sw: fix invalid downcast of SwDrawFrameFormat in DelContentIndex()

failure in UITest_writer_tests6:

sw/source/core/undo/undobj.cxx:1021:47: runtime error: downcast of address 0x61300019d3c0 which does not point to an object of type 'SwFlyFrameFormat'
0x61300019d3c0:m note: object is of type 'SwDrawFrameFormat'
a2 01 80 19  50 ac d1 9e 14 7f 00 00  00 af 19 00 30 61 00 00  e8 4f 0b 00 b0 61 00 00  40 dd 40 00
^~~~~~~~~~~~~~~~~~~~~~~
vptr for 'SwDrawFrameFormat'
in SwUndoSaveContent::DelContentIndex(SwPosition const&, SwPosition const&, DelContentType) at sw/source/core/undo/undobj.cxx:1021:47 (instdir/program/../program/libswlo.so +0xf8e5833)

Also lose the ridiculous overloading across derived classes.

Change-Id: I19439d0d511c5f8c36b00d8dd02c31f802a44e00
Reviewed-on: https://gerrit.libreoffice.org/83175
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@cib.de>

4 files changed, 16 insertions, 12 deletions

diff --git a/sw/source/core/inc/rolbck.hxx b/sw/source/core/inc/rolbck.hxx
index 91e9d85574b1..2abe1d590b88 100644
--- a/sw/source/core/inc/rolbck.hxx
+++ b/sw/source/core/inc/rolbck.hxx
@@ -364,8 +364,8 @@ public:
     void Add( SwTextAttr* pTextHt, sal_uLong nNodeIdx, bool bNewAttr );
     void Add( SwFormatColl*, sal_uLong nNodeIdx, SwNodeType nWhichNd );
     void Add( const ::sw::mark::IMark&, bool bSavePos, bool bSaveOtherPos );
-    void Add( SwFrameFormat& rFormat );
-    void Add( SwFlyFrameFormat&, sal_uInt16& rSetPos );
+    void AddChangeFlyAnchor( SwFrameFormat& rFormat );
+    void AddDeleteFly( SwFrameFormat&, sal_uInt16& rSetPos );
     void Add( const SwTextFootnote& );
     void Add( const SfxItemSet & rSet, const SwCharFormat & rCharFormat);
 
diff --git a/sw/source/core/undo/rolbck.cxx b/sw/source/core/undo/rolbck.cxx
index 353ce708fe8a..6f0c1de92bb1 100644
--- a/sw/source/core/undo/rolbck.cxx
+++ b/sw/source/core/undo/rolbck.cxx
@@ -1093,18 +1093,21 @@ void SwHistory::Add(const ::sw::mark::IMark& rBkmk, bool bSavePos, bool bSaveOth
     m_SwpHstry.push_back( std::move(pHt) );
 }
 
-void SwHistory::Add( SwFrameFormat& rFormat )
+void SwHistory::AddChangeFlyAnchor(SwFrameFormat& rFormat)
 {
     std::unique_ptr<SwHistoryHint> pHt(new SwHistoryChangeFlyAnchor( rFormat ));
     m_SwpHstry.push_back( std::move(pHt) );
 }
 
-void SwHistory::Add( SwFlyFrameFormat& rFormat, sal_uInt16& rSetPos )
+void SwHistory::AddDeleteFly(SwFrameFormat& rFormat, sal_uInt16& rSetPos)
 {
     OSL_ENSURE( !m_nEndDiff, "History was not deleted after REDO" );
 
     const sal_uInt16 nWh = rFormat.Which();
-    if( RES_FLYFRMFMT == nWh || RES_DRAWFRMFMT == nWh )
+    (void) nWh;
+    // only Flys!
+    assert((RES_FLYFRMFMT == nWh && dynamic_cast<SwFlyFrameFormat*>(&rFormat))
+        || (RES_DRAWFRMFMT == nWh && dynamic_cast<SwDrawFrameFormat*>(&rFormat)));
     {
         std::unique_ptr<SwHistoryHint> pHint(new SwHistoryTextFlyCnt( &rFormat ));
         m_SwpHstry.push_back( std::move(pHint) );
@@ -1113,10 +1116,11 @@ void SwHistory::Add( SwFlyFrameFormat& rFormat, sal_uInt16& rSetPos )
         if( SfxItemState::SET == rFormat.GetItemState( RES_CHAIN, false,
             reinterpret_cast<const SfxPoolItem**>(&pChainItem) ))
         {
+            assert(RES_FLYFRMFMT == nWh); // not supported on SdrObjects
             if( pChainItem->GetNext() || pChainItem->GetPrev() )
             {
                 std::unique_ptr<SwHistoryHint> pHt(
-                    new SwHistoryChangeFlyChain( rFormat, *pChainItem ));
+                    new SwHistoryChangeFlyChain(static_cast<SwFlyFrameFormat&>(rFormat), *pChainItem));
                 m_SwpHstry.insert( m_SwpHstry.begin() + rSetPos++, std::move(pHt) );
                 if ( pChainItem->GetNext() )
                 {
diff --git a/sw/source/core/undo/undobj.cxx b/sw/source/core/undo/undobj.cxx
index bb5683853a51..e54290e941b0 100644
--- a/sw/source/core/undo/undobj.cxx
+++ b/sw/source/core/undo/undobj.cxx
@@ -988,7 +988,7 @@ void SwUndoSaveContent::DelContentIndex( const SwPosition& rMark,
                                     // Do not try to move the anchor to a table!
                                     && rMark.nNode.GetNode().IsTextNode())
                                 {
-                                    m_pHistory->Add( *pFormat );
+                                    m_pHistory->AddChangeFlyAnchor(*pFormat);
                                     SwFormatAnchor aAnch( *pAnchor );
                                     SwPosition aPos( rMark.nNode );
                                     aAnch.SetAnchor( &aPos );
@@ -996,7 +996,7 @@ void SwUndoSaveContent::DelContentIndex( const SwPosition& rMark,
                                 }
                                 else
                                 {
-                                    m_pHistory->Add( *static_cast<SwFlyFrameFormat *>(pFormat), nChainInsPos );
+                                    m_pHistory->AddDeleteFly(*pFormat, nChainInsPos );
                                     // reset n so that no Format is skipped
                                     n = n >= rSpzArr.size() ?
                                         rSpzArr.size() : n+1;
@@ -1014,7 +1014,7 @@ void SwUndoSaveContent::DelContentIndex( const SwPosition& rMark,
                         if (IsDestroyFrameAnchoredAtChar(
                                 *pAPos, *pStt, *pEnd, nDelContentType))
                         {
-                            m_pHistory->Add( *static_cast<SwFlyFrameFormat *>(pFormat), nChainInsPos );
+                            m_pHistory->AddDeleteFly(*pFormat, nChainInsPos);
                             n = n >= rSpzArr.size() ? rSpzArr.size() : n+1;
                         }
                         else if (!((DelContentType::CheckNoCntnt |
@@ -1028,7 +1028,7 @@ void SwUndoSaveContent::DelContentIndex( const SwPosition& rMark,
                                 // Do not try to move the anchor to a table!
                                 if( rMark.nNode.GetNode().GetTextNode() )
                                 {
-                                    m_pHistory->Add( *pFormat );
+                                    m_pHistory->AddChangeFlyAnchor(*pFormat);
                                     SwFormatAnchor aAnch( *pAnchor );
                                     aAnch.SetAnchor( &rMark );
                                     pFormat->SetFormatAttr( aAnch );
@@ -1045,7 +1045,7 @@ void SwUndoSaveContent::DelContentIndex( const SwPosition& rMark,
                         if( !m_pHistory )
                             m_pHistory.reset( new SwHistory );
 
-                        m_pHistory->Add( *static_cast<SwFlyFrameFormat *>(pFormat), nChainInsPos );
+                        m_pHistory->AddDeleteFly(*pFormat, nChainInsPos);
 
                         // reset n so that no Format is skipped
                         n = n >= rSpzArr.size() ? rSpzArr.size() : n+1;
diff --git a/sw/source/core/undo/untbl.cxx b/sw/source/core/undo/untbl.cxx
index fb617fd6e2aa..9d1675c0f304 100644
--- a/sw/source/core/undo/untbl.cxx
+++ b/sw/source/core/undo/untbl.cxx
@@ -424,7 +424,7 @@ SwUndoTableToText::SwUndoTableToText( const SwTable& rTable, sal_Unicode cCh )
             nTableStt <= pAPos->nNode.GetIndex() &&
             pAPos->nNode.GetIndex() < nTableEnd )
         {
-            pHistory->Add( *pFormat );
+            pHistory->AddChangeFlyAnchor(*pFormat);
         }
     }