash on splitting in-table section containing a nested table

Found by crashtesting, ooo95698-1.odt crashed sw layout on load. The
intended use-case is splitting section frames inside a table frame, so
can just blacklist the non-interesting table-in-section-in-table case
that causes the problem here.

Reviewed-on: https://gerrit.libreoffice.org/41224
Reviewed-by: Miklos Vajna <vmiklos@collabora.co.uk>
Tested-by: Jenkins <ci@libreoffice.org>
(cherry picked from commit 802477ae75b39194442d9c01a1342d068c7b9300)

Conflicts:
sw/qa/extras/uiwriter/uiwriter.cxx

Change-Id: Ic47cd8c46cc71f7eaa36b03ec2c4a5df8ca8051c

3 files changed, 22 insertions, 0 deletions

diff --git a/sw/qa/extras/uiwriter/data/i95698.odt b/sw/qa/extras/uiwriter/data/i95698.odt
new file mode 100644
index 000000000000..9fe3ec207648
--- /dev/null
+++ b/sw/qa/extras/uiwriter/data/i95698.odt
diff --git a/sw/qa/extras/uiwriter/uiwriter.cxx b/sw/qa/extras/uiwriter/uiwriter.cxx
index 3d566b5df278..c23c0e825d27 100644
--- a/sw/qa/extras/uiwriter/uiwriter.cxx
+++ b/sw/qa/extras/uiwriter/uiwriter.cxx
@@ -203,6 +203,7 @@ public:
     void testTdf108524();
     void testTableInSection();
     void testTableInNestedSection();
+    void testTableInSectionInTable();
     void testLinesInSectionInTable();
     void testLinesMoveBackwardsInSectionInTable();
 
@@ -312,6 +313,7 @@ public:
     CPPUNIT_TEST(testTableInSection);
     CPPUNIT_TEST(testTableInNestedSection);
     CPPUNIT_TEST(testLinesInSectionInTable);
+    CPPUNIT_TEST(testTableInSectionInTable);
     CPPUNIT_TEST(testLinesMoveBackwardsInSectionInTable);
     CPPUNIT_TEST_SUITE_END();
 
@@ -3820,6 +3822,14 @@ void SwUiWriterTest::testTableInNestedSection()
     assertXPath(pXmlDoc, "//page[2]//section/tab", 1);
 }
 
+void SwUiWriterTest::testTableInSectionInTable()
+{
+    // The document has a table, containing a section, containing a nested
+    // table.
+    // This crashed the layout.
+    createDoc("i95698.odt");
+}
+
 CPPUNIT_TEST_SUITE_REGISTRATION(SwUiWriterTest);
 CPPUNIT_PLUGIN_IMPLEMENT();
 
diff --git a/sw/source/core/layout/tabfrm.cxx b/sw/source/core/layout/tabfrm.cxx
index 45282d886929..0c6db983d50d 100644
--- a/sw/source/core/layout/tabfrm.cxx
+++ b/sw/source/core/layout/tabfrm.cxx
@@ -916,9 +916,21 @@ static bool lcl_FindSectionsInRow( const SwRowFrame& rRow )
                         if (const SwFrame* pSectionLower = pTmpFrame->GetLower())
                         {
                             if (!pSectionLower->IsColumnFrame())
+                            {
                                 // Section has a single column only, try to
                                 // split that.
                                 bRet = false;
+
+                                for (const SwFrame* pFrame = pSectionLower; pFrame; pFrame = pFrame->GetNext())
+                                {
+                                    if (pFrame->IsTabFrame())
+                                    {
+                                        // Section contains a table, no split in that case.
+                                        bRet = true;
+                                        break;
+                                    }
+                                }
+                            }
                         }
                     }
                 }