i#30979: sw: fix crash on Flys anchored in ToX

When a fly is anchored at the first paragraph of a ToX, as happens in
the WW8 bugdoc in i#30979, updating the ToX will remove the anchor
node, and bad things happen, including ~SwIndexReg assert and also
eventually a crash when editing the Frame and updating the ToX a few
times.  Probably best to really remove all anchored flys here.

Note that it's not enough to re-anchor to the empty node that is
inserted here because that one will also be removed again.

While we're at it the _DelBookmarks is superfluous because CorrAbs
does exactly that 2 lines above.

Change-Id: Id40ae1d88ad99813b93bea7470f5dc790edcc80c

1 files changed, 4 insertions, 3 deletions

diff --git a/sw/source/core/doc/doctxm.cxx b/sw/source/core/doc/doctxm.cxx
index f5372a773c23..02bc7de34605 100644
--- a/sw/source/core/doc/doctxm.cxx
+++ b/sw/source/core/doc/doctxm.cxx
@@ -858,9 +858,10 @@ void SwTOXBaseSection::Update(const SfxItemSet* pAttr,
         SwPosition aPos( aEndIdx, SwIndex( pFirstEmptyNd, 0 ));
         pDoc->CorrAbs( aSttIdx, aEndIdx, aPos, sal_True );
 
-        // delete all before
-        DelFlyInRange( aSttIdx, aEndIdx );
-        _DelBookmarks( aSttIdx, aEndIdx );
+        // delete flys in whole range including start node which requires
+        // giving the node before start node as Mark parameter, hence -1.
+        // (flys must be deleted because the anchor nodes are removed)
+        DelFlyInRange( SwNodeIndex(aSttIdx, -1), aEndIdx );
 
         pDoc->GetNodes().Delete( aSttIdx, aEndIdx.GetIndex() - aSttIdx.GetIndex() );