fdo#57197: sw: fix crash on Undo of table row/column insert

The _SaveTable::CreateNew() will call _FndBox::DelFrms() but at that
point the SwTableBoxes have already been deleted; so do that earlier.

Change-Id: I868c8fffbddeb1ea6df724fb68cac732eeee2eba

1 files changed, 12 insertions, 4 deletions

diff --git a/sw/source/core/undo/untbl.cxx b/sw/source/core/undo/untbl.cxx
index 9fd3331ee533..f6377c987852 100644
--- a/sw/source/core/undo/untbl.cxx
+++ b/sw/source/core/undo/untbl.cxx
@@ -1689,7 +1689,7 @@ void SwUndoTblNdsChg::UndoImpl(::sw::UndoRedoContext & rContext)
     // ? TL_CHART2: notification or locking of controller required ?
 
     SwChartDataProvider *pPCD = rDoc.GetChartDataProvider();
-    std::vector< SwTableBox* > aDelBoxes;
+    SwSelBoxes aDelBoxes;
     if( IsDelBox() )
     {
         // Trick: add missing boxes in any line, they will be connected
@@ -1712,7 +1712,7 @@ void SwUndoTblNdsChg::UndoImpl(::sw::UndoRedoContext & rContext)
     }
     else if( !pNewSttNds->empty() )
     {
-        // Than the nodes have be moved and not deleted!
+        // Then the nodes have be moved and not deleted!
         // But for that we need a temp array.
         std::vector<_BoxMove> aTmp( pNewSttNds->begin(), pNewSttNds->end() );
 
@@ -1729,6 +1729,10 @@ void SwUndoTblNdsChg::UndoImpl(::sw::UndoRedoContext & rContext)
             if (pPCD)
                 pPCD->DeleteBox( &pTblNd->GetTable(), *pBox );
 
+            // insert _before_ deleting the section - otherwise the box
+            // has no start node so all boxes sort equal in SwSelBoxes
+            aDelBoxes.insert(pBox);
+
             if( aTmp[n].hasMoved )
             {
                 SwNodeRange aRg( *pBox->GetSttNd(), 1,
@@ -1755,7 +1759,6 @@ void SwUndoTblNdsChg::UndoImpl(::sw::UndoRedoContext & rContext)
                 pBox->RemoveFromTable();
                 rDoc.DeleteSection( rDoc.GetNodes()[ nIdx ] );
             }
-            aDelBoxes.insert( aDelBoxes.end(), pBox );
         }
     }
     else
@@ -1770,11 +1773,16 @@ void SwUndoTblNdsChg::UndoImpl(::sw::UndoRedoContext & rContext)
             // TL_CHART2: notify chart about box to be removed
             if (pPCD)
                 pPCD->DeleteBox( &pTblNd->GetTable(), *pBox );
+            aDelBoxes.insert(pBox);
             pBox->RemoveFromTable(); // ~SwTableBox would access pBox->pSttNd
-            aDelBoxes.insert( aDelBoxes.end(), pBox );
             rDoc.DeleteSection( rDoc.GetNodes()[ nIdx ] );
         }
     }
+
+    // fdo#57197: before deleting the SwTableBoxes, delete the SwTabFrms
+    aTmpBox.SetTableLines(aDelBoxes, pTblNd->GetTable());
+    aTmpBox.DelFrms(pTblNd->GetTable());
+
     // Remove boxes from table structure
     for( sal_uInt16 n = 0; n < aDelBoxes.size(); ++n )
     {