forcepoint#93 fix crash on layout of specific rtf

Change-Id: Id81729de2efd6f65f1b51bdb437ca21a260eaf6e
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132143
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>

6 files changed, 15 insertions, 7 deletions

diff --git a/sw/qa/extras/layout/data/forcepoint93-1.rtf b/sw/qa/extras/layout/data/forcepoint93-1.rtf
new file mode 100644
index 000000000000..d3af2eaf9782
--- /dev/null
+++ b/sw/qa/extras/layout/data/forcepoint93-1.rtf
diff --git a/sw/qa/extras/layout/data/forcepoint93-2.rtf b/sw/qa/extras/layout/data/forcepoint93-2.rtf
new file mode 100644
index 000000000000..a9843bc73aad
--- /dev/null
+++ b/sw/qa/extras/layout/data/forcepoint93-2.rtf
diff --git a/sw/qa/extras/layout/layout.cxx b/sw/qa/extras/layout/layout.cxx
index cad027def8a2..6df37719bf53 100644
--- a/sw/qa/extras/layout/layout.cxx
+++ b/sw/qa/extras/layout/layout.cxx
@@ -2642,6 +2642,13 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter, testForcepoint92)
 }
 
 //just care it doesn't crash/assert
+CPPUNIT_TEST_FIXTURE(SwLayoutWriter, testForcepoint93)
+{
+    createSwDoc(DATA_DIRECTORY, "forcepoint93-1.rtf");
+    createSwDoc(DATA_DIRECTORY, "forcepoint93-2.rtf");
+}
+
+//just care it doesn't crash/assert
 CPPUNIT_TEST_FIXTURE(SwLayoutWriter, testForcepoint94)
 {
     createSwWebDoc(DATA_DIRECTORY, "forcepoint94.html");
diff --git a/sw/source/core/inc/frame.hxx b/sw/source/core/inc/frame.hxx
index 1d43850c7e9a..7cb9dffc27bc 100644
--- a/sw/source/core/inc/frame.hxx
+++ b/sw/source/core/inc/frame.hxx
@@ -443,7 +443,7 @@ protected:
     bool mbColLocked     : 1;  // lock Grow/Shrink for column-wise section
                                   // or fly frames, will be set in Format
     bool m_isInDestroy : 1;
-    bool mbForbidDelete : 1;
+    int mnForbidDelete;
 
     void ColLock()      { mbColLocked = true; }
     void ColUnlock()    { mbColLocked = false; }
@@ -884,7 +884,7 @@ public:
     bool IsProtected() const;
 
     bool IsColLocked()  const { return mbColLocked; }
-    virtual bool IsDeleteForbidden() const { return mbForbidDelete; }
+    virtual bool IsDeleteForbidden() const { return mnForbidDelete > 0; }
 
     /// this is the only way to delete a SwFrame instance
     static void DestroyFrame(SwFrame *const pFrame);
@@ -924,8 +924,8 @@ public:
     void RegisterToFormat( SwFormat& rFormat );
     void ValidateThisAndAllLowers( const sal_uInt16 nStage );
 
-    void ForbidDelete()      { mbForbidDelete = true; }
-    void AllowDelete()    { mbForbidDelete = false; }
+    void ForbidDelete() { ++mnForbidDelete; }
+    void AllowDelete() { assert(mnForbidDelete > 0); --mnForbidDelete; }
 
     drawinglayer::attribute::SdrAllFillAttributesHelperPtr getSdrAllFillAttributesHelper() const;
     bool supportsFullDrawingLayerFillAttributeSet() const;
@@ -1262,8 +1262,7 @@ public:
     //it in e.g. SwSectionFrame::MergeNext etc because we will need it
     //again after the SwFrameDeleteGuard dtor
     explicit SwFrameDeleteGuard(SwFrame* pFrame)
-        : m_pForbidFrame((pFrame && !pFrame->IsDeleteForbidden()) ?
-            pFrame : nullptr)
+        : m_pForbidFrame(pFrame)
     {
         if (m_pForbidFrame)
             m_pForbidFrame->ForbidDelete();
diff --git a/sw/source/core/layout/objectformattertxtfrm.cxx b/sw/source/core/layout/objectformattertxtfrm.cxx
index e250f7c43680..6b2503d40c39 100644
--- a/sw/source/core/layout/objectformattertxtfrm.cxx
+++ b/sw/source/core/layout/objectformattertxtfrm.cxx
@@ -876,6 +876,8 @@ void SwObjectFormatterTextFrame::FormatAnchorFrameAndItsPrevs( SwTextFrame& _rAn
                 // Thus, check for valid <pFrame>.
                 while ( pFrame && pFrame != pSectFrame )
                 {
+                    SwFrameDeleteGuard aDeleteFrameGuard(pFrame);
+
                     if ( pFrame->IsLayoutFrame() )
                         lcl_FormatContentOfLayoutFrame( static_cast<SwLayoutFrame*>(pFrame) );
                     else
diff --git a/sw/source/core/layout/wsfrm.cxx b/sw/source/core/layout/wsfrm.cxx
index 5b322676330d..ca3478b3f85f 100644
--- a/sw/source/core/layout/wsfrm.cxx
+++ b/sw/source/core/layout/wsfrm.cxx
@@ -318,7 +318,7 @@ SwFrame::SwFrame( sw::BroadcastingModify *pMod, SwFrame* pSib )
     mbInfSct ( false ),
     mbColLocked(false),
     m_isInDestroy(false),
-    mbForbidDelete(false)
+    mnForbidDelete(0)
 {
     OSL_ENSURE( pMod, "No frame format given." );
 }