bnc#382137 SwFrm::CheckPageDescs: notify clients about deleted SwPageFrm

The problem is the following: SwLayAction::InternalAction() saves
pPage->GetPrev() as pTmp, then SwFrm::CheckPageDescs(pPage) is called,
which deletes pPage->GetPrev(). SwLayAction has no idea that pTmp got
deleted, and later passes it to unlockPositionOfObjects(), which
obviously assumes a valid pointer.

To be on the safe side, just provide a possibility to let the caller
know its pointer has been deleted.

Change-Id: Ibb4d83266b1f4b6146a12dce0d4701f1056deecd

3 files changed, 8 insertions, 3 deletions

diff --git a/sw/source/core/inc/frame.hxx b/sw/source/core/inc/frame.hxx
index f93ae6771f18..7d91e7992a08 100644
--- a/sw/source/core/inc/frame.hxx
+++ b/sw/source/core/inc/frame.hxx
@@ -588,7 +588,7 @@ public:
     inline void SetFixSize( sal_Bool bNew ) { mbFixSize = bNew; }
 
     // check all pages (starting from the given) and correct them if needed
-    static void CheckPageDescs( SwPageFrm *pStart, sal_Bool bNotifyFields = sal_True );
+    static void CheckPageDescs( SwPageFrm *pStart, sal_Bool bNotifyFields = sal_True, SwPageFrm** ppPrev = 0);
 
     // might return 0, with and without const
     SwFrm               *GetNext()  { return mpNext; }
diff --git a/sw/source/core/layout/layact.cxx b/sw/source/core/layout/layact.cxx
index 71659ce4ab95..37c77f43a7dc 100644
--- a/sw/source/core/layout/layact.cxx
+++ b/sw/source/core/layout/layact.cxx
@@ -562,7 +562,7 @@ void SwLayAction::InternalAction()
             SwPageFrm *pTmp = pPage->GetPrev() ?
                                         (SwPageFrm*)pPage->GetPrev() : pPage;
             SetCheckPages( sal_True );
-            SwFrm::CheckPageDescs( pPage );
+            SwFrm::CheckPageDescs( pPage, sal_True, &pTmp );
             SetCheckPages( sal_False );
             nCheckPageNum = USHRT_MAX;
             pPage = pTmp;
diff --git a/sw/source/core/layout/pagechg.cxx b/sw/source/core/layout/pagechg.cxx
index 304bbcbece10..1bf4522b8547 100644
--- a/sw/source/core/layout/pagechg.cxx
+++ b/sw/source/core/layout/pagechg.cxx
@@ -1061,7 +1061,7 @@ void SwPageFrm::PrepareRegisterChg()
 |*      einfache zu bereinigen.
 |*
 |*************************************************************************/
-void SwFrm::CheckPageDescs( SwPageFrm *pStart, sal_Bool bNotifyFields )
+void SwFrm::CheckPageDescs( SwPageFrm *pStart, sal_Bool bNotifyFields, SwPageFrm** ppPrev )
 {
     OSL_ENSURE( pStart, "Keine Startpage." );
 
@@ -1136,10 +1136,15 @@ void SwFrm::CheckPageDescs( SwPageFrm *pStart, sal_Bool bNotifyFields )
             {
                 SwPageFrm *pTmp = (SwPageFrm*)pPage->GetNext();
                 pPage->Cut();
+                bool bUpdatePrev = false;
+                if (ppPrev && *ppPrev == pPage)
+                    bUpdatePrev = true;
                 delete pPage;
                 if ( pStart == pPage )
                     pStart = pTmp;
                 pPage = pTmp;
+                if (bUpdatePrev)
+                    *ppPrev = pTmp;
                 continue;
             }
             else if ( pPage->IsEmptyPage() && !pFmtWish &&  //2.