rhbz#1205072: sw: resource mangement SNAFU caused by SwPaM copy ctor

SwPaM copy ctor has the surprising habit of linking the new one into the
old one's Ring.  If you copy a shell cursor, *this* epic fail happens:

==948== Thread 6 SelectionManager:
==948== Invalid free() / delete / delete[] / realloc()
==948==    at 0x4A07CE9: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==948==    by 0x222F542B: SwPaM::operator delete(void*, unsigned long) (in /libreoffice-4-3/instdir/program/libswlo.so)
==948==    by 0x2239E20E: SwPaM::~SwPaM() (pam.cxx:422)
==948==    by 0x22368630: CheckRange(SwCursor*) (crsrsh.cxx:111)
==948==    by 0x2236DECC: SwCrsrShell::UpdateCrsr(unsigned short, bool) (crsrsh.cxx:1397)
==948==    by 0x22369113: SwCrsrShell::EndAction(bool) (crsrsh.cxx:290)
==948==    by 0x2268971F: SwEditShell::EndAllAction() (edws.cxx:87)
==948==    by 0x2262BEF3: SwBaseLink::DataChanged(rtl::OUString const&, com::sun::star::uno::Any const&) (swbaslnk.cxx:274)
==948==    by 0x2262C78E: SwBaseLink::SwapIn(bool, bool) (swbaslnk.cxx:411)
==948==    by 0x227102EC: SwGrfNode::SwapIn(bool) (ndgrf.cxx:539)
==948==    by 0x227121BC: SwGrfNode::MakeCopy(SwDoc*, SwNodeIndex const&) const (ndgrf.cxx:999)
==948==    by 0x22610E4D: SwNodes::_CopyNodes(SwNodeRange const&, SwNodeIndex const&, bool, bool) const (nodes.cxx:1862)
==948==    by 0x225B98E0: SwDoc::CopyWithFlyInFly(SwNodeRange const&, int, SwNodeIndex const&, SwPaM const*, bool, bool, bool) const (ndcopy.cxx:1336)
==948==    by 0x224AC1FF: SwDoc::CopyLayoutFmt(SwFrmFmt const&, SwFmtAnchor const&, bool, bool) (doclay.cxx:446)
==948==    by 0x2294D2D4: SwTxtFlyCnt::CopyFlyFmt(SwDoc*) (atrflyin.cxx:130)
==948==    by 0x229A5B96: MakeTxtAttr(SwDoc&, SfxPoolItem&, int, int, CopyOrNew_t, SwTxtNode*) (thints.cxx:1060)
==948==    by 0x229A64E6: SwTxtNode::InsertItem(SfxPoolItem&, int, int, unsigned short) (thints.cxx:1224)
==948==    by 0x2298E536: SwTxtNode::CopyText(SwTxtNode*, SwIndex const&, SwIndex const&, int, bool) (ndtxt.cxx:1773)
==948==    by 0x2298DC08: SwTxtNode::CopyText(SwTxtNode*, SwIndex const&, int, bool) (ndtxt.cxx:1555)
==948==    by 0x225B4C9D: SwTxtNode::MakeCopy(SwDoc*, SwNodeIndex const&) const (ndcopy.cxx:286)
==948==    by 0x22610E4D: SwNodes::_CopyNodes(SwNodeRange const&, SwNodeIndex const&, bool, bool) const (nodes.cxx:1862)
==948==    by 0x223EF3C2: SwNodes::_Copy(SwNodeRange const&, SwNodeIndex const&, bool) const (ndarr.hxx:182)
==948==    by 0x225B5D8D: SwTableNode::MakeCopy(SwDoc*, SwNodeIndex const&) const (ndcopy.cxx:475)
==948==    by 0x22610ACA: SwNodes::_CopyNodes(SwNodeRange const&, SwNodeIndex const&, bool, bool) const (nodes.cxx:1790)
==948==    by 0x223EF3C2: SwNodes::_Copy(SwNodeRange const&, SwNodeIndex const&, bool) const (ndarr.hxx:182)
==948==    by 0x225CA663: SwSectionNode::MakeCopy(SwDoc*, SwNodeIndex const&) const (ndsect.cxx:1270)
==948==    by 0x22610BFC: SwNodes::_CopyNodes(SwNodeRange const&, SwNodeIndex const&, bool, bool) const (nodes.cxx:1817)
==948==    by 0x223EF3C2: SwNodes::_Copy(SwNodeRange const&, SwNodeIndex const&, bool) const (ndarr.hxx:182)
==948==    by 0x225CA663: SwSectionNode::MakeCopy(SwDoc*, SwNodeIndex const&) const (ndsect.cxx:1270)
==948==    by 0x22610BFC: SwNodes::_CopyNodes(SwNodeRange const&, SwNodeIndex const&, bool, bool) const (nodes.cxx:1817)
==948==    by 0x223EF3C2: SwNodes::_Copy(SwNodeRange const&, SwNodeIndex const&, bool) const (ndarr.hxx:182)
==948==    by 0x225CA663: SwSectionNode::MakeCopy(SwDoc*, SwNodeIndex const&) const (ndsect.cxx:1270)
==948==    by 0x22610BFC: SwNodes::_CopyNodes(SwNodeRange const&, SwNodeIndex const&, bool, bool) const (nodes.cxx:1817)
==948==    by 0x225B98E0: SwDoc::CopyWithFlyInFly(SwNodeRange const&, int, SwNodeIndex const&, SwPaM const*, bool, bool, bool) const (ndcopy.cxx:1336)
==948==    by 0x225B8F15: SwDoc::CopyImpl(SwPaM&, SwPosition&, bool, bool, SwPaM*) const (ndcopy.cxx:1239)
==948==    by 0x225B6EE0: SwDoc::CopyRange(SwPaM&, SwPosition&, bool) const (ndcopy.cxx:707)
==948==    by 0x22667E69: SwEditShell::_CopySelToDoc(SwDoc*, SwNodeIndex*) (edglss.cxx:244)
==948==    by 0x226C8400: SwFEShell::Copy(SwDoc*, rtl::OUString const*) (fecopy.cxx:214)
==948==    by 0x22DBF72B: (anonymous namespace)::lclOverWriteDoc(SwWrtShell&, SwDoc&) (swdtflvr.cxx:373)
==948==    by 0x22DBFBC6: SwTransferable::GetData(com::sun::star::datatransfer::DataFlavor const&, rtl::OUString const&) (swdtflvr.cxx:439)
==948==    by 0x7CB36C7: TransferableHelper::getTransferData2(com::sun::star::datatransfer::DataFlavor const&, rtl::OUString const&) (transfer.cxx:332)
==948==    by 0x7CB34B5: TransferableHelper::getTransferData(com::sun::star::datatransfer::DataFlavor const&) (transfer.cxx:306)
==948==    by 0x17A7E949: x11::SelectionManager::convertData(com::sun::star::uno::Reference<com::sun::star::datatransfer::XTransferable> const&, unsigned long, unsigned long, int&, com::sun::star::uno::Sequence<signed char>&) (X11_selection.cxx:655)
==948==    by 0x17A823CA: x11::SelectionManager::sendData(x11::SelectionAdaptor*, unsigned long, unsigned long, unsigned long, unsigned long) (X11_selection.cxx:1503)
==948==    by 0x17A82E03: x11::SelectionManager::handleSelectionRequest(XSelectionRequestEvent&) (X11_selection.cxx:1729)
==948==    by 0x17A8A08A: x11::SelectionManager::handleXEvent(_XEvent&) (X11_selection.cxx:3574)
==948==  Address 0x21e31a60 is on thread 6's stack
==948==  in frame #40, created by SwEditShell::_CopySelToDoc(SwDoc*, SwNodeIndex*) (edglss.cxx:158)

(regression from 49505336a629a75f4fb48bbe0c532b402e857ed4)

Change-Id: I3d0a288a83b4719dda7977b4898dea656ea67388

2 files changed, 3 insertions, 2 deletions

diff --git a/sw/source/core/edit/eddel.cxx b/sw/source/core/edit/eddel.cxx
index 0cbd8f22c931..8c0e77710bac 100644
--- a/sw/source/core/edit/eddel.cxx
+++ b/sw/source/core/edit/eddel.cxx
@@ -95,7 +95,7 @@ void SwEditShell::DeleteSel( SwPaM& rPam, bool* pUndo )
         if (bSelectAll)
         {
             assert(dynamic_cast<SwShellCrsr*>(&rPam)); // must be corrected pam
-            pNewPam.reset(new SwPaM(rPam));
+            pNewPam.reset(new SwPaM(*rPam.GetMark(), *rPam.GetPoint()));
             // Selection starts at the first para of the first cell, but we
             // want to delete the table node before the first cell as well.
             pNewPam->Start()->nNode = pNewPam->Start()->nNode.GetNode().FindTableNode()->GetIndex();
diff --git a/sw/source/core/edit/edglss.cxx b/sw/source/core/edit/edglss.cxx
index 8139e10df8a5..56475875d8b3 100644
--- a/sw/source/core/edit/edglss.cxx
+++ b/sw/source/core/edit/edglss.cxx
@@ -231,13 +231,14 @@ bool SwEditShell::_CopySelToDoc( SwDoc* pInsDoc, SwNodeIndex* pSttNd )
                     // Make a copy, so that in case we need to adjust the selection
                     // for the purpose of copying, our shell cursor is not touched.
                     // (Otherwise we would have to restore it.)
-                    SwPaM aPaM(rPaM);
+                    SwPaM aPaM(*rPaM.GetMark(), *rPaM.GetPoint());
                     if (bSelectAll)
                     {
                         // Selection starts at the first para of the first cell,
                         // but we want to copy the table and the start node before
                         // the first cell as well.
                         aPaM.Start()->nNode = aPaM.Start()->nNode.GetNode().FindTableNode()->GetIndex();
+                        aPaM.Start()->nContent.Assign(nullptr, 0);
                     }
                     bRet = GetDoc()->getIDocumentContentOperations().CopyRange( aPaM, aPos, /*bCopyAll=*/false, /*bCheckPos=*/true ) || bRet;
                 }