Access by AnchoredObject of a deleted SwLayoutFrm

as demonstrated by abi10075-1.doc

just register the AnchoredObjects in the SwLayoutFrm and
inform them when the SwLayoutFrm goes away.

This crash was triggered by "1e113cb7604e1509e7d598a9be329f1f7b6e9322" import
different first page header/footer from doc. But that commit is blameless.

Change-Id: Ia079cc635a81dff1ccbf740641f441aa784328a4
(cherry picked from commit b376eacdfae11f5d39eb7011efe67390d9f495e7)
Reviewed-on: https://gerrit.libreoffice.org/6622
Reviewed-by: Michael Stahl <mstahl@redhat.com>
Tested-by: Michael Stahl <mstahl@redhat.com>

4 files changed, 36 insertions, 5 deletions

diff --git a/sw/inc/anchoredobject.hxx b/sw/inc/anchoredobject.hxx
index cc5edbfb17b0..ff4b88ada644 100644
--- a/sw/inc/anchoredobject.hxx
+++ b/sw/inc/anchoredobject.hxx
@@ -269,15 +269,12 @@ class SW_DLLPUBLIC SwAnchoredObject
 
         // accessors to data of position calculation:
         // frame vertical position is orient at
-        inline const SwLayoutFrm* GetVertPosOrientFrm() const
+        const SwLayoutFrm* GetVertPosOrientFrm() const
         {
             return mpVertPosOrientFrm;
         }
         // method to clear member <mpVertPosOrientFrm>
-        inline void ClearVertPosOrientFrm()
-        {
-            mpVertPosOrientFrm = 0L;
-        }
+        void ClearVertPosOrientFrm();
 
         /** check anchor character rectangle and top of line
 
diff --git a/sw/source/core/inc/layfrm.hxx b/sw/source/core/inc/layfrm.hxx
index fdd6b7cb034e..d17b6e526473 100644
--- a/sw/source/core/inc/layfrm.hxx
+++ b/sw/source/core/inc/layfrm.hxx
@@ -21,6 +21,7 @@
 
 #include "frame.hxx"
 
+class SwAnchoredObject;
 class SwCntntFrm;
 class SwFlowFrm;
 class SwFmtCol;
@@ -53,6 +54,7 @@ protected:
     virtual void MakeAll();
 
     SwFrm           *pLower;
+    std::vector<SwAnchoredObject*> aVertPosOrientFrmsFor;
 
     virtual SwTwips ShrinkFrm( SwTwips, sal_Bool bTst = sal_False, sal_Bool bInfo = sal_False );
     virtual SwTwips GrowFrm  ( SwTwips, sal_Bool bTst = sal_False, sal_Bool bInfo = sal_False );
@@ -164,6 +166,18 @@ public:
     inline SwFrm* GetLastLower();
 
     virtual void PaintBreak() const;
+
+    void SetVertPosOrientFrmFor(SwAnchoredObject *pObj)
+    {
+        aVertPosOrientFrmsFor.push_back(pObj);
+    }
+
+    void ClearVertPosOrientFrmFor(SwAnchoredObject *pObj)
+    {
+        aVertPosOrientFrmsFor.erase(
+            std::remove(aVertPosOrientFrmsFor.begin(),
+                aVertPosOrientFrmsFor.end(), pObj), aVertPosOrientFrmsFor.end());
+    }
 };
 
 //Um doppelte Implementierung zu sparen wird hier ein bischen gecasted
diff --git a/sw/source/core/layout/anchoredobject.cxx b/sw/source/core/layout/anchoredobject.cxx
index ab4a193a5673..77cf548f6428 100644
--- a/sw/source/core/layout/anchoredobject.cxx
+++ b/sw/source/core/layout/anchoredobject.cxx
@@ -107,8 +107,18 @@ SwAnchoredObject::SwAnchoredObject() :
 {
 }
 
+void SwAnchoredObject::ClearVertPosOrientFrm()
+{
+    if (mpVertPosOrientFrm)
+    {
+        const_cast<SwLayoutFrm*>(mpVertPosOrientFrm)->ClearVertPosOrientFrmFor(this);
+        mpVertPosOrientFrm = NULL;
+    }
+}
+
 SwAnchoredObject::~SwAnchoredObject()
 {
+    ClearVertPosOrientFrm();
 }
 
 // =============================================================================
@@ -238,6 +248,8 @@ void SwAnchoredObject::SetVertPosOrientFrm( const SwLayoutFrm& _rVertPosOrientFr
 {
     mpVertPosOrientFrm = &_rVertPosOrientFrm;
 
+    const_cast<SwLayoutFrm*>(mpVertPosOrientFrm)->SetVertPosOrientFrmFor(this);
+
     // #i28701# - take over functionality of deleted method
     // <SwFlyAtCntFrm::AssertPage()>: assure for at-paragraph and at-character
     // an anchored object, that it is registered at the correct page frame
diff --git a/sw/source/core/layout/ssfrm.cxx b/sw/source/core/layout/ssfrm.cxx
index 4ae962ef751b..1fc5ff0fdcf3 100644
--- a/sw/source/core/layout/ssfrm.cxx
+++ b/sw/source/core/layout/ssfrm.cxx
@@ -557,6 +557,14 @@ void SwCntntFrm::DelFrms( const SwCntntNode& rNode )
 
 void SwLayoutFrm::Destroy()
 {
+    while (!aVertPosOrientFrmsFor.empty())
+    {
+        SwAnchoredObject *pObj = *aVertPosOrientFrmsFor.begin();
+        pObj->ClearVertPosOrientFrm();
+    }
+
+    assert(aVertPosOrientFrmsFor.empty());
+
     SwFrm *pFrm = pLower;
 
     if( GetFmt() && !GetFmt()->GetDoc()->IsInDtor() )