tdf#139500 svx: fix crash on changing table properties during active text edit

Regression from commit fdeb04f7c59cf8032fe17072ed779e70505cc6ab
(tdf#129961 svx: finish UI for table shadow as direct format,
2020-12-15), the problem was that the BegUndo() / EndUndo() pair can be
only used if we know that the text edit of a cell of a table shape is
not started or ended in-between.

The bugreport scenario was an active text edit, where setting attributes
on the shape ends the text edit:

    #9 0x7f6dbb417121 in SdrEditView::EndTextEditAllViews() const /svx/source/svdraw/svdedtv.cxx:1079:20
    #10 0x7f6dbb466798 in SdrEditView::SetAttrToMarked(SfxItemSet const&, bool) /svx/source/svdraw/svdedtv1.cxx:1095:9
    #11 0x7f6dbc34b0af in sdr::table::SvxTableController::SetAttrToSelectedShape(SfxItemSet const&) /svx/source/table/tablecontroller.cxx:2738:12

Which also means that the underlying edit engine is deleted. But then
undo/redo would still reference that edit engine:

==31830==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c0001fc300 at pc 0x7f6dd73a9cb9 bp 0x7fff788db4b0 sp 0x7fff788db4a8
READ of size 8 at 0x60c0001fc300 thread T0
    #0 0x7f6dd73a9cb8 in EditUndo::GetComment() const /editeng/source/editeng/editundo.cxx:147:34

Fix the problem by not grouping in case there is an active text edit,
that's not something I considered when I added the original grouping.

Change-Id: I4f3583e21a27f8380c35b3f4563ce496819bcb81
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/115049
Tested-by: Jenkins
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>

2 files changed, 39 insertions, 1 deletions

diff --git a/svx/qa/uitest/table/tablecontroller.py b/svx/qa/uitest/table/tablecontroller.py
index afc5de807fde..607df44a3a4f 100644
--- a/svx/qa/uitest/table/tablecontroller.py
+++ b/svx/qa/uitest/table/tablecontroller.py
@@ -6,6 +6,7 @@
 
 from uitest.framework import UITestCase
 from uitest.uihelper.common import select_pos
+from libreoffice.uno.propertyvalue import mkPropertyValues
 
 
 # Test for SvxTableController.
@@ -42,4 +43,41 @@ class SvxTableControllerTest(UITestCase):
         # Close the document.
         self.ui_test.close_doc()
 
+    def testUndoCrash(self):
+        # Given an Impress document with a single table in it:
+        self.ui_test.create_doc_in_start_center("impress")
+        template = self.xUITest.getTopFocusWindow()
+        self.ui_test.close_dialog_through_button(template.getChild("close"))
+        self.xUITest.executeCommand(".uno:SelectAll")
+        self.xUITest.executeCommand(".uno:Delete")
+        self.xUITest.executeCommand(".uno:InsertTable?Columns:short=3&Rows:short=3")
+        self.xUITest.executeCommand(".uno:SelectAll")
+
+        # When enabling shadow on the shape while text edit is active:
+        doc = self.xUITest.getTopFocusWindow()
+        impress = doc.getChild("impress_win")
+        impress.executeAction("TYPE", mkPropertyValues({"TEXT": "A1"}))
+        for i in range(6):
+            impress.executeAction("TYPE", mkPropertyValues({"KEYCODE": "CTRL+TAB"}))
+        impress.executeAction("TYPE", mkPropertyValues({"TEXT": "A3"}))
+        self.xUITest.executeCommand(".uno:SelectAll")
+        self.ui_test.execute_dialog_through_command(".uno:TableDialog")
+        tableDialog = self.xUITest.getTopFocusWindow()
+        tabs = tableDialog.getChild("tabcontrol")
+        # Select "shadow".
+        select_pos(tabs, "4")
+        shadowCheckbox = tableDialog.getChild("TSB_SHOW_SHADOW")
+        shadowCheckbox.executeAction("CLICK", tuple())
+        self.ui_test.close_dialog_through_button(tableDialog.getChild("ok"))
+
+        # Then make sure we don't crash:
+        # Without the accompanying fix in place, this test would have failed crashed due to a
+        # use-after-free: text edit ended but an undo action of the text edit remained on the undo
+        # stack.
+        for i in range(2):
+            self.xUITest.executeCommand(".uno:Undo")
+
+        # Close the document.
+        self.ui_test.close_doc()
+
 # vim: set shiftwidth=4 softtabstop=4 expandtab:
diff --git a/svx/source/table/tablecontroller.cxx b/svx/source/table/tablecontroller.cxx
index a81756c0ffdc..cab8570871dc 100644
--- a/svx/source/table/tablecontroller.cxx
+++ b/svx/source/table/tablecontroller.cxx
@@ -984,7 +984,7 @@ void SvxTableController::onFormatTable(const SfxRequest& rReq)
                 // Create a single undo action when applying the result of the dialog.
                 SdrTableObj& rTableObject(*mxTableObj);
                 SdrModel& rSdrModel(rTableObject.getSdrModelFromSdrObject());
-                bool bUndo = rSdrModel.IsUndoEnabled();
+                bool bUndo = rSdrModel.IsUndoEnabled() && !mrView.IsTextEdit();
                 if (bUndo)
                 {
                     rSdrModel.BegUndo(SvxResId(STR_TABLE_NUMFORMAT));