sw: fix crash in SwFEShell::SelectObj()

Crashreport signature:

SwContact::GetFormat()
sw/inc/dcontact.hxx:112
SwFEShell::SelectObj(Point const&, unsigned char, SdrObject*)
sw/source/core/frmedt/feshview.cxx:292
SwWrtShell::UnSelectFrame()
sw/source/uibase/wrtsh/select.cxx:326
SwWrtShell::DelRight()
sw/source/uibase/wrtsh/delete.cxx:467
SwBaseShell::ExecDelete(SfxRequest&)
sw/source/uibase/shells/basesh.cxx:198

I.e. it seems that in case we're in the middle of a delete, then it's
possible that the mark list contains an SdrObject that doesn't have a
matching SwClient anymore. Ignore such SdrObjects when looking for the
textbox of a draw shape.

Change-Id: I065b2ea44d39220184a5f604c3ea13f6a106ddb0
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/126563
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Tested-by: Jenkins

1 files changed, 7 insertions, 1 deletions

diff --git a/sw/source/core/frmedt/feshview.cxx b/sw/source/core/frmedt/feshview.cxx
index 1e3c8f2ff150..e0212c28d57c 100644
--- a/sw/source/core/frmedt/feshview.cxx
+++ b/sw/source/core/frmedt/feshview.cxx
@@ -290,7 +290,13 @@ bool SwFEShell::SelectObj( const Point& rPt, sal_uInt8 nFlag, SdrObject *pObj )
         for (size_t i = 0; i < rMrkList.GetMarkCount(); ++i)
         {
             SdrObject* pObject = rMrkList.GetMark(i)->GetMarkedSdrObj();
-            SwFrameFormat* pFormat = GetUserCall(pObject)->GetFormat();
+            SwContact* pContact = GetUserCall(pObject);
+            if (!pContact)
+            {
+                continue;
+            }
+
+            SwFrameFormat* pFormat = pContact->GetFormat();
             if (SwFrameFormat* pShapeFormat = SwTextBoxHelper::getOtherTextBoxFormat(pFormat, RES_FLYFRMFMT))
             {
                 SdrObject* pShape = pShapeFormat->FindSdrObject();