Revert "tdf#129183 sw: textboxes in group shapes - part 3"

This reverts commit eabcfb3f18a6944d9ad89cecd3eb3ca7a2259cf3.
Conflicts:
sw/source/core/doc/textboxhelper.cxx

It caused UITest_writer_tests4 to fail in an ASan build with
> ==2987325==ERROR: AddressSanitizer: heap-use-after-free on address 0x6130000e5048 at pc 0x7f20cb3112ac bp 0x7f1e62de92d0 sp 0x7f1e62de92c8
> WRITE of size 8 at 0x6130000e5048 thread T47
>  #0 in SwFrameFormat::SetOtherTextBoxFormat(SwTextBoxNode*) at sw/inc/frmfmt.hxx:106:77
>  #1 in SwTextBoxNode::~SwTextBoxNode() at sw/source/core/doc/textboxhelper.cxx:1680:30
>  #2 in SwFrameFormat::~SwFrameFormat() at sw/source/core/layout/atrfrm.cxx:2564:9
>  #3 in SwDrawFrameFormat::~SwDrawFrameFormat() at sw/source/core/layout/atrfrm.cxx:3455:1
>  #4 in SwDrawFrameFormat::~SwDrawFrameFormat() at sw/source/core/layout/atrfrm.cxx:3453:1
>  #5 in SwFrameFormats::DeleteAndDestroyAll(bool) at sw/source/core/doc/docfmt.cxx:2115:9
>  #6 in SwDoc::~SwDoc() at sw/source/core/doc/docnew.cxx:565:28
>  #7 in SwDoc::release() at sw/source/core/doc/doc.cxx:118:9
>  #8 in rtl::Reference<SwDoc>::clear() at include/rtl/ref.hxx:196:19
>  #9 in SwDocShell::RemoveLink() at sw/source/uibase/app/docshini.cxx:444:16
>  #10 in SwDocShell::~SwDocShell() at sw/source/uibase/app/docshini.cxx:372:5
>  #11 in SwDocShell::~SwDocShell() at sw/source/uibase/app/docshini.cxx:362:1
>  #12 in SwDocShell::~SwDocShell() at sw/source/uibase/app/docshini.cxx:362:1
>  #13 in SvRefBase::ReleaseRef() at include/tools/ref.hxx:163:29
>  #14 in tools::SvRef<SfxObjectShell>::~SvRef() at include/tools/ref.hxx:56:36
>  #15 in IMPL_SfxBaseModel_DataContainer::~IMPL_SfxBaseModel_DataContainer() at sfx2/source/doc/sfxbasemodel.cxx:245:5
>  #16 in void std::destroy_at<IMPL_SfxBaseModel_DataContainer>(IMPL_SfxBaseModel_DataContainer*) at ~/gcc/trunk/inst/lib/gcc/x86_64-pc-linux-gnu/12.0.0/../../../../include/c++/12.0.0/bits/stl_construct.h:88:15
>  #17 in void std::allocator_traits<std::allocator<IMPL_SfxBaseModel_DataContainer> >::destroy<IMPL_SfxBaseModel_DataContainer>(std::allocator<IMPL_SfxBaseModel_DataContainer>&, IMPL_SfxBaseModel_DataContainer*) at ~/gcc/trunk/inst/lib/gcc/x86_64-pc-linux-gnu/12.0.0/../../../../include/c++/12.0.0/bits/alloc_traits.h:537:4
>  #18 in std::_Sp_counted_ptr_inplace<IMPL_SfxBaseModel_DataContainer, std::allocator<IMPL_SfxBaseModel_DataContainer>, (__gnu_cxx::_Lock_policy)2>::_M_dispose() at ~/gcc/trunk/inst/lib/gcc/x86_64-pc-linux-gnu/12.0.0/../../../../include/c++/12.0.0/bits/shared_ptr_base.h:528:2
>  #19 in std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release() at ~/gcc/trunk/inst/lib/gcc/x86_64-pc-linux-gnu/12.0.0/../../../../include/c++/12.0.0/bits/shared_ptr_base.h:168:6
>  #20 in std::__shared_count<(__gnu_cxx::_Lock_policy)2>::~__shared_count() at ~/gcc/trunk/inst/lib/gcc/x86_64-pc-linux-gnu/12.0.0/../../../../include/c++/12.0.0/bits/shared_ptr_base.h:705:11
>  #21 in std::__shared_ptr<IMPL_SfxBaseModel_DataContainer, (__gnu_cxx::_Lock_policy)2>::~__shared_ptr() at ~/gcc/trunk/inst/lib/gcc/x86_64-pc-linux-gnu/12.0.0/../../../../include/c++/12.0.0/bits/shared_ptr_base.h:1154:31
>  #22 in std::__shared_ptr<IMPL_SfxBaseModel_DataContainer, (__gnu_cxx::_Lock_policy)2>::reset() at ~/gcc/trunk/inst/lib/gcc/x86_64-pc-linux-gnu/12.0.0/../../../../include/c++/12.0.0/bits/shared_ptr_base.h:1272:9
>  #23 in SfxBaseModel::dispose() at sfx2/source/doc/sfxbasemodel.cxx:757:13
>  #24 in SwXTextDocument::dispose() at sw/source/uibase/uno/unotxdoc.cxx:549:19
>  #25 in SfxBaseModel::close(unsigned char) at sfx2/source/doc/sfxbasemodel.cxx:1482:5
>  #26 in SwXTextDocument::close(unsigned char) at sw/source/uibase/uno/unotxdoc.cxx:562:19
>  #27 in SfxBaseModel::dispose() at sfx2/source/doc/sfxbasemodel.cxx:718:13
>  #28 in SwXTextDocument::dispose() at sw/source/uibase/uno/unotxdoc.cxx:549:19
>  #29 in gcc3::callVirtualMethod(void*, unsigned int, void*, _typelib_TypeDescriptionReference*, bool, unsigned long*, unsigned int, unsigned long*, double*) at bridges/source/cpp_uno/gcc3_linux_x86-64/callvirtualmethod.cxx:77:5
>  #30 in cpp_call(bridges::cpp_uno::shared::UnoInterfaceProxy*, bridges::cpp_uno::shared::VtableSlot, _typelib_TypeDescriptionReference*, int, _typelib_MethodParameter*, void*, void**, _uno_Any**) at bridges/source/cpp_uno/gcc3_linux_x86-64/uno2cpp.cxx:233:13
>  #31 in unoInterfaceProxyDispatch at bridges/source/cpp_uno/gcc3_linux_x86-64/uno2cpp.cxx:413:13
>  #32 in binaryurp::IncomingRequest::execute_throw(binaryurp::BinaryAny*, std::__debug::vector<binaryurp::BinaryAny, std::allocator<binaryurp::BinaryAny> >*) const at binaryurp/source/incomingrequest.cxx:235:13
>  #33 in binaryurp::IncomingRequest::execute() const at binaryurp/source/incomingrequest.cxx:78:26
>  #34 in request at binaryurp/source/reader.cxx:85:9
>  #35 in cppu_threadpool::JobQueue::enter(void const*, bool) at cppu/source/threadpool/jobqueue.cxx:100:17
>  #36 in cppu_threadpool::ORequestThread::run() at cppu/source/threadpool/thread.cxx:164:31
>  #37 in threadFunc at include/osl/thread.hxx:189:15
>  #38 in osl_thread_start_Impl(void*) at sal/osl/unx/thread.cxx:264:9
>  #39 in start_thread at <null>
>  #40 in __GI___clone3 at <null>
>
> 0x6130000e5048 is located 328 bytes inside of 376-byte region [0x6130000e4f00,0x6130000e5078)
> freed by thread T47 here:
>  #0 in operator delete(void*, unsigned long) at ~/github.com/llvm/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:164:3
>  #1 in SwFlyFrameFormat::~SwFlyFrameFormat() at sw/source/core/layout/atrfrm.cxx:2912:1
>  #2 in SwFrameFormats::DeleteAndDestroyAll(bool) at sw/source/core/doc/docfmt.cxx:2115:9
>  #3 in SwDoc::~SwDoc() at sw/source/core/doc/docnew.cxx:565:28
>  #4 in SwDoc::release() at sw/source/core/doc/doc.cxx:118:9
>  #5 in rtl::Reference<SwDoc>::clear() at include/rtl/ref.hxx:196:19
>  #6 in SwDocShell::RemoveLink() at sw/source/uibase/app/docshini.cxx:444:16
>  #7 in SwDocShell::~SwDocShell() at sw/source/uibase/app/docshini.cxx:372:5
>  #8 in SwDocShell::~SwDocShell() at sw/source/uibase/app/docshini.cxx:362:1
>  #9 in SwDocShell::~SwDocShell() at sw/source/uibase/app/docshini.cxx:362:1
>  #10 in SvRefBase::ReleaseRef() at include/tools/ref.hxx:163:29
>  #11 in tools::SvRef<SfxObjectShell>::~SvRef() at include/tools/ref.hxx:56:36
>  #12 in IMPL_SfxBaseModel_DataContainer::~IMPL_SfxBaseModel_DataContainer() at sfx2/source/doc/sfxbasemodel.cxx:245:5
>  #13 in void std::destroy_at<IMPL_SfxBaseModel_DataContainer>(IMPL_SfxBaseModel_DataContainer*) at ~/gcc/trunk/inst/lib/gcc/x86_64-pc-linux-gnu/12.0.0/../../../../include/c++/12.0.0/bits/stl_construct.h:88:15
>  #14 in void std::allocator_traits<std::allocator<IMPL_SfxBaseModel_DataContainer> >::destroy<IMPL_SfxBaseModel_DataContainer>(std::allocator<IMPL_SfxBaseModel_DataContainer>&, IMPL_SfxBaseModel_DataContainer*) at ~/gcc/trunk/inst/lib/gcc/x86_64-pc-linux-gnu/12.0.0/../../../../include/c++/12.0.0/bits/alloc_traits.h:537:4
>  #15 in std::_Sp_counted_ptr_inplace<IMPL_SfxBaseModel_DataContainer, std::allocator<IMPL_SfxBaseModel_DataContainer>, (__gnu_cxx::_Lock_policy)2>::_M_dispose() at ~/gcc/trunk/inst/lib/gcc/x86_64-pc-linux-gnu/12.0.0/../../../../include/c++/12.0.0/bits/shared_ptr_base.h:528:2
>  #16 in std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release() at ~/gcc/trunk/inst/lib/gcc/x86_64-pc-linux-gnu/12.0.0/../../../../include/c++/12.0.0/bits/shared_ptr_base.h:168:6
>  #17 in std::__shared_count<(__gnu_cxx::_Lock_policy)2>::~__shared_count() at ~/gcc/trunk/inst/lib/gcc/x86_64-pc-linux-gnu/12.0.0/../../../../include/c++/12.0.0/bits/shared_ptr_base.h:705:11
>  #18 in std::__shared_ptr<IMPL_SfxBaseModel_DataContainer, (__gnu_cxx::_Lock_policy)2>::~__shared_ptr() at ~/gcc/trunk/inst/lib/gcc/x86_64-pc-linux-gnu/12.0.0/../../../../include/c++/12.0.0/bits/shared_ptr_base.h:1154:31
>  #19 in std::__shared_ptr<IMPL_SfxBaseModel_DataContainer, (__gnu_cxx::_Lock_policy)2>::reset() at ~/gcc/trunk/inst/lib/gcc/x86_64-pc-linux-gnu/12.0.0/../../../../include/c++/12.0.0/bits/shared_ptr_base.h:1272:9
>
> previously allocated by thread T10 here:
>  #0 in operator new(unsigned long) at ~/github.com/llvm/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:95:3
>  #1 in SwDoc::MakeFlyFrameFormat(rtl::OUString const&, SwFrameFormat*) at sw/source/core/doc/docfmt.cxx:756:33
>  #2 in SwDoc::MakeFlySection_(SwPosition const&, SwContentNode const&, RndStdIds, SfxItemSet const*, SwFrameFormat*) at sw/source/core/doc/doclay.cxx:171:33
>  #3 in SwDoc::MakeFlySection(RndStdIds, SwPosition const*, SfxItemSet const*, SwFrameFormat*, bool) at sw/source/core/doc/doclay.cxx:337:19
>  #4 in SwXFrame::attachToRange(com::sun::star::uno::Reference<com::sun::star::text::XTextRange> const&, SwPaM const*) at sw/source/core/unocore/unoframe.cxx:2821:29
>  #5 in SwXFrame::attach(com::sun::star::uno::Reference<com::sun::star::text::XTextRange> const&) at sw/source/core/unocore/unoframe.cxx:3115:9
>  #6 in SwXTextFrame::attach(com::sun::star::uno::Reference<com::sun::star::text::XTextRange> const&) at sw/source/core/unocore/unoframe.cxx:3346:15
>  #7 in SwXText::insertTextContent(com::sun::star::uno::Reference<com::sun::star::text::XTextRange> const&, com::sun::star::uno::Reference<com::sun::star::text::XTextContent> const&, unsigned char) at sw/source/core/unocore/unotext.cxx:615:15
>  #8 in SwXText::insertTextContentWithProperties(com::sun::star::uno::Reference<com::sun::star::text::XTextContent> const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::text::XTextRange> const&) at sw/source/core/unocore/unotext.cxx:1472:5
>  #9 in non-virtual thunk to SwXText::insertTextContentWithProperties(com::sun::star::uno::Reference<com::sun::star::text::XTextContent> const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::text::XTextRange> const&) at sw/source/core/unocore/unotext.cxx
>  #10 in SwTextBoxHelper::create(SwFrameFormat*, SdrObject*, bool) at sw/source/core/doc/textboxhelper.cxx:100:29
>  #11 in SwXShape::setPropertyValue(rtl::OUString const&, com::sun::star::uno::Any const&) at sw/source/core/unocore/unodraw.cxx:1165:25
>  #12 in SdXMLShapeContext::SetStyle(bool) at xmloff/source/draw/ximpshap.cxx:701:27
>  #13 in SdXMLCustomShapeContext::startFastElement(int, com::sun::star::uno::Reference<com::sun::star::xml::sax::XFastAttributeList> const&) at xmloff/source/draw/ximpshap.cxx:3545:5
>  #14 in SvXMLImport::startFastElement(int, com::sun::star::uno::Reference<com::sun::star::xml::sax::XFastAttributeList> const&) at xmloff/source/core/xmlimp.cxx:805:15
>  #15 in (anonymous namespace)::Entity::startElement((anonymous namespace)::Event const*) at sax/source/fastparser/fastparser.cxx:468:27
>  #16 in sax_fastparser::FastSaxParserImpl::callbackStartElement(unsigned char const*, unsigned char const*, unsigned char const*, int, unsigned char const**, int, unsigned char const**) at sax/source/fastparser/fastparser.cxx:1304:21
>  #17 in (anonymous namespace)::call_callbackStartElement(void*, unsigned char const*, unsigned char const*, unsigned char const*, int, unsigned char const**, int, int, unsigned char const**) at sax/source/fastparser/fastparser.cxx:331:18
>  #18 in xmlParseStartTag2 at workdir/UnpackedTarball/libxml2/parser.c:9658:6
>  #19 in xmlParseTryOrFinish at workdir/UnpackedTarball/libxml2/parser.c:11453:14

Change-Id: I752190e05fc3c282b75021724527f623f56ee6a6
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/125977
Tested-by: Jenkins
Tested-by: René Engelhard <rene@debian.org>
Reviewed-by: Stephan Bergmann <sbergman@redhat.com>

2 files changed, 0 insertions, 124 deletions

diff --git a/sw/qa/uitest/data/ComplexGroupShapeTest.odt b/sw/qa/uitest/data/ComplexGroupShapeTest.odt
deleted file mode 100644
index 8fe093203690..000000000000
--- a/sw/qa/uitest/data/ComplexGroupShapeTest.odt
+++ /dev/null
diff --git a/sw/qa/uitest/writer_tests4/ComplexGroupShapeTest.py b/sw/qa/uitest/writer_tests4/ComplexGroupShapeTest.py
deleted file mode 100644
index cdac088a32d7..000000000000
--- a/sw/qa/uitest/writer_tests4/ComplexGroupShapeTest.py
+++ /dev/null
@@ -1,124 +0,0 @@
-# -*- tab-width: 4; indent-tabs-mode: nil; py-indent-offset: 4 -*-
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-from uitest.framework import UITestCase
-from uitest.uihelper.common import get_state_as_dict
-from uitest.uihelper.common import select_pos
-from uitest.uihelper.common import get_url_for_data_file
-from libreoffice.uno.propertyvalue import mkPropertyValues
-import time
-
-class ComplexGroupShapeTest(UITestCase):
-    def test_ComplexGroupShape(self):
-        with self.ui_test.load_file(get_url_for_data_file("ComplexGroupShapeTest.odt")):
-            xWriterDoc = self.xUITest.getTopFocusWindow()
-            xWriterEdit = xWriterDoc.getChild("writer_edit")
-            document = self.ui_test.get_component()
-
-            # check the shape type
-            self.assertEqual("com.sun.star.drawing.GroupShape", document.DrawPage.getByIndex(1).ShapeType)
-
-            # select the shape
-            self.xUITest.executeCommand(".uno:JumpToNextFrame")
-            self.ui_test.wait_until_child_is_available('metricfield')
-
-            # go inside the group
-            self.xUITest.executeCommand(".uno:EnterGroup")
-
-            # select a shape in the group
-            xWriterEdit.executeAction("TYPE", mkPropertyValues({"KEYCODE": "TAB"}))
-
-            # add a textbox to this subshape
-            self.xUITest.executeCommand(".uno:AddTextBox")
-
-            # select the next shape in the group
-            xWriterEdit.executeAction("TYPE", mkPropertyValues({"KEYCODE": "TAB"}))
-
-            # add a textbox to this subshape
-            self.xUITest.executeCommand(".uno:AddTextBox")
-
-            # leave the groupshape
-            self.xUITest.executeCommand(".uno:LeaveGroup")
-
-            # select the other shape
-            self.xUITest.executeCommand(".uno:JumpToNextFrame")
-            self.ui_test.wait_until_child_is_available('metricfield')
-
-            # get the current selection
-            ShapeCollection = document.getCurrentSelection()
-
-            # extend the selection with the grouped shape
-            ShapeCollection.add(document.DrawPage.getByIndex(0))
-            ShapeCollection.add(document.DrawPage.getByIndex(1))
-
-            # select these shapes
-            document.getCurrentController().select(ShapeCollection)
-
-            # do ungroup
-            self.xUITest.executeCommand(".uno:FormatGroup")
-
-            # deselect
-            xWriterEdit.executeAction("TYPE", mkPropertyValues({"KEYCODE":"ESC"}))
-            time.sleep(0.1)
-
-            # select the group
-            self.xUITest.executeCommand(".uno:JumpToNextFrame")
-            self.ui_test.wait_until_child_is_available('metricfield')
-
-            # move it down
-            for i in range(1, 30):
-                xWriterEdit.executeAction("TYPE", mkPropertyValues({"KEYCODE":"DOWN"}))
-                time.sleep(0.1)
-
-            # select again
-            self.xUITest.executeCommand(".uno:JumpToNextFrame")
-            self.ui_test.wait_until_child_is_available('metricfield')
-
-            # do ungroup
-            self.xUITest.executeCommand(".uno:FormatUngroup")
-
-            # deselect everything
-            xWriterEdit.executeAction("TYPE", mkPropertyValues({"KEYCODE":"ESC"}))
-            time.sleep(0.1)
-
-            # select the first ex-group member shape
-            self.xUITest.executeCommand(".uno:JumpToNextFrame")
-            self.ui_test.wait_until_child_is_available('metricfield')
-            xWriterEdit.executeAction("TYPE", mkPropertyValues({"KEYCODE": "TAB"}))
-
-            # check if it is a textbox
-            self.assertEqual(True,document.getCurrentSelection().getByIndex(0).TextBox)
-
-            # go to the other one
-            xWriterEdit.executeAction("TYPE", mkPropertyValues({"KEYCODE": "TAB"}))
-            xWriterEdit.executeAction("TYPE", mkPropertyValues({"KEYCODE": "TAB"}))
-
-            # this is still a group, so it cannot be a textbox
-            self.assertEqual(False,document.getCurrentSelection().getByIndex(0).TextBox)
-
-            # do ungroup
-            self.xUITest.executeCommand(".uno:FormatUngroup")
-
-            # deselect
-            xWriterEdit.executeAction("TYPE", mkPropertyValues({"KEYCODE":"ESC"}))
-            time.sleep(0.1)
-
-            # select one shape of the last group
-            self.xUITest.executeCommand(".uno:JumpToNextFrame")
-            self.ui_test.wait_until_child_is_available('metricfield')
-            xWriterEdit.executeAction("TYPE", mkPropertyValues({"KEYCODE": "TAB"}))
-            xWriterEdit.executeAction("TYPE", mkPropertyValues({"KEYCODE": "TAB"}))
-            xWriterEdit.executeAction("TYPE", mkPropertyValues({"KEYCODE": "TAB"}))
-
-            # check if it is a textbox
-            self.assertEqual(True,document.getCurrentSelection().getByIndex(0).TextBox)
-
-            # Without the fix in place, the following problems occurred during this test:
-            # - After the grouping old textbox frames detached from their shape before
-            # - Moving caused messed layout
-            # - After ungroup, the shapes in the embed group lost their textbox
-
-# vim: set shiftwidth=4 softtabstop=4 expandtab: