forcepoint#93 fix crash on layout of specific rtf

Change-Id: Id81729de2efd6f65f1b51bdb437ca21a260eaf6e
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/133481
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
(cherry picked from commit 5277b953b29845555cba8f867c9c750e8bc510a5)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/133950
Tested-by: Michael Stahl <michael.stahl@allotropia.de>

6 files changed, 15 insertions, 7 deletions

diff --git a/sw/qa/extras/layout/data/forcepoint93-1.rtf b/sw/qa/extras/layout/data/forcepoint93-1.rtf
new file mode 100644
index 000000000000..bbe5ecfb78f2
--- /dev/null
+++ b/sw/qa/extras/layout/data/forcepoint93-1.rtf
diff --git a/sw/qa/extras/layout/data/forcepoint93-2.rtf b/sw/qa/extras/layout/data/forcepoint93-2.rtf
new file mode 100644
index 000000000000..bcc5f3dc8855
--- /dev/null
+++ b/sw/qa/extras/layout/data/forcepoint93-2.rtf
diff --git a/sw/qa/extras/layout/layout.cxx b/sw/qa/extras/layout/layout.cxx
index abe44c1c3ad0..bec9c8e4d5f9 100644
--- a/sw/qa/extras/layout/layout.cxx
+++ b/sw/qa/extras/layout/layout.cxx
@@ -3064,6 +3064,13 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter, testForcepoint90)
 //just care it doesn't crash/assert
 CPPUNIT_TEST_FIXTURE(SwLayoutWriter, testForcepoint92) { createDoc("forcepoint92.doc"); }
 
+//just care it doesn't crash/assert
+CPPUNIT_TEST_FIXTURE(SwLayoutWriter, testForcepoint93)
+{
+//fails to load    createDoc("forcepoint93-1.rtf");
+    createDoc("forcepoint93-2.rtf");
+}
+
 #if 0 // no createSwWebDoc
 //just care it doesn't crash/assert
 CPPUNIT_TEST_FIXTURE(SwLayoutWriter, testForcepoint94)
diff --git a/sw/source/core/inc/frame.hxx b/sw/source/core/inc/frame.hxx
index ae5e8378ee4b..289a45fc922f 100644
--- a/sw/source/core/inc/frame.hxx
+++ b/sw/source/core/inc/frame.hxx
@@ -424,7 +424,7 @@ protected:
     bool mbColLocked     : 1;  // lock Grow/Shrink for column-wise section
                                   // or fly frames, will be set in Format
     bool m_isInDestroy : 1;
-    bool mbForbidDelete : 1;
+    int mnForbidDelete;
 
     void ColLock()      { mbColLocked = true; }
     void ColUnlock()    { mbColLocked = false; }
@@ -860,7 +860,7 @@ public:
     bool IsProtected() const;
 
     bool IsColLocked()  const { return mbColLocked; }
-    virtual bool IsDeleteForbidden() const { return mbForbidDelete; }
+    virtual bool IsDeleteForbidden() const { return mnForbidDelete > 0; }
 
     /// this is the only way to delete a SwFrame instance
     static void DestroyFrame(SwFrame *const pFrame);
@@ -900,8 +900,8 @@ public:
     void RegisterToFormat( SwFormat& rFormat );
     void ValidateThisAndAllLowers( const sal_uInt16 nStage );
 
-    void ForbidDelete()      { mbForbidDelete = true; }
-    void AllowDelete()    { mbForbidDelete = false; }
+    void ForbidDelete() { ++mnForbidDelete; }
+    void AllowDelete() { assert(mnForbidDelete > 0); --mnForbidDelete; }
 
     drawinglayer::attribute::SdrAllFillAttributesHelperPtr getSdrAllFillAttributesHelper() const;
     bool supportsFullDrawingLayerFillAttributeSet() const;
@@ -1238,8 +1238,7 @@ public:
     //it in e.g. SwSectionFrame::MergeNext etc because we will need it
     //again after the SwFrameDeleteGuard dtor
     explicit SwFrameDeleteGuard(SwFrame* pFrame)
-        : m_pForbidFrame((pFrame && !pFrame->IsDeleteForbidden()) ?
-            pFrame : nullptr)
+        : m_pForbidFrame(pFrame)
     {
         if (m_pForbidFrame)
             m_pForbidFrame->ForbidDelete();
diff --git a/sw/source/core/layout/objectformattertxtfrm.cxx b/sw/source/core/layout/objectformattertxtfrm.cxx
index 45608c13c651..e6fc506d73fb 100644
--- a/sw/source/core/layout/objectformattertxtfrm.cxx
+++ b/sw/source/core/layout/objectformattertxtfrm.cxx
@@ -836,6 +836,8 @@ void SwObjectFormatterTextFrame::FormatAnchorFrameAndItsPrevs( SwTextFrame& _rAn
                 // Thus, check for valid <pFrame>.
                 while ( pFrame && pFrame != pSectFrame )
                 {
+                    SwFrameDeleteGuard aDeleteFrameGuard(pFrame);
+
                     if ( pFrame->IsLayoutFrame() )
                         lcl_FormatContentOfLayoutFrame( static_cast<SwLayoutFrame*>(pFrame) );
                     else
diff --git a/sw/source/core/layout/wsfrm.cxx b/sw/source/core/layout/wsfrm.cxx
index 5cd3a3d6b889..d1a54738812b 100644
--- a/sw/source/core/layout/wsfrm.cxx
+++ b/sw/source/core/layout/wsfrm.cxx
@@ -318,7 +318,7 @@ SwFrame::SwFrame( SwModify *pMod, SwFrame* pSib )
     mbInfSct ( false ),
     mbColLocked(false),
     m_isInDestroy(false),
-    mbForbidDelete(false)
+    mnForbidDelete(0)
 {
     OSL_ENSURE( pMod, "No frame format given." );
 }