ofz#5435 sw: fix SwCache::Insert() stale pointers

If SwCache::Insert() happens to delete the object that m_pFirst or
m_pRealFirst point to, which is unlikely as it means every other object
is locked, then these pointers must be updated.

This sometimes happens in the bugdoc after scrolling around for some
time.

Change-Id: I13f04d28c37969469efa4e1109c7f5b751ceba96
Reviewed-on: https://gerrit.libreoffice.org/49151
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Michael Stahl <mstahl@redhat.com>
(cherry picked from commit 269d6d3366eea8541d965181dfdda1fdc5ef2d00)
Reviewed-on: https://gerrit.libreoffice.org/49234
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

1 files changed, 25 insertions, 7 deletions

diff --git a/sw/source/core/bastyp/swcache.cxx b/sw/source/core/bastyp/swcache.cxx
index f75468219873..64ae10658518 100644
--- a/sw/source/core/bastyp/swcache.cxx
+++ b/sw/source/core/bastyp/swcache.cxx
@@ -367,16 +367,34 @@ bool SwCache::Insert( SwCacheObj *pNew )
 
         nPos = pObj->GetCachePos();
         if ( pObj == m_pLast )
-        { OSL_ENSURE( pObj->GetPrev(), "Last but no Prev" );
+        {
             m_pLast = pObj->GetPrev();
-            m_pLast->SetNext( nullptr );
+            assert(m_pLast); // must have capacity > 1
         }
-        else
+        if (pObj == m_pFirst)
         {
-            if ( pObj->GetPrev() )
-                pObj->GetPrev()->SetNext( pObj->GetNext() );
-            if ( pObj->GetNext() )
-                pObj->GetNext()->SetPrev( pObj->GetPrev() );
+            if (pObj->GetNext())
+            {
+                m_pFirst = pObj->GetNext();
+            }
+            else
+            {
+                m_pFirst = pObj->GetPrev();
+            }
+            assert(m_pFirst); // must have capacity > 1
+        }
+        if (pObj == m_pRealFirst)
+        {
+            m_pRealFirst = pObj->GetNext();
+            assert(m_pRealFirst); // must have capacity > 1
+        }
+        if (pObj->GetPrev())
+        {
+            pObj->GetPrev()->SetNext( pObj->GetNext() );
+        }
+        if (pObj->GetNext())
+        {
+            pObj->GetNext()->SetPrev( pObj->GetPrev() );
         }
         delete pObj;
         m_aCacheObjects[nPos] = pNew;