Avoid bad downcast during destruction

...as reported by UBSan in CppunitTest_sw_filters_test:

> /sw/inc/format.hxx:110:73: runtime error: downcast of address 0x2af2d8024000 which does not point to an object of type 'const SwFormat'
> 0x2af2d8024000: note: object is of type 'SwModify'
>  f2 2a 00 00  70 33 2f 87 f2 2a 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00
>               ^~~~~~~~~~~~~~~~~~~~~~~
>               vptr for 'SwModify'
>     #0 0x2af27bbe8083 in SwFormat::DerivedFrom() const /sw/inc/format.hxx:110:73
>     #1 0x2af27bbc8401 in SwFormat::Modify(SfxPoolItem const*, SfxPoolItem const*) /sw/source/core/attr/format.cxx:282:21
>     #2 0x2af27e9934a3 in SwFrameFormat::Modify(SfxPoolItem const*, SfxPoolItem const*) /sw/source/core/layout/atrfrm.cxx:2597:5
>     #3 0x2af27f8207d5 in SwTableBoxFormat::Modify(SfxPoolItem const*, SfxPoolItem const*) /sw/source/core/table/swtable.cxx:2353:5
>     #4 0x2af27bb9cd52 in SwClient::SwClientNotify(SwModify const&, SfxHint const&) /sw/source/core/attr/calbck.cxx:68:9
>     #5 0x2af27bba4bee in SwModify::CallSwClientNotify(SfxHint const&) const /sw/inc/calbck.hxx:349:9
>     #6 0x2af27bba290b in SwModify::ModifyBroadcast(SfxPoolItem const*, SfxPoolItem const*) /sw/inc/calbck.hxx:173:11
>     #7 0x2af27bb9fbc0 in SwModify::NotifyClients(SfxPoolItem const*, SfxPoolItem const*) /sw/source/core/attr/calbck.cxx:143:5
>     #8 0x2af27bb9e0e7 in SwModify::~SwModify() /sw/source/core/attr/calbck.cxx:101:5
>     #9 0x2af27bbc6bb4 in SwFormat::~SwFormat() /sw/source/core/attr/format.cxx:251:1
>     #10 0x2af27e98fdf3 in SwFrameFormat::~SwFrameFormat() /sw/source/core/layout/atrfrm.cxx:2534:1
>     #11 0x2af27e9900af in SwFrameFormat::~SwFrameFormat() /sw/source/core/layout/atrfrm.cxx:2525:1
>     #12 0x2af27cb1646e in SwDoc::~SwDoc() /sw/source/core/doc/docnew.cxx:592:5
>     #13 0x2af27cb1993f in SwDoc::~SwDoc() /sw/source/core/doc/docnew.cxx:385:1
>     #14 0x2af282d45bb0 in SwDocShell::RemoveLink() /sw/source/uibase/app/docshini.cxx:472:13
>     #15 0x2af282d43596 in SwDocShell::~SwDocShell() /sw/source/uibase/app/docshini.cxx:394:5
>     #16 0x2af282d45f46 in SwDocShell::~SwDocShell() /sw/source/uibase/app/docshini.cxx:384:1
>     #17 0x2af282d4637f in SwDocShell::~SwDocShell() /sw/source/uibase/app/docshini.cxx:384:1
>     #18 0x2af282d464c6 in virtual thunk to SwDocShell::~SwDocShell() /sw/source/uibase/app/docshini.cxx:383:13
>     #19 0x2af27420aade in SvRefBase::ReleaseRef() /include/tools/ref.hxx:138:29
>     #20 0x2af27420195a in tools::SvRef<SwDocShell>::~SvRef() /include/tools/ref.hxx:49:30
>     #21 0x2af2741f6663 in SwFiltersTest::filter(rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, SfxFilterFlags, SotClipboardFormatId, unsigned int, bool) /sw/qa/core/filters-test.cxx:130:1
>     #22 0x2af2741f368e in SwFiltersTest::load(rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, SfxFilterFlags, SotClipboardFormatId, unsigned int) /sw/qa/core/filters-test.cxx:69:12
>     #23 0x2af29a05d1fb in test::FiltersTest::recursiveScan(test::filterStatus, rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, SfxFilterFlags, SotClipboardFormatId, unsigned int, bool) /unotest/source/cpp/filters-test.cxx:129:20
>     #24 0x2af29a060741 in test::FiltersTest::testDir(rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, SfxFilterFlags, SotClipboardFormatId, unsigned int, bool) /unotest/source/cpp/filters-test.cxx:154:5
>     #25 0x2af2741fa8fa in SwFiltersTest::testCVEs() /sw/qa/core/filters-test.cxx:174:5
>     #26 0x2af27421631d in CppUnit::TestCaller<SwFiltersTest>::runTest() /workdir/UnpackedTarball/cppunit/include/cppunit/TestCaller.h:166:6
>     #27 0x2af23644866d in CppUnit::TestCaseMethodFunctor::operator()() const /workdir/UnpackedTarball/cppunit/src/cppunit/TestCase.cpp:32:5
>     #28 0x2af24e66d0d6 in (anonymous namespace)::Protector::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) /test/source/vclbootstrapprotector.cxx:57:14
>     #29 0x2af236403bb7 in CppUnit::ProtectorChain::ProtectFunctor::operator()() const /workdir/UnpackedTarball/cppunit/src/cppunit/ProtectorChain.cpp:20:12
>     #30 0x2af2458a1926 in (anonymous namespace)::Prot::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) /unotest/source/cpp/unobootstrapprotector/unobootstrapprotector.cxx:88:12
>     #31 0x2af236403bb7 in CppUnit::ProtectorChain::ProtectFunctor::operator()() const /workdir/UnpackedTarball/cppunit/src/cppunit/ProtectorChain.cpp:20:12
>     #32 0x2af241b89d58 in (anonymous namespace)::Prot::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) /unotest/source/cpp/unoexceptionprotector/unoexceptionprotector.cxx:63:16
>     #33 0x2af236403bb7 in CppUnit::ProtectorChain::ProtectFunctor::operator()() const /workdir/UnpackedTarball/cppunit/src/cppunit/ProtectorChain.cpp:20:12
>     #34 0x2af23638b90c in CppUnit::DefaultProtector::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) /workdir/UnpackedTarball/cppunit/src/cppunit/DefaultProtector.cpp:15:12
>     #35 0x2af236403bb7 in CppUnit::ProtectorChain::ProtectFunctor::operator()() const /workdir/UnpackedTarball/cppunit/src/cppunit/ProtectorChain.cpp:20:12
>     #36 0x2af2363ffb61 in CppUnit::ProtectorChain::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) /workdir/UnpackedTarball/cppunit/src/cppunit/ProtectorChain.cpp:77:18
>     #37 0x2af2364c91c5 in CppUnit::TestResult::protect(CppUnit::Functor const&, CppUnit::Test*, std::string const&) /workdir/UnpackedTarball/cppunit/src/cppunit/TestResult.cpp:181:10
>     #38 0x2af2364451c6 in CppUnit::TestCase::run(CppUnit::TestResult*) /workdir/UnpackedTarball/cppunit/src/cppunit/TestCase.cpp:91:5
>     #39 0x2af23644bc03 in CppUnit::TestComposite::doRunChildTests(CppUnit::TestResult*) /workdir/UnpackedTarball/cppunit/src/cppunit/TestComposite.cpp:64:5
>     #40 0x2af23644ab6d in CppUnit::TestComposite::run(CppUnit::TestResult*) /workdir/UnpackedTarball/cppunit/src/cppunit/TestComposite.cpp:23:3
>     #41 0x2af23644bc03 in CppUnit::TestComposite::doRunChildTests(CppUnit::TestResult*) /workdir/UnpackedTarball/cppunit/src/cppunit/TestComposite.cpp:64:5
>     #42 0x2af23644ab6d in CppUnit::TestComposite::run(CppUnit::TestResult*) /workdir/UnpackedTarball/cppunit/src/cppunit/TestComposite.cpp:23:3
>     #43 0x2af2365078c6 in CppUnit::TestRunner::WrappingSuite::run(CppUnit::TestResult*) /workdir/UnpackedTarball/cppunit/src/cppunit/TestRunner.cpp:47:5
>     #44 0x2af2364c7049 in CppUnit::TestResult::runTest(CppUnit::Test*) /workdir/UnpackedTarball/cppunit/src/cppunit/TestResult.cpp:148:3
>     #45 0x2af236508e86 in CppUnit::TestRunner::run(CppUnit::TestResult&, std::string const&) /workdir/UnpackedTarball/cppunit/src/cppunit/TestRunner.cpp:96:3
>     #46 0x501b3c in (anonymous namespace)::ProtectedFixtureFunctor::run() const /sal/cppunittester/cppunittester.cxx:281:13
>     #47 0x4fc866 in sal_main() /sal/cppunittester/cppunittester.cxx:431:14
>     #48 0x4fa822 in main /sal/cppunittester/cppunittester.cxx:338:1
>     #49 0x2af2380d2af4 in __libc_start_main (/lib64/libc.so.6+0x21af4)
>     #50 0x4323c4 in _start (/workdir/LinkTarget/Executable/cppunittester+0x4323c4)

Change-Id: Ic1ff73d3184ad2cd97555b7a45fb205e9ec84ac6

1 files changed, 1 insertions, 1 deletions

diff --git a/sw/source/core/attr/format.cxx b/sw/source/core/attr/format.cxx
index d350b3278519..8210df867d83 100644
--- a/sw/source/core/attr/format.cxx
+++ b/sw/source/core/attr/format.cxx
@@ -279,7 +279,7 @@ void SwFormat::Modify( const SfxPoolItem* pOldValue, const SfxPoolItem* pNewValu
                 else
                 {
                     // otherwise de-register at least from dying one
-                    DerivedFrom()->Remove( this );
+                    GetRegisteredIn()->Remove( this );
                     m_aSet.SetParent( nullptr );
                 }
             }