tdf#133933 sw: fix crash on undo of redlined pasted table

This is just a crash fix, there is some deeper problem here around undo:
once redlining is on, overwriting table content during paste does not
delete the fly frames anchored to empty cells (see lcl_CpyBox()), and we
have the same problem on undo as well (see
SwUndoTableCpyTable::UndoImpl()). And node indexes are recorded before
inserting flys, so if they are not deleted, then the indexes don't
match.

Change-Id: I419e96c4d64f70a582358cab3808cea8b0e36649
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/112939
Tested-by: Jenkins
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>

3 files changed, 28 insertions, 1 deletions

diff --git a/sw/qa/core/undo/data/table-copy-redline.odt b/sw/qa/core/undo/data/table-copy-redline.odt
new file mode 100644
index 000000000000..f391687823aa
--- /dev/null
+++ b/sw/qa/core/undo/data/table-copy-redline.odt
diff --git a/sw/qa/core/undo/undo.cxx b/sw/qa/core/undo/undo.cxx
index fd1069e64ae0..0e9ef5b0231e 100644
--- a/sw/qa/core/undo/undo.cxx
+++ b/sw/qa/core/undo/undo.cxx
@@ -84,6 +84,25 @@ CPPUNIT_TEST_FIXTURE(SwCoreUndoTest, testTextboxCutUndo)
     CPPUNIT_ASSERT_EQUAL(pIndex1->GetIndex(), pIndex2->GetIndex());
 }
 
+CPPUNIT_TEST_FIXTURE(SwCoreUndoTest, testTableCopyRedline)
+{
+    // Given a document with two table cells and redlining enabled:
+    load(DATA_DIRECTORY, "table-copy-redline.odt");
+    SwXTextDocument* pTextDoc = dynamic_cast<SwXTextDocument*>(mxComponent.get());
+    SwDocShell* pDocShell = pTextDoc->GetDocShell();
+    SwWrtShell* pWrtShell = pDocShell->GetWrtShell();
+
+    // When doing select-all, copy, paste and undo:
+    pWrtShell->SelAll();
+    rtl::Reference<SwTransferable> pTransfer = new SwTransferable(*pWrtShell);
+    pTransfer->Copy();
+    TransferableDataHelper aHelper(pTransfer);
+    SwTransferable::Paste(*pWrtShell, aHelper);
+
+    // Without the accompanying fix in place, this test would have crashed.
+    pWrtShell->Undo();
+}
+
 CPPUNIT_PLUGIN_IMPLEMENT();
 
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/sw/source/core/undo/untbl.cxx b/sw/source/core/undo/untbl.cxx
index 707ae38541e6..d2a9d5e36808 100644
--- a/sw/source/core/undo/untbl.cxx
+++ b/sw/source/core/undo/untbl.cxx
@@ -2360,7 +2360,15 @@ void SwUndoTableCpyTable::UndoImpl(::sw::UndoRedoContext & rContext)
         if( !pTableNd )
             pTableNd = pSNd->FindTableNode();
 
-        SwTableBox& rBox = *pTableNd->GetTable().GetTableBox( nSttPos );
+        SwTableBox* pBox = pTableNd->GetTable().GetTableBox( nSttPos );
+        if (!pBox)
+        {
+            SAL_WARN("sw.core",
+                     "SwUndoTableCpyTable::UndoImpl: invalid start node index for table box");
+            continue;
+        }
+
+        SwTableBox& rBox = *pBox;
 
         SwNodeIndex aInsIdx( *rBox.GetSttNd(), 1 );
         rDoc.GetNodes().MakeTextNode( aInsIdx, rDoc.GetDfltTextFormatColl() );