rhbz#689053: fix crash following delete at last table cell:

The IsSelOvr() in SwCrsrShell::Combine() detects that the PaM with mark
in the last table cell and point ouside the table is invalid, but
unfortunatley restores the wrong position, which does not actually
correct the PaM; the deletion on the invalid PaM then removes the
last SwTxtNode in the document, which leads to crash later.

Change-Id: Ib2ae0b54e6c15dbe5b6811d8696531bf2022e1a4

1 files changed, 8 insertions, 7 deletions

diff --git a/sw/source/core/crsr/crsrsh.cxx b/sw/source/core/crsr/crsrsh.cxx
index 96d96b755aed..187095ca543a 100644
--- a/sw/source/core/crsr/crsrsh.cxx
+++ b/sw/source/core/crsr/crsrsh.cxx
@@ -1984,26 +1984,27 @@ void SwCrsrShell::Combine()
         return;
 
     SwCallLink aLk( *this ); // watch Crsr-Moves; call Link if needed
-    SwCrsrSaveState aSaveState( *pCurCrsr );
+    // rhbz#689053: IsSelOvr must restore the saved stack position, not the
+    // current one, because current point + stack mark may be invalid PaM
+    SwCrsrSaveState aSaveState(*pCrsrStk);
     if( pCrsrStk->HasMark() ) // only if GetMark was set
     {
         bool const bResult =
         CheckNodesRange( pCrsrStk->GetMark()->nNode, pCurCrsr->GetPoint()->nNode, sal_True );
         OSL_ENSURE(bResult, "StackCrsr & current Crsr not in same Section.");
         (void) bResult; // non-debug: unused
-        // copy GetMark
-        if( !pCurCrsr->HasMark() )
-            pCurCrsr->SetMark();
-        *pCurCrsr->GetMark() = *pCrsrStk->GetMark();
-        pCurCrsr->GetMkPos() = pCrsrStk->GetMkPos();
     }
+    *pCrsrStk->GetPoint() = *pCurCrsr->GetPoint();
+    pCrsrStk->GetPtPos() = pCurCrsr->GetPtPos();
 
     SwShellCrsr * pTmp = 0;
     if( pCrsrStk->GetNext() != pCrsrStk )
     {
         pTmp = dynamic_cast<SwShellCrsr*>(pCrsrStk->GetNext());
     }
-    delete pCrsrStk;
+    delete pCurCrsr;
+    pCurCrsr = pCrsrStk;
+    pCrsrStk->MoveTo(0); // remove from ring
     pCrsrStk = pTmp;
     if( !pCurCrsr->IsInProtectTable( sal_True ) &&
         !pCurCrsr->IsSelOvr( nsSwCursorSelOverFlags::SELOVER_TOGGLE |