forcepoint#103 avoid crash on layout of specific html

return early if the prev frame was unexpectedly deleted

and another similar case to forcepoint#100 and drop a
SwBorderAttrAccess to allow the cache entry to be removed
in SwCache::DeleteObj

Change-Id: Ia83fe8911e2f6071a28d69c3089a96e3b87cc548
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132487
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>

4 files changed, 18 insertions, 1 deletions

diff --git a/sw/qa/extras/layout/data/forcepoint103.html b/sw/qa/extras/layout/data/forcepoint103.html
new file mode 100644
index 000000000000..006a6d340ef0
--- /dev/null
+++ b/sw/qa/extras/layout/data/forcepoint103.html
diff --git a/sw/qa/extras/layout/layout.cxx b/sw/qa/extras/layout/layout.cxx
index a788bd9171d1..e02f0202f406 100644
--- a/sw/qa/extras/layout/layout.cxx
+++ b/sw/qa/extras/layout/layout.cxx
@@ -2549,6 +2549,12 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter, testForcepoint102)
 }
 
 //just care it doesn't crash/assert
+CPPUNIT_TEST_FIXTURE(SwLayoutWriter, testForcepoint103)
+{
+    createSwWebDoc(DATA_DIRECTORY, "forcepoint103.html");
+}
+
+//just care it doesn't crash/assert
 CPPUNIT_TEST_FIXTURE(SwLayoutWriter, testTdf147485Forcepoint)
 {
     createSwDoc(DATA_DIRECTORY, "tdf147485-forcepoint.doc");
diff --git a/sw/source/core/layout/layact.cxx b/sw/source/core/layout/layact.cxx
index 558cbdff22f8..bb46c23e11a3 100644
--- a/sw/source/core/layout/layact.cxx
+++ b/sw/source/core/layout/layact.cxx
@@ -60,6 +60,7 @@
 #include <mdiexp.hxx>
 #include <sectfrm.hxx>
 #include <acmplwrd.hxx>
+#include <deletelistener.hxx>
 #include <sortedobjs.hxx>
 #include <objectformatter.hxx>
 #include <fntcache.hxx>
@@ -1694,7 +1695,10 @@ bool SwLayAction::FormatContent(SwPageFrame *const pPage)
             // We do this so we don't have to search later on.
             const bool bNxtCnt = IsCalcLayout() && !pContent->GetFollow();
             const SwContentFrame *pContentNext = bNxtCnt ? pContent->GetNextContentFrame() : nullptr;
-            const SwContentFrame *pContentPrev = pContent->GetPrev() ? pContent->GetPrevContentFrame() : nullptr;
+            SwContentFrame* const pContentPrev = pContent->GetPrev() ? pContent->GetPrevContentFrame() : nullptr;
+            std::optional<SfxDeleteListener> oPrevDeleteListener;
+            if (pContentPrev)
+                oPrevDeleteListener.emplace(*pContentPrev);
 
             const SwLayoutFrame*pOldUpper  = pContent->GetUpper();
             const SwTabFrame *pTab = pContent->FindTabFrame();
@@ -1773,6 +1777,12 @@ bool SwLayAction::FormatContent(SwPageFrame *const pPage)
             bool bSetContent = true;
             if ( pContentPrev )
             {
+                if (oPrevDeleteListener->WasDeleted())
+                {
+                    SAL_WARN("sw", "ContentPrev was deleted");
+                    return false;
+                }
+
                 if ( !pContentPrev->isFrameAreaDefinitionValid() && pPage->IsAnLower( pContentPrev ) )
                 {
                     pPage->InvalidateContent();
diff --git a/sw/source/core/layout/tabfrm.cxx b/sw/source/core/layout/tabfrm.cxx
index f9f655392521..e092db0286ef 100644
--- a/sw/source/core/layout/tabfrm.cxx
+++ b/sw/source/core/layout/tabfrm.cxx
@@ -2550,6 +2550,7 @@ void SwTabFrame::MakeAll(vcl::RenderContext* pRenderContext)
                         }
                     }
 
+                    oAccess.reset();
                     const bool bSplitError = !Split( nDeadLine, bTryToSplit, ( bTableRowKeep && !(bAllowSplitOfRow || bEmulateTableKeepSplitAllowed) ) );
 
                     // tdf#130639 don't start table on a new page after the fallback "switch off repeating header"