tdf#108118 sw: fix recursive layouting during SwCursorShell::Paint()

The problem, in a nutshell, is that SwDrawContact::Changed() is called
during layout, and recursively starts another layout that removes a
drawing object that is being iterated over in frame #28
SwObjectFormatter::FormatObjsAtFrame_() from the layout.

Apparently SwDrawContact::Changed() is by far the most dangerous
function to call during layout; set the quite targeted flag
SetCallbackActionEnabled() to prevent the recursion.

0  SwSortedObjs::Remove(SwAnchoredObject&) (this=0x73e4a00, _rAnchoredObj=...) at sw/source/core/layout/sortedobjs.cxx:228
1  SwFrame::RemoveDrawObj(SwAnchoredObject&) (this=0x9430e20, _rToRemoveObj=...) at sw/source/core/layout/fly.cxx:2076
2  SwDrawVirtObj::RemoveFromWriterLayout() (this=0x95ce130) at sw/source/core/draw/dcontact.cxx:2199
3  SwDrawContact::DisconnectObjFromLayout(SdrObject*) (this=0x70fef00, _pDrawObj=0x95ce130) at sw/source/core/draw/dcontact.cxx:1663
4  SwLayoutFrame::DestroyImpl() (this=0x91c6c60) at sw/source/core/layout/ssfrm.cxx:489
5  SwFrame::DestroyFrame(SwFrame*) (pFrame=0x91c6c60) at sw/source/core/layout/ssfrm.cxx:389
6  SwLayoutFrame::DestroyImpl() (this=0x9435cd0) at sw/source/core/layout/ssfrm.cxx:500
7  SwPageFrame::DestroyImpl() (this=0x9435cd0) at sw/source/core/layout/pagechg.cxx:270
8  SwFrame::DestroyFrame(SwFrame*) (pFrame=0x9435cd0) at sw/source/core/layout/ssfrm.cxx:389
9  SwRootFrame::RemovePage(SwPageFrame**, SwRemoveResult) (this=0x36b26f0, pDelRef=0x7ffeafbf2e38, eResult=SwRemoveResult::Prev) at sw/source/core/layout/pagechg.cxx:1351
10 SwRootFrame::RemoveSuperfluous() (this=0x36b26f0) at sw/source/core/layout/pagechg.cxx:1426
11 SwLayAction::InternalAction(OutputDevice*) (this=0x7ffeafbf3250, pRenderContext=0x3595030) at sw/source/core/layout/layact.cxx:502
12 SwLayAction::Action(OutputDevice*) (this=0x7ffeafbf3250, pRenderContext=0x3595030) at sw/source/core/layout/layact.cxx:351
13 SwViewShell::ImplEndAction(bool) (this=0x364cc00, bIdleEnd=false) at sw/source/core/view/viewsh.cxx:279
14 SwViewShell::EndAction(bool) (this=0x364cc00, bIdleEnd=false) at sw/inc/viewsh.hxx:605
15 SwCursorShell::EndAction(bool, bool) (this=0x364cc00, bIdleEnd=false, DoSetPosX=false) at sw/source/core/crsr/crsrsh.cxx:259
16 SwRootFrame::EndAllAction(bool) (this=0x36b26f0, bVirDev=false) at sw/source/core/layout/pagechg.cxx:1728
17 SwDrawContact::Changed(SdrObject const&, SdrUserCallType, tools::Rectangle const&) (this=0x70fef00, rObj=..., eType=SdrUserCallType::MoveOnly, rOldBoundRect=...) at sw/source/core/draw/dcontact.cxx:985
18 SdrObject::SendUserCall(SdrUserCallType, tools::Rectangle const&) const (this=0x95ce130, eUserCall=SdrUserCallType::MoveOnly, rBoundRect=...) at svx/source/svdraw/svdobj.cxx:2736
19 SdrObject::Move(Size const&) (this=0x95ce130, rSiz=Size = {...}) at svx/source/svdraw/svdobj.cxx:1482
20 SwDrawVirtObj::Move(Size const&) (this=0x95ce130, rSiz=Size = {...}) at sw/source/core/draw/dcontact.cxx:2366
21 SwAnchoredDrawObject::SetObjTop_(long) (this=0x95ce250, _nTop=777490) at sw/source/core/layout/anchoreddrawobject.cxx:677
22 SwAnchoredObject::SetObjTop(long) (this=0x95ce250, _nTop=777490) at sw/source/core/layout/anchoredobject.cxx:593
23 objectpositioning::SwToContentAnchoredObjectPosition::CalcPosition() (this=0x7ffeafbf3980) at sw/source/core/objectpositioning/tocntntanchoredobjectposition.cxx:739
24 SwAnchoredDrawObject::MakeObjPosAnchoredAtPara() (this=0x95ce250) at sw/source/core/layout/anchoreddrawobject.cxx:421
25 SwAnchoredDrawObject::MakeObjPos() (this=0x95ce250) at sw/source/core/layout/anchoreddrawobject.cxx:318
26 SwObjectFormatter::FormatObj_(SwAnchoredObject&) (this=0x90623d0, _rAnchoredObj=...) at sw/source/core/layout/objectformatter.cxx:374
27 SwObjectFormatterTextFrame::DoFormatObj(SwAnchoredObject&, bool) (this=0x90623d0, _rAnchoredObj=..., _bCheckForMovedFwd=false) at sw/source/core/layout/objectformattertxtfrm.cxx:126
28 SwObjectFormatter::FormatObjsAtFrame_(SwTextFrame*) (this=0x90623d0, _pMasterTextFrame=0x0) at sw/source/core/layout/objectformatter.cxx:443
29 SwObjectFormatterTextFrame::DoFormatObjs() (this=0x90623d0) at sw/source/core/layout/objectformattertxtfrm.cxx:328
30 SwObjectFormatter::FormatObjsAtFrame(SwFrame&, SwPageFrame const&, SwLayAction*) (_rAnchorFrame=..., _rPageFrame=..., _pLayAction=0x0) at sw/source/core/layout/objectformatter.cxx:191
31 SwHeadFootFrame::FormatSize(long, SwBorderAttrs const*) (this=0x91c6c60, nUL=663, pAttrs=0x8fbc530) at sw/source/core/layout/hffrm.cxx:263
32 SwHeadFootFrame::Format(OutputDevice*, SwBorderAttrs const*) (this=0x91c6c60, pRenderContext=0x3595030, pAttrs=0x8fbc530) at sw/source/core/layout/hffrm.cxx:416
33 SwLayoutFrame::MakeAll(OutputDevice*) (this=0x91c6c60) at sw/source/core/layout/calcmove.cxx:913
34 SwFrame::PrepareMake(OutputDevice*) (this=0x91c6c60, pRenderContext=0x3595030) at sw/source/core/layout/calcmove.cxx:346
35 SwFrame::Calc(OutputDevice*) const (this=0x91c6c60, pRenderContext=0x3595030) at sw/source/core/layout/trvlfrm.cxx:1783
36 lcl_FormatLay(SwLayoutFrame*) (pLay=0x91c6c60) at sw/source/core/layout/pagechg.cxx:360
37 lcl_FormatLay(SwLayoutFrame*) (pLay=0x9435cd0) at sw/source/core/layout/pagechg.cxx:357
38 SwPageFrame::PreparePage(bool) (this=0x9435cd0, bFootnote=false) at sw/source/core/layout/pagechg.cxx:456
39 (anonymous namespace)::doInsertPage(SwRootFrame*, SwPageFrame**, SwFrameFormat*, SwPageDesc*, bool, SwPageFrame**) (pRoot=0x36b26f0, pRefSibling=0x7ffeafbf43c8, pFormat=0x3076050, pDesc=0x3076010, bFootnote=false, pRefPage=0x7ffeafbf43d8) at sw/source/core/layout/pagechg.cxx:1210
40 SwFrame::InsertPage(SwPageFrame*, bool) (this=0x3620d70, pPrevPage=0x9227900, bFootnote=false) at sw/source/core/layout/pagechg.cxx:1269
41 SwFrame::GetNextLeaf(MakePageType) (this=0x3620d70, eMakePage=MAKEPAGE_INSERT) at sw/source/core/layout/flowfrm.cxx:994
42 SwFrame::GetLeaf(MakePageType, bool) (this=0x3620d70, eMakePage=MAKEPAGE_INSERT, bFwd=true) at sw/source/core/layout/flowfrm.cxx:797
43 SwFlowFrame::MoveFwd(bool, bool, bool) (this=0x3620e18, bMakePage=true, bPageBreak=false, bMoveAlways=false) at sw/source/core/layout/flowfrm.cxx:1851
44 SwContentFrame::MakeAll(OutputDevice*) (this=0x3620d70) at sw/source/core/layout/calcmove.cxx:1681
45 SwFrame::PrepareMake(OutputDevice*) (this=0x707a340, pRenderContext=0x3595030) at sw/source/core/layout/calcmove.cxx:312
46 SwFrame::Calc(OutputDevice*) const (this=0x707a340, pRenderContext=0x3595030) at sw/source/core/layout/trvlfrm.cxx:1783
47 GetFrameOfModify(SwRootFrame const*, SwModify const&, SwFrameType, Point const*, SwPosition const*, bool) (pLayout=0x36b26f0, rMod=..., nFrameType=(SwFrameType::Txt | SwFrameType::NoTxt), pPoint=0x707c6f0, pPos=0x707c720, bCalcFrame=true) at sw/source/core/layout/frmtool.cxx:3247
48 SwContentNode::getLayoutFrame(SwRootFrame const*, Point const*, SwPosition const*, bool) const (this=0x71328c0, _pRoot=0x36b26f0, pPoint=0x707c6f0, pPos=0x707c720, bCalcFrame=true) at sw/source/core/docnode/node.cxx:1118
49 SwRootFrame::CalcFrameRects(SwShellCursor&) (this=0x36b26f0, rCursor=...) at sw/source/core/layout/trvlfrm.cxx:2028
50 SwShellCursor::FillRects() (this=0x707c680) at sw/source/core/crsr/viscrs.cxx:609
51 SwSelPaintRects::Show(std::__debug::vector<rtl::OString, std::allocator<rtl::OString> >*) (this=0x707c680, pSelectionRectangles=0x7ffeafbf5570) at sw/source/core/crsr/viscrs.cxx:332
52 SwShellCursor::Show(SfxViewShell*) (this=0x707c680, pViewShell=0x0) at sw/source/core/crsr/viscrs.cxx:619
53 SwCursorShell::Paint(OutputDevice&, tools::Rectangle const&) (this=0x364cc00, rRenderContext=..., rRect=...) at sw/source/core/crsr/crsrsh.cxx:1283
54 SwEditWin::Paint(OutputDevice&, tools::Rectangle const&) (this=0x3595030, rRenderContext=..., rRect=...) at sw/source/uibase/docvw/edtwin2.cxx:476

Change-Id: I1b237f0f425e58bb95bae9f19019f26fe5da21fd

4 files changed, 28 insertions, 24 deletions

diff --git a/sw/source/core/inc/rootfrm.hxx b/sw/source/core/inc/rootfrm.hxx
index 66a3e590a490..73c020e8e9a8 100644
--- a/sw/source/core/inc/rootfrm.hxx
+++ b/sw/source/core/inc/rootfrm.hxx
@@ -420,6 +420,28 @@ inline  void SwRootFrame::SetVirtPageNum( const bool bOf) const
     const_cast<SwRootFrame*>(this)->mbIsVirtPageNum = bOf;
 }
 
+/// helper class to disable creation of an action by a callback event
+/// in particular, change event from a drawing object (SwDrawContact::Changed())
+class DisableCallbackAction
+{
+    private:
+        SwRootFrame & m_rRootFrame;
+        bool m_bOldCallbackActionState;
+
+    public:
+        explicit DisableCallbackAction(SwRootFrame & rRootFrame)
+            : m_rRootFrame(rRootFrame)
+            , m_bOldCallbackActionState(rRootFrame.IsCallbackActionEnabled())
+        {
+            m_rRootFrame.SetCallbackActionEnabled(false);
+        }
+
+        ~DisableCallbackAction()
+        {
+            m_rRootFrame.SetCallbackActionEnabled(m_bOldCallbackActionState);
+        }
+};
+
 #endif // INCLUDED_SW_SOURCE_CORE_INC_ROOTFRM_HXX
 
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/sw/source/core/layout/flylay.cxx b/sw/source/core/layout/flylay.cxx
index 47b10ca812d2..17dbc5086bac 100644
--- a/sw/source/core/layout/flylay.cxx
+++ b/sw/source/core/layout/flylay.cxx
@@ -800,7 +800,7 @@ void SwPageFrame::AppendDrawObjToPage( SwAnchoredObject& _rNewObj )
         static_cast<SwRootFrame*>(GetUpper())->InvalidateBrowseWidth();
     }
 
-    OSL_ENSURE( _rNewObj.GetAnchorFrame(), "anchored draw object without anchor" );
+    assert(_rNewObj.GetAnchorFrame());
     SwFlyFrame* pFlyFrame = const_cast<SwFlyFrame*>(_rNewObj.GetAnchorFrame()->FindFlyFrame());
     if ( pFlyFrame &&
          _rNewObj.GetDrawObj()->GetOrdNum() < pFlyFrame->GetVirtDrawObj()->GetOrdNum() )
diff --git a/sw/source/core/layout/frmtool.cxx b/sw/source/core/layout/frmtool.cxx
index 1ebc28a52498..1fe27ac3cf6e 100644
--- a/sw/source/core/layout/frmtool.cxx
+++ b/sw/source/core/layout/frmtool.cxx
@@ -3234,6 +3234,8 @@ SwFrame* GetFrameOfModify( const SwRootFrame* pLayout, SwModify const& rMod, SwF
 
                     if( bCalcFrame )
                     {
+                        // tdf#108118 prevent recursion
+                        DisableCallbackAction a(*pTmpFrame->getRootFrame());
                         // - format parent Writer
                         // fly frame, if it isn't been formatted yet.
                         // Note: The Writer fly frame could be the frame itself.
diff --git a/sw/source/core/layout/trvlfrm.cxx b/sw/source/core/layout/trvlfrm.cxx
index 60e1ed637138..05864d10a4ba 100644
--- a/sw/source/core/layout/trvlfrm.cxx
+++ b/sw/source/core/layout/trvlfrm.cxx
@@ -1449,28 +1449,6 @@ void SwPageFrame::GetContentPosition( const Point &rPt, SwPosition &rPos ) const
     }
 }
 
-// #123110# - helper class to disable creation of an action
-// by a callback event - e.g., change event from a drawing object
-class DisableCallbackAction
-{
-    private:
-        SwRootFrame& mrRootFrame;
-        bool mbOldCallbackActionState;
-
-    public:
-        explicit DisableCallbackAction( const SwRootFrame& _rRootFrame ) :
-            mrRootFrame( const_cast<SwRootFrame&>(_rRootFrame) ),
-            mbOldCallbackActionState( _rRootFrame.IsCallbackActionEnabled() )
-        {
-            mrRootFrame.SetCallbackActionEnabled( false );
-        }
-
-        ~DisableCallbackAction()
-        {
-            mrRootFrame.SetCallbackActionEnabled( mbOldCallbackActionState );
-        }
-};
-
 /** Search the nearest Content to the passed point.
  *
  * Only search inside the BodyText.
@@ -1483,7 +1461,7 @@ Point SwRootFrame::GetNextPrevContentPos( const Point& rPoint, bool bNext ) cons
     // #123110# - disable creation of an action by a callback
     // event during processing of this method. Needed because formatting is
     // triggered by this method.
-    DisableCallbackAction aDisableCallbackAction( *this );
+    DisableCallbackAction aDisableCallbackAction(const_cast<SwRootFrame&>(*this));
     //Search the first ContentFrame and his successor in the body area.
     //To be efficient (and not formatting too much) we'll start at the correct
     //page.
@@ -2019,6 +1997,8 @@ void SwRootFrame::CalcFrameRects(SwShellCursor &rCursor)
         return;
     }
 
+    DisableCallbackAction a(*this); // the GetCharRect below may format
+
     //First obtain the ContentFrames for the start and the end - those are needed
     //anyway.
     SwContentFrame const* pStartFrame = pStartPos->nNode.GetNode().