tdf#147006 sw_fieldmarkhide: fix crash when deleting fly with fieldmark

The problem is similar to commit eef10be20a4c5108c68b19ccdda263c5ca852386,
there is a fieldmark in a fly and this results in
UpdateFramesForRemoveDeleteRedline() re-creating fly frames that have
already been deleted in SwUndoFlyBase::DelFly(), and then the
SwFlyAtContentFrame::SwClientNotify() crashes on a null anchor position
in the SwFormat::ResetFormatAttr(RES_ANCHOR).

This time the passed rPam is empty, after removing the dummy characters
of the fieldmark; there isn't really anything to do in this case so
just return.

Change-Id: I475b8fcb0bcf94be58ff553454c261d75076303b
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/129308
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
(cherry picked from commit bdf1d9b8151476531f2fbe06f66db260efcbc529)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/129266
Tested-by: Xisco Fauli <xiscofauli@libreoffice.org>
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>

3 files changed, 61 insertions, 1 deletions

diff --git a/sw/qa/extras/uiwriter/data/tdf147006.rtf b/sw/qa/extras/uiwriter/data/tdf147006.rtf
new file mode 100644
index 000000000000..462c8dc4d52d
--- /dev/null
+++ b/sw/qa/extras/uiwriter/data/tdf147006.rtf
@@ -0,0 +1,24 @@
+{\rtf1\ansi\deff3\adeflang1025
+{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset0 Liberation Serif{\*\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset0 Liberation Sans{\*\falt Arial};}{\f5\fnil\fprq2\fcharset0 Source Han Sans CN;}{\f6\fnil\fprq2\fcharset0 Lohit Devanagari;}{\f7\fnil\fprq0\fcharset128 Lohit Devanagari;}}
+{\colortbl;\red0\green0\blue0;\red0\green0\blue255;\red0\green255\blue255;\red0\green255\blue0;\red255\green0\blue255;\red255\green0\blue0;\red255\green255\blue0;\red255\green255\blue255;\red0\green0\blue128;\red0\green128\blue128;\red0\green128\blue0;\red128\green0\blue128;\red128\green0\blue0;\red128\green128\blue0;\red128\green128\blue128;\red192\green192\blue192;}
+{\stylesheet{\s0\snext0\rtlch\af6\afs24\alang1081 \ltrch\lang1031\langfe2052\hich\af3\loch\widctlpar\hyphpar0\ltrpar\cf0\f3\fs24\lang1031\kerning1\dbch\af8\langfe2052 Normal;}
+{\s20\sbasedon0\snext20 Frame Contents;}
+}{\*\generator LibreOfficeDev/7.4.0.0.alpha0$Linux_X86_64 LibreOffice_project/086efd30b2f5857d2b155099ec06c522d57ad81f}{\info{\creatim\yr2022\mo2\dy1\hr21\min9}{\revtim\yr2022\mo2\dy1\hr21\min10}{\printim\yr0\mo0\dy0\hr0\min0}}{\*\userprops}\deftab709
+\hyphauto1\viewscale100
+{\*\pgdsctbl
+{\pgdsc0\pgdscuse451\pgwsxn11906\pghsxn16838\marglsxn1134\margrsxn1134\margtsxn1134\margbsxn1134\pgdscnxt0 Default Page Style;}}
+\formshade\paperh16838\paperw11906\margl1134\margr1134\margt1134\margb1134\sectd\sbknone\pgndec\sftnnar\saftnnrlc\sectunlocked1\pgwsxn11906\pghsxn16838\marglsxn1134\margrsxn1134\margtsxn1134\margbsxn1134\ftnbj\ftnstart1\ftnrstcont\ftnnar\aenddoc\aftnrstcont\aftnstart1\aftnnrlc
+{\*\ftnsep\chftnsep}\pard\plain \s0\rtlch\af6\afs24\alang1081 \ltrch\lang1031\langfe2052\hich\af3\loch\widctlpar\hyphpar0\ltrpar\cf0\f3\fs24\lang1031\kerning1\dbch\af8\langfe2052\loch\ql\ltrpar\loch
+{\shp{\*\shpinst\shpwr2\shpwrk0\shpbypara\shpbyignore\shptop114\shpbottom1248\shpbxcolumn\shpbxignore\shpleft4252\shpright5386\shpz0{\sp{\sn shapeType}{\sv 202}}{\sp{\sn dxWrapDistLeft}{\sv 72390}}{\sp{\sn dxWrapDistRight}{\sv 72390}}{\sp{\sn dyWrapDistTop}{\sv 72390}}{\sp{\sn dyWrapDistBottom}{\sv 72390}}{\sp{\sn posrelv}{\sv 2}}{\sp{\sn posv}{\sv 1}}{\sp{\sn posrelh}{\sv 2}}{\sp{\sn posh}{\sv 2}}{\sp{\sn dxTextLeft}{\sv 53975}}{\sp{\sn dyTextTop}{\sv 53975}}{\sp{\sn dxTextRight}{\sv 53975}}{\sp{\sn dyTextBottom}{\sv 53975}}{\sp{\sn lineColor}{\sv 0}}{\sp{\sn lineWidth}{\sv 635}}{\shptxt\pgndec\s20\loch\ql{
+{\*\shppict{\pict{\*\picprop{\sp{\sn wzDescription}{\sv }}{\sp{\sn wzName}{\sv }}}\picscalex100\picscaley100\piccropl0\piccropr0\piccropt0\piccropb0\picw19\pich19\picwgoal380\pichgoal380\pngblip
+89504e470d0a1a0a0000000d4948445200000013000000130806000000725036cc000000017352474200aece1ce900000006624b474400ff00ff00ffa0bda793
+000000097048597300000b1300000b1301009a9c180000000774494d4507db0906123403a1d7aeb2000000654944415438cb63fcffff3f03b50013318a2497b0
+fca78a6130838831908914171132908954afe13390899c30c225cf446e606353c7448e41b8d433e133e879cc1f467c7c747d3823009b467ce20c0c0c0c2cc428
+22d64026062a8251c38693618cd42c6901c5e32de14bf6d21e0000000049454e44ae426082}}
+}{\loch
+{\field{\*\fldinst { FORMTEXT }{\loch
+}}{\fldrslt {}{\loch
+}}}}
+\par \pard}}}
+
+\par }
diff --git a/sw/qa/extras/uiwriter/uiwriter2.cxx b/sw/qa/extras/uiwriter/uiwriter2.cxx
index 65142dbd64e1..988225938a89 100644
--- a/sw/qa/extras/uiwriter/uiwriter2.cxx
+++ b/sw/qa/extras/uiwriter/uiwriter2.cxx
@@ -3678,6 +3678,41 @@ CPPUNIT_TEST_FIXTURE(SwUiWriterTest2, testMixedFormFieldInsertion)
     CPPUNIT_ASSERT_EQUAL(sal_Int32(3), pMarkAccess->getAllMarksCount());
 }
 
+CPPUNIT_TEST_FIXTURE(SwUiWriterTest2, testTdf147006)
+{
+    SwDoc* const pDoc = createSwDoc(DATA_DIRECTORY, "tdf147006.rtf");
+
+    IDocumentMarkAccess& rIDMA(*pDoc->getIDocumentMarkAccess());
+    CPPUNIT_ASSERT_EQUAL(size_t(1), pDoc->GetFlyCount(FLYCNTTYPE_FRM));
+    CPPUNIT_ASSERT_EQUAL(size_t(1), pDoc->GetFlyCount(FLYCNTTYPE_GRF));
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(1), rIDMA.getAllMarksCount());
+    CPPUNIT_ASSERT_EQUAL(std::iterator_traits<IDocumentMarkAccess::iterator>::difference_type(1),
+                         std::distance(rIDMA.getFieldmarksBegin(), rIDMA.getFieldmarksEnd()));
+
+    dispatchCommand(mxComponent, ".uno:SelectAll", {});
+    // this crashed
+    dispatchCommand(mxComponent, ".uno:Delete", {});
+    CPPUNIT_ASSERT_EQUAL(size_t(0), pDoc->GetFlyCount(FLYCNTTYPE_FRM));
+    CPPUNIT_ASSERT_EQUAL(size_t(0), pDoc->GetFlyCount(FLYCNTTYPE_GRF));
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(0), rIDMA.getAllMarksCount());
+    dispatchCommand(mxComponent, ".uno:Undo", {});
+    CPPUNIT_ASSERT_EQUAL(size_t(1), pDoc->GetFlyCount(FLYCNTTYPE_FRM));
+    CPPUNIT_ASSERT_EQUAL(size_t(1), pDoc->GetFlyCount(FLYCNTTYPE_GRF));
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(1), rIDMA.getAllMarksCount());
+    dispatchCommand(mxComponent, ".uno:Redo", {});
+    CPPUNIT_ASSERT_EQUAL(size_t(0), pDoc->GetFlyCount(FLYCNTTYPE_FRM));
+    CPPUNIT_ASSERT_EQUAL(size_t(0), pDoc->GetFlyCount(FLYCNTTYPE_GRF));
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(0), rIDMA.getAllMarksCount());
+    dispatchCommand(mxComponent, ".uno:Undo", {});
+    CPPUNIT_ASSERT_EQUAL(size_t(1), pDoc->GetFlyCount(FLYCNTTYPE_FRM));
+    CPPUNIT_ASSERT_EQUAL(size_t(1), pDoc->GetFlyCount(FLYCNTTYPE_GRF));
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(1), rIDMA.getAllMarksCount());
+    dispatchCommand(mxComponent, ".uno:Redo", {});
+    CPPUNIT_ASSERT_EQUAL(size_t(0), pDoc->GetFlyCount(FLYCNTTYPE_FRM));
+    CPPUNIT_ASSERT_EQUAL(size_t(0), pDoc->GetFlyCount(FLYCNTTYPE_GRF));
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(0), rIDMA.getAllMarksCount());
+}
+
 CPPUNIT_TEST_FIXTURE(SwUiWriterTest2, testTdf124261)
 {
 #if !defined(_WIN32)
diff --git a/sw/source/core/doc/DocumentRedlineManager.cxx b/sw/source/core/doc/DocumentRedlineManager.cxx
index 69bbf3d7ac67..a3de2c9143fb 100644
--- a/sw/source/core/doc/DocumentRedlineManager.cxx
+++ b/sw/source/core/doc/DocumentRedlineManager.cxx
@@ -246,7 +246,8 @@ void UpdateFramesForAddDeleteRedline(SwDoc & rDoc, SwPaM const& rPam)
 
 void UpdateFramesForRemoveDeleteRedline(SwDoc & rDoc, SwPaM const& rPam)
 {
-    if (rDoc.IsClipBoard())
+    // tdf#147006 fieldmark command may be empty => do not call AppendAllObjs()
+    if (rDoc.IsClipBoard() || *rPam.GetPoint() == *rPam.GetMark())
     {
         return;
     }