forcepoint#50 refetch FirstNonHeadlineRow

Invalid read of size 8
   at 0x43D42DE6: SwFrame::GetUpper() const (frame.hxx:664)
   by 0x44427435: SwRowFrame::ShouldRowKeepWithNext() const (tabfrm.cxx:4618)
   by 0x4441FA5C: SwTabFrame::MakeAll(OutputDevice*) (tabfrm.cxx:2403)
   by 0x4433492F: SwFrame::PrepareMake(OutputDevice*) (calcmove.cxx:343)
   by 0x44431B6F: SwFrame::Calc(OutputDevice*) const (trvlfrm.cxx:1799)
   by 0x44334430: SwFrame::PrepareMake(OutputDevice*) (calcmove.cxx:246)
   by 0x44431B6F: SwFrame::Calc(OutputDevice*) const (trvlfrm.cxx:1799)
   by 0x44334430: SwFrame::PrepareMake(OutputDevice*) (calcmove.cxx:246)
   by 0x44431B6F: SwFrame::Calc(OutputDevice*) const (trvlfrm.cxx:1799)
   by 0x44334A67: SwFrame::OptPrepareMake() (calcmove.cxx:354)
   by 0x443982CE: SwFrame::OptCalc() const (frame.hxx:1051)
   by 0x44395F18: SwLayAction::FormatContent_(SwContentFrame const*, SwPageFrame const*) (layact.cxx:1794)
 Address 0x352771b0 is 144 bytes inside a block of size 280 free'd
   at 0x4C2EDAC: free (vg_replace_malloc.c:530)
   by 0x4E5B9D7: rtl_freeMemory_SYSTEM(void*) (alloc_global.cxx:237)
   by 0x4E5BC93: rtl_freeMemory (alloc_global.cxx:303)
   by 0x4E5A7A2: rtl_cache_free (alloc_cache.cxx:1081)
   by 0xF28B5B9: FixedMemPool::Free(void*) (mempool.cxx:49)
   by 0x442FF36D: SwRowFrame::operator delete(void*, unsigned long) (rowfrm.hxx:123)
   by 0x444243E8: SwRowFrame::~SwRowFrame() (tabfrm.cxx:3702)
   by 0x4441630C: SwFrame::DestroyFrame(SwFrame*) (ssfrm.cxx:384)
   by 0x4441AC31: SwTabFrame::RemoveFollowFlowLine() (tabfrm.cxx:900)
   by 0x4441D7EB: SwTabFrame::MakeAll(OutputDevice*) (tabfrm.cxx:1836)
   by 0x4433492F: SwFrame::PrepareMake(OutputDevice*) (calcmove.cxx:343)
   by 0x44431B6F: SwFrame::Calc(OutputDevice*) const (trvlfrm.cxx:1799)

Change-Id: I36fe0df0ef96b4019e0ca5756b06df72e9f0d8cb
Reviewed-on: https://gerrit.libreoffice.org/57480
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

1 files changed, 7 insertions, 13 deletions

diff --git a/sw/source/core/layout/tabfrm.cxx b/sw/source/core/layout/tabfrm.cxx
index 8fad05cf2508..a5538ea3f707 100644
--- a/sw/source/core/layout/tabfrm.cxx
+++ b/sw/source/core/layout/tabfrm.cxx
@@ -164,7 +164,7 @@ void SwTabFrame::RegistFlys()
 }
 
 void SwInvalidateAll( SwFrame *pFrame, long nBottom );
-static bool lcl_RecalcRow( SwRowFrame* pRow, long nBottom );
+static void lcl_RecalcRow( SwRowFrame* pRow, long nBottom );
 static bool lcl_ArrangeLowers( SwLayoutFrame *pLay, long lYStart, bool bInva );
 // #i26945# - add parameter <_bOnlyRowsAndCells> to control
 // that only row and cell frames are formatted.
@@ -1562,8 +1562,7 @@ static bool lcl_InnerCalcLayout( SwFrame *pFrame,
     return bRet;
 }
 
-// returns false if pRow is invalid
-static bool lcl_RecalcRow( SwRowFrame* pRow, long nBottom )
+static void lcl_RecalcRow( SwRowFrame* pRow, long nBottom )
 {
     // FME 2007-08-30 #i81146# new loop control
     int nLoopControlRuns_1 = 0;
@@ -1621,7 +1620,7 @@ static bool lcl_RecalcRow( SwRowFrame* pRow, long nBottom )
             if (!bRowStillExists)
             {
                 SAL_WARN("sw.layout", "no row anymore at " << pRow);
-                return false;
+                return;
             }
 
             // NEW TABLES
@@ -1665,8 +1664,7 @@ static bool lcl_RecalcRow( SwRowFrame* pRow, long nBottom )
             }
         }
         break;
-    } while (true);
-    return true;
+    } while( true );
 }
 
 static void lcl_RecalcTable( SwTabFrame& rTab,
@@ -2353,7 +2351,7 @@ void SwTabFrame::MakeAll(vcl::RenderContext* pRenderContext)
 
             // 1. Try: bTryToSplit = true  => Try to split the row.
             // 2. Try: bTryToSplit = false => Split the table between the rows.
-            if ((pFirstNonHeadlineRow && pFirstNonHeadlineRow->GetNext()) || bTryToSplit )
+            if ( pFirstNonHeadlineRow->GetNext() || bTryToSplit )
             {
                 SwTwips nDeadLine = aRectFnSet.GetPrtBottom(*GetUpper());
                 if( IsInSct() || GetUpper()->IsInTab() ) // TABLE IN TABLE)
@@ -2362,11 +2360,7 @@ void SwTabFrame::MakeAll(vcl::RenderContext* pRenderContext)
 
                 {
                     SetInRecalcLowerRow( true );
-                    SwRowFrame* pRow = static_cast<SwRowFrame*>(Lower());
-                    if (!lcl_RecalcRow(pRow, nDeadLine))
-                    {
-                        pFirstNonHeadlineRow = GetFirstNonHeadlineRow();
-                    }
+                    ::lcl_RecalcRow( static_cast<SwRowFrame*>(Lower()), nDeadLine );
                     SetInRecalcLowerRow( false );
                 }
                 m_bLowersFormatted = true;
@@ -2400,7 +2394,7 @@ void SwTabFrame::MakeAll(vcl::RenderContext* pRenderContext)
 
                 if ( bTableRowKeep )
                 {
-                    const SwRowFrame* pTmpRow = pFirstNonHeadlineRow;
+                    const SwRowFrame* pTmpRow = GetFirstNonHeadlineRow();
                     while ( pTmpRow && pTmpRow->ShouldRowKeepWithNext() )
                     {
                         ++nMinNumOfLines;