tdf#128335 sw textbox: fix crash on deleting multiple shapes with textboxes

This was introduced in commit 33141f999b22ce10cdbfbd76081fff211c4b5067
(SwDrawView::DeleteMarked: delete textbox of shape as well, 2014-06-23),
the problem is that in case one shape+textframe pair is anchored in an
other textframe, which is also part of a shape+textframe pair, it
matters what order we use for deleting these objects.

What happened is that the anchor position of a 2nd textbox was updated
on the deletion (cut) of the 1st textbox, and this was not properly
restored on paste.

Fix the problem by deleting in reverse order, assuming that the
container is ordered by anchor positions.

Change-Id: I62bc12a5064ce397234999e8fd7b108f79de3c24
Reviewed-on: https://gerrit.libreoffice.org/82042
Tested-by: Jenkins
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>

1 files changed, 5 insertions, 1 deletions

diff --git a/sw/source/core/draw/dview.cxx b/sw/source/core/draw/dview.cxx
index e617a6da8dec..54f86e8abb27 100644
--- a/sw/source/core/draw/dview.cxx
+++ b/sw/source/core/draw/dview.cxx
@@ -975,8 +975,12 @@ void SwDrawView::DeleteMarked()
         ::FrameNotify( Imp().GetShell(), FLY_DRAG_END );
 
         // Only delete these now: earlier deletion would clear the mark list as well.
-        for (auto& rpTextBox : aTextBoxesToDelete)
+        // Delete in reverse order, assuming that the container is sorted by anchor positions.
+        for (int i = aTextBoxesToDelete.size() - 1; i >= 0; --i)
+        {
+            SwFrameFormat*& rpTextBox = aTextBoxesToDelete[i];
             pDoc->getIDocumentLayoutAccess().DelLayoutFormat(rpTextBox);
+        }
     }
     pDoc->GetIDocumentUndoRedo().EndUndo(SwUndoId::EMPTY, nullptr);
     if( pTmpRoot )