tdf#161215 sw: layout: don't move into section frame on same page

The problem is that in SwFrame::GetNextFlyLeaf() pLayLeaf is in the body
on the same page as pFlyAnchor, so the MoveSubTree() effectively removes
the pNext chain from the layout into a circular structure whose upper is
an indirect lower, causing an infinite loop later.

Change-Id: I08f96cf483205d6213d7cec7b239f750fff5d3ad
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/168529
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>

1 files changed, 11 insertions, 1 deletions

diff --git a/sw/source/core/layout/flycnt.cxx b/sw/source/core/layout/flycnt.cxx
index 89cd2e0bb876..03d95c979f11 100644
--- a/sw/source/core/layout/flycnt.cxx
+++ b/sw/source/core/layout/flycnt.cxx
@@ -1629,7 +1629,17 @@ SwLayoutFrame *SwFrame::GetNextFlyLeaf( MakePageType eMakePage )
             {
                 // Make sure the candidate is not inside the same body frame, that would prevent
                 // inserting a new page.
-                if (pFlyAnchor->FindBodyFrame() == pLayLeaf->FindBodyFrame())
+                SwBodyFrame const* pAnchorBody(pFlyAnchor->FindBodyFrame());
+                while (!pAnchorBody->IsPageBodyFrame())
+                {
+                    pAnchorBody = pAnchorBody->GetUpper()->FindBodyFrame();
+                };
+                SwBodyFrame const* pLeafBody(pLayLeaf->FindBodyFrame());
+                while (!pLeafBody->IsPageBodyFrame())
+                {
+                    pLeafBody = pLeafBody->GetUpper()->FindBodyFrame();
+                };
+                if (pAnchorBody == pLeafBody)
                 {
                     bSameBody = true;
                 }