fdo#76312: LO crashes - endTableCell is called before StartTable.

- m_oldTableReference values were not being reset.
- A call for DocxAttributeOutput::switchHeaderFooter from
DocxExport::WriteHeadersFooters would end up using the m_oldTableReference
value saved by DocxAttributeOutput::EndParagraph, which is incorrect.
- Fixed this issue and added an UT for the same.

Change-Id: I5ac51c3449e78bd26389e93e0d733d429dcc6874
Reviewed-on: https://gerrit.libreoffice.org/8659
Reviewed-by: Miklos Vajna <vmiklos@collabora.co.uk>
Tested-by: Miklos Vajna <vmiklos@collabora.co.uk>

3 files changed, 15 insertions, 1 deletions

diff --git a/sw/qa/extras/ooxmlexport/data/FDO76312.docx b/sw/qa/extras/ooxmlexport/data/FDO76312.docx
new file mode 100644
index 000000000000..b41ae7a720fa
--- /dev/null
+++ b/sw/qa/extras/ooxmlexport/data/FDO76312.docx
diff --git a/sw/qa/extras/ooxmlexport/ooxmlexport.cxx b/sw/qa/extras/ooxmlexport/ooxmlexport.cxx
index 11c1ab076e8a..00deeb3e4d39 100644
--- a/sw/qa/extras/ooxmlexport/ooxmlexport.cxx
+++ b/sw/qa/extras/ooxmlexport/ooxmlexport.cxx
@@ -2719,6 +2719,15 @@ DECLARE_OOXMLEXPORT_TEST(test_OpeningBrace, "2120112713_OpenBrace.docx")
     assertXPath(pXmlDoc, "/w:document/w:body/w:p[1]/m:oMath[1]/m:d[1]/m:dPr[1]/m:begChr[1]","val","");
 }
 
+DECLARE_OOXMLEXPORT_TEST(testFDO76312, "FDO76312.docx")
+{
+    xmlDocPtr pXmlDoc = parseExport("word/document.xml");
+    if (!pXmlDoc)
+        return;
+
+    assertXPath(pXmlDoc, "/w:document/w:body/w:tbl[1]/w:tr[1]/w:tc[1]");
+}
+
 DECLARE_OOXMLEXPORT_TEST(test_FieldType, "99_Fields.docx")
 {
     xmlDocPtr pXmlDoc = parseExport("word/document.xml");
diff --git a/sw/source/filter/ww8/docxattributeoutput.cxx b/sw/source/filter/ww8/docxattributeoutput.cxx
index 69d4759e8230..a0883679693b 100644
--- a/sw/source/filter/ww8/docxattributeoutput.cxx
+++ b/sw/source/filter/ww8/docxattributeoutput.cxx
@@ -2490,6 +2490,9 @@ void DocxAttributeOutput::switchHeaderFooter(bool isHeaderFooter, sal_Int32 inde
     else if( index == -1)
     {
         *m_tableReference = *m_oldTableReference;
+        //Reset the oldReference, after copying it back to the original.
+        m_oldTableReference->m_bTableCellOpen = false ;
+        m_oldTableReference->m_nTableDepth = 0;
     }
     else
     {
@@ -2519,7 +2522,9 @@ void DocxAttributeOutput::EndTable()
 
     // We closed the table; if it is a nested table, the cell that contains it
     // still continues
-    m_tableReference->m_bTableCellOpen = true;
+    // set to true only if we were in a nested table, not otherwise.
+    if( 0 != tableFirstCells.size() )
+        m_tableReference->m_bTableCellOpen = true;
 
     // Cleans the table helper
     delete m_pTableWrt, m_pTableWrt = NULL;