sw: avoid deleting the iterated SwRowFrame on tdf104188-4.odt

The change in commit 1e6dec4b4313212a3bdc6bb06155fd65e795368b
was not enough to fix this problem.

SwContentFrame::CalcLowers() may move a SwTextFrame to the previous
page; in that case Calc() on the upper is a bad idea because it may then
call RemoveFollowFlowLine() and delete the SwRowFrame that is being
iterated.

There is one other (unknown) bugdoc with this problem, let's hope it's
fixed as well...

(regression from commit 18765b9fa739337d2d891513f6e2fb7c3ce23b50)

Change-Id: I3c55a0d7ef0350a482fb150d3e96c3b34853400d
Reviewed-on: https://gerrit.libreoffice.org/74793
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl@cib.de>
(cherry picked from commit 1cb7e4899b5ada902e99a0c964ee047950c07044)
Reviewed-on: https://gerrit.libreoffice.org/74835
Reviewed-by: Thorsten Behrens <Thorsten.Behrens@CIB.de>

2 files changed, 16 insertions, 13 deletions

diff --git a/sw/source/core/inc/cntfrm.hxx b/sw/source/core/inc/cntfrm.hxx
index aa28f580f3ad..998cf2ed1a1e 100644
--- a/sw/source/core/inc/cntfrm.hxx
+++ b/sw/source/core/inc/cntfrm.hxx
@@ -92,7 +92,8 @@ public:
 
     inline  SwContentFrame* GetNextContentFrame() const;
     inline  SwContentFrame* GetPrevContentFrame() const;
-    static bool CalcLowers( SwLayoutFrame* pLay, const SwLayoutFrame* pDontLeave, long nBottom, bool bSkipRowSpanCells );
+    static bool CalcLowers(SwLayoutFrame & rLay, SwLayoutFrame const& rDontLeave,
+            long nBottom, bool bSkipRowSpanCells);
 };
 
 inline SwContentFrame* SwContentFrame::GetNextContentFrame() const
diff --git a/sw/source/core/layout/tabfrm.cxx b/sw/source/core/layout/tabfrm.cxx
index 694e1b70fb03..141bc7e296af 100644
--- a/sw/source/core/layout/tabfrm.cxx
+++ b/sw/source/core/layout/tabfrm.cxx
@@ -1461,25 +1461,22 @@ static void lcl_InvalidateAllLowersPrt( SwLayoutFrame* pLayFrame )
     }
 }
 
-bool SwContentFrame::CalcLowers( SwLayoutFrame* pLay, const SwLayoutFrame* pDontLeave,
+bool SwContentFrame::CalcLowers(SwLayoutFrame & rLay, SwLayoutFrame const& rDontLeave,
                                  long nBottom, bool bSkipRowSpanCells )
 {
-    if ( !pLay )
-        return true;
-
-    vcl::RenderContext* pRenderContext = pLay->getRootFrame()->GetCurrShell()->GetOut();
+    vcl::RenderContext* pRenderContext = rLay.getRootFrame()->GetCurrShell()->GetOut();
     // LONG_MAX == nBottom means we have to calculate all
     bool bAll = LONG_MAX == nBottom;
     bool bRet = false;
-    SwContentFrame *pCnt = pLay->ContainsContent();
-    SwRectFnSet aRectFnSet(pLay);
+    SwContentFrame *pCnt = rLay.ContainsContent();
+    SwRectFnSet aRectFnSet(&rLay);
 
     // FME 2007-08-30 #i81146# new loop control
     int nLoopControlRuns = 0;
     const int nLoopControlMax = 10;
     const SwModify* pLoopControlCond = nullptr;
 
-    while ( pCnt && pDontLeave->IsAnLower( pCnt ) )
+    while (pCnt && rDontLeave.IsAnLower(pCnt))
     {
         // #115759# - check, if a format of content frame is
         // possible. Thus, 'copy' conditions, found at the beginning of
@@ -1535,7 +1532,7 @@ bool SwContentFrame::CalcLowers( SwLayoutFrame* pLay, const SwLayoutFrame* pDont
                     if ( nLoopControlRuns < nLoopControlMax )
                     {
                         // restart format with first content
-                        pCnt = pLay->ContainsContent();
+                        pCnt = rLay.ContainsContent();
                         continue;
                     }
 
@@ -1544,6 +1541,11 @@ bool SwContentFrame::CalcLowers( SwLayoutFrame* pLay, const SwLayoutFrame* pDont
 #endif
                 }
             }
+            if (!rDontLeave.IsAnLower(pCnt)) // moved backward?
+            {
+                pCnt = rLay.ContainsContent();
+                continue; // avoid formatting new upper on different page
+            }
             pCnt->GetUpper()->Calc(pRenderContext);
         }
         if( ! bAll && aRectFnSet.YDiff(aRectFnSet.GetTop(pCnt->getFrameArea()), nBottom) > 0 )
@@ -1599,7 +1601,7 @@ static bool lcl_InnerCalcLayout( SwFrame *pFrame,
     return bRet;
 }
 
-static void lcl_RecalcRow( SwRowFrame* pRow, long nBottom )
+static void lcl_RecalcRow(SwRowFrame *const pRow, long const nBottom)
 {
     // FME 2007-08-30 #i81146# new loop control
     int nLoopControlRuns_1 = 0;
@@ -1639,7 +1641,7 @@ static void lcl_RecalcRow( SwRowFrame* pRow, long nBottom )
             OSL_ENSURE(pOriginalRow->GetUpper() && pOriginalRow->GetUpper()->IsTabFrame(), "No table");
             SwTabFrame* pOriginalTab = static_cast<SwTabFrame*>(pRow->GetUpper());
 
-            bCheck = SwContentFrame::CalcLowers( pRow, pRow->GetUpper(), nBottom, true );
+            bCheck = SwContentFrame::CalcLowers(*pRow, *pRow->GetUpper(), nBottom, true);
 
             bool bRowStillExists = false;
             SwFrame* pTestRow = pOriginalTab->Lower();
@@ -1677,7 +1679,7 @@ static void lcl_RecalcRow( SwRowFrame* pRow, long nBottom )
                         SwCellFrame& rToRecalc = 0 == i ?
                                                const_cast<SwCellFrame&>(pCellFrame->FindStartEndOfRowSpanCell( true )) :
                                                *pCellFrame;
-                        bCheck  |= SwContentFrame::CalcLowers( &rToRecalc, &rToRecalc, nBottom, false );
+                        bCheck |= SwContentFrame::CalcLowers(rToRecalc, rToRecalc, nBottom, false);
                     }
 
                     pCellFrame = static_cast<SwCellFrame*>(pCellFrame->GetNext());