1 files changed, 62 insertions, 6 deletions

diff --git a/sw/source/core/layout/layact.cxx b/sw/source/core/layout/layact.cxx
index 04201e1c6f5e..2a08b22fbcdb 100644
--- a/sw/source/core/layout/layact.cxx
+++ b/sw/source/core/layout/layact.cxx
@@ -282,11 +282,12 @@ bool SwLayAction::IsInterrupt()
 
 void SwLayAction::Reset()
 {
+    SetAgain(false);
     m_pOptTab = nullptr;
     m_nStartTicks = std::clock();
     m_nEndPage = m_nPreInvaPage = m_nCheckPageNum = USHRT_MAX;
     m_bPaint = m_bComplete = m_bWaitAllowed = m_bCheckPages = true;
-    m_bInterrupt = m_bAgain = m_bNextCycle = m_bCalcLayout = m_bReschedule =
+    m_bInterrupt = m_bNextCycle = m_bCalcLayout = m_bReschedule =
     m_bUpdateExpFields = m_bBrowseActionStop = false;
     m_pCurPage = nullptr;
 }
@@ -303,7 +304,8 @@ bool SwLayAction::RemoveEmptyBrowserPages()
         do
         {
             if ( (pPage->GetSortedObjs() && pPage->GetSortedObjs()->size()) ||
-                 pPage->ContainsContent() )
+                 pPage->ContainsContent() ||
+                 pPage->FindFootnoteCont() )
                 pPage = static_cast<SwPageFrame*>(pPage->GetNext());
             else
             {
@@ -318,6 +320,53 @@ bool SwLayAction::RemoveEmptyBrowserPages()
     return bRet;
 }
 
+void SwLayAction::SetAgain(bool bAgain)
+{
+    if (bAgain == m_bAgain)
+        return;
+
+    m_bAgain = bAgain;
+
+    assert(m_aFrameStack.size() == m_aFrameDeleteGuards.size());
+    size_t nCount = m_aFrameStack.size();
+    if (m_bAgain)
+    {
+        // LayAction::FormatLayout is now flagged to exit early and will avoid
+        // dereferencing any SwFrames in the stack of FormatLayouts so allow
+        // their deletion
+        for (size_t i = 0; i < nCount; ++i)
+            m_aFrameDeleteGuards[i].reset();
+    }
+    else
+    {
+        // LayAction::FormatLayout is now continue normally and will
+        // dereference the top SwFrame in the stack of m_aFrameStack as each
+        // FormatLevel returns so disallow their deletion
+        for (size_t i = 0; i < nCount; ++i)
+            m_aFrameDeleteGuards[i] = std::make_unique<SwFrameDeleteGuard>(m_aFrameStack[i]);
+    }
+}
+
+void SwLayAction::PushFormatLayout(SwFrame* pLow)
+{
+    /* Workaround crash seen in crashtesting with fdo53985-1.docx
+
+       Lock pLow against getting deleted when it will be dereferenced
+       after FormatLayout
+
+       If SetAgain is called to make SwLayAction exit early to avoid that
+       dereference, then it clears these guards
+    */
+    m_aFrameStack.push_back(pLow);
+    m_aFrameDeleteGuards.push_back(std::make_unique<SwFrameDeleteGuard>(pLow));
+}
+
+void SwLayAction::PopFormatLayout()
+{
+    m_aFrameDeleteGuards.pop_back();
+    m_aFrameStack.pop_back();
+}
+
 void SwLayAction::Action(OutputDevice* pRenderContext)
 {
     m_bActionInProgress = true;
@@ -344,12 +393,15 @@ void SwLayAction::Action(OutputDevice* pRenderContext)
         SetCheckPages( false );
 
     InternalAction(pRenderContext);
-    m_bAgain |= RemoveEmptyBrowserPages();
+    if (RemoveEmptyBrowserPages())
+        SetAgain(true);
     while ( IsAgain() )
     {
-        m_bAgain = m_bNextCycle = false;
+        SetAgain(false);
+        m_bNextCycle = false;
         InternalAction(pRenderContext);
-        m_bAgain |= RemoveEmptyBrowserPages();
+        if (RemoveEmptyBrowserPages())
+            SetAgain(true);
     }
     m_pRoot->DeleteEmptySct();
 
@@ -637,7 +689,7 @@ void SwLayAction::InternalAction(OutputDevice* pRenderContext)
             {
                 bool bOld = IsAgain();
                 m_pRoot->RemoveSuperfluous();
-                m_bAgain = bOld;
+                SetAgain(bOld);
             }
             if ( IsAgain() )
             {
@@ -1370,7 +1422,11 @@ bool SwLayAction::FormatLayout( OutputDevice *pRenderContext, SwLayoutFrame *pLa
             }
             // Skip the ones already registered for deletion
             else if( !pLow->IsSctFrame() || static_cast<SwSectionFrame*>(pLow)->GetSection() )
+            {
+                PushFormatLayout(pLow);
                 bChanged |= FormatLayout( pRenderContext, static_cast<SwLayoutFrame*>(pLow), bAddRect );
+                PopFormatLayout();
+            }
         }
         else if ( m_pImp->GetShell()->IsPaintLocked() )
             // Shortcut to minimize the cycles. With Lock, the