crashtesting: failures on swfootnoteframe_colunlock_heap_use_after_free.sample

undo forcepoint80 hackery and try a different solution

Change-Id: I52b5f9b41074e122bd32e70967e198ce9f86aec7
Reviewed-on: https://gerrit.libreoffice.org/76072
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

4 files changed, 19 insertions, 44 deletions

diff --git a/sw/source/core/inc/frame.hxx b/sw/source/core/inc/frame.hxx
index ab1047d0348f..6e0d653690c4 100644
--- a/sw/source/core/inc/frame.hxx
+++ b/sw/source/core/inc/frame.hxx
@@ -1237,8 +1237,19 @@ public:
     //Flag pFrame for SwFrameDeleteGuard lifetime that we shouldn't delete
     //it in e.g. SwSectionFrame::MergeNext etc because we will need it
     //again after the SwFrameDeleteGuard dtor
-    explicit SwFrameDeleteGuard(SwFrame* pFrame);
-    ~SwFrameDeleteGuard();
+    explicit SwFrameDeleteGuard(SwFrame* pFrame)
+        : m_pForbidFrame((pFrame && !pFrame->IsDeleteForbidden()) ?
+            pFrame : nullptr)
+    {
+        if (m_pForbidFrame)
+            m_pForbidFrame->ForbidDelete();
+    }
+
+    ~SwFrameDeleteGuard()
+    {
+        if (m_pForbidFrame)
+            m_pForbidFrame->AllowDelete();
+    }
 };
 
 typedef long (SwFrame:: *SwFrameGet)() const;
diff --git a/sw/source/core/layout/ftnfrm.cxx b/sw/source/core/layout/ftnfrm.cxx
index 824bf8401b70..4560ded12942 100644
--- a/sw/source/core/layout/ftnfrm.cxx
+++ b/sw/source/core/layout/ftnfrm.cxx
@@ -1144,7 +1144,7 @@ void SwFootnoteBossFrame::ResetFootnote( const SwFootnoteFrame *pCheck )
                 pFootnote = pFootnote->GetMaster();
             if ( pFootnote != pCheck )
             {
-                while ( pFootnote )
+                while (pFootnote && !pFootnote->IsDeleteForbidden())
                 {
                     SwFootnoteFrame *pNxt = pFootnote->GetFollow();
                     pFootnote->Cut();
@@ -2264,11 +2264,14 @@ void SwFootnoteBossFrame::RearrangeFootnotes( const SwTwips nDeadLine, const boo
                     // #i49383# - format anchored objects
                     if ( pCnt->IsTextFrame() && pCnt->isFrameAreaDefinitionValid() )
                     {
+                        SwFrameDeleteGuard aDeleteGuard(pFootnote);
                         if ( !SwObjectFormatter::FormatObjsAtFrame( *pCnt,
                                                                   *(pCnt->FindPageFrame()) ) )
                         {
                             // restart format with first content
                             pCnt = pFootnote->ContainsAny();
+                            if (!pCnt)
+                                bMore = false;
                             continue;
                         }
                     }
diff --git a/sw/source/core/layout/objectformattertxtfrm.cxx b/sw/source/core/layout/objectformattertxtfrm.cxx
index 8e73cfc2a2f9..1ba020a84901 100644
--- a/sw/source/core/layout/objectformattertxtfrm.cxx
+++ b/sw/source/core/layout/objectformattertxtfrm.cxx
@@ -659,7 +659,7 @@ static void lcl_FormatContentOfLayoutFrame( SwLayoutFrame* pLayFrame,
             {
                 assert(pFootnote->IsFootnoteFrame());
                 SwFrame *const pNextNote = pFootnote->GetNext();
-                if (!pFootnote->GetLower() && !pFootnote->IsColLocked() &&
+                if (!pFootnote->IsDeleteForbidden() && !pFootnote->GetLower() && !pFootnote->IsColLocked() &&
                     !static_cast<SwFootnoteFrame*>(pFootnote)->IsBackMoveLocked())
                 {
                     pFootnote->Cut();
diff --git a/sw/source/core/layout/ssfrm.cxx b/sw/source/core/layout/ssfrm.cxx
index 8ff47322e0c0..043752c6d9e9 100644
--- a/sw/source/core/layout/ssfrm.cxx
+++ b/sw/source/core/layout/ssfrm.cxx
@@ -469,33 +469,6 @@ void SwTextFrame::RegisterToNode(SwTextNode & rNode, bool const isForceNodeAsFir
     }
 }
 
-//Flag pFrame for SwFrameDeleteGuard lifetime that we shouldn't delete
-//it in e.g. SwSectionFrame::MergeNext etc because we will need it
-//again after the SwFrameDeleteGuard dtor
-SwFrameDeleteGuard::SwFrameDeleteGuard(SwFrame* pFrame)
-    : m_pForbidFrame((pFrame && !pFrame->IsDeleteForbidden()) ? pFrame : nullptr)
-{
-    if (m_pForbidFrame)
-    {
-        m_pForbidFrame->ForbidDelete();
-    }
-}
-
-SwFrameDeleteGuard::~SwFrameDeleteGuard()
-{
-    if (m_pForbidFrame)
-    {
-        const bool bLogicErrorThrown = !m_pForbidFrame->IsDeleteForbidden();
-        if (bLogicErrorThrown)
-        {
-            // see testForcepoint80
-            SwFrame::DestroyFrame(m_pForbidFrame);
-            return;
-        }
-        m_pForbidFrame->AllowDelete();
-    }
-}
-
 void SwLayoutFrame::DestroyImpl()
 {
     while (!m_VertPosOrientFramesFor.empty())
@@ -510,7 +483,6 @@ void SwLayoutFrame::DestroyImpl()
 
     if( GetFormat() && !GetFormat()->GetDoc()->IsInDtor() )
     {
-        bool bFatalError = false;
         while ( pFrame )
         {
             //First delete the Objs of the Frame because they can't unregister
@@ -549,20 +521,9 @@ void SwLayoutFrame::DestroyImpl()
                 }
             }
             pFrame->RemoveFromLayout();
-            // see testForcepoint80
-            if (pFrame->IsDeleteForbidden())
-            {
-                pFrame->AllowDelete();
-                bFatalError = true;
-            }
-            else
-                SwFrame::DestroyFrame(pFrame);
+            SwFrame::DestroyFrame(pFrame);
             pFrame = m_pLower;
         }
-
-        if (bFatalError)
-            throw std::logic_error("DeleteForbidden");
-
         //Delete the Flys, the last one also deletes the array.
         while ( GetDrawObjs() && GetDrawObjs()->size() )
         {