i#95698 sw: fix crash on splitting in-table section containing a nested table

Found by crashtesting, ooo95698-1.odt crashed sw layout on load. The
intended use-case is splitting section frames inside a table frame, so
can just blacklist the non-interesting table-in-section-in-table case
that causes the problem here.

Change-Id: Ic47cd8c46cc71f7eaa36b03ec2c4a5df8ca8051c
Reviewed-on: https://gerrit.libreoffice.org/41224
Reviewed-by: Miklos Vajna <vmiklos@collabora.co.uk>
Tested-by: Jenkins <ci@libreoffice.org>

3 files changed, 22 insertions, 0 deletions

diff --git a/sw/qa/extras/uiwriter/data/i95698.odt b/sw/qa/extras/uiwriter/data/i95698.odt
new file mode 100644
index 000000000000..9fe3ec207648
--- /dev/null
+++ b/sw/qa/extras/uiwriter/data/i95698.odt
diff --git a/sw/qa/extras/uiwriter/uiwriter.cxx b/sw/qa/extras/uiwriter/uiwriter.cxx
index 68e96977139a..cb01dfc812d9 100644
--- a/sw/qa/extras/uiwriter/uiwriter.cxx
+++ b/sw/qa/extras/uiwriter/uiwriter.cxx
@@ -264,6 +264,7 @@ public:
 #if HAVE_MORE_FONTS
     void testTableInSection();
     void testTableInNestedSection();
+    void testTableInSectionInTable();
     void testLinesMoveBackwardsInSectionInTable();
 #endif
     void testLinesInSectionInTable();
@@ -415,6 +416,7 @@ public:
 #if HAVE_MORE_FONTS
     CPPUNIT_TEST(testTableInSection);
     CPPUNIT_TEST(testTableInNestedSection);
+    CPPUNIT_TEST(testTableInSectionInTable);
     CPPUNIT_TEST(testLinesMoveBackwardsInSectionInTable);
 #endif
     CPPUNIT_TEST(testLinesInSectionInTable);
@@ -5144,6 +5146,14 @@ void SwUiWriterTest::testTableInNestedSection()
     assertXPath(pXmlDoc, "//page[1]//section/tab", 1);
     assertXPath(pXmlDoc, "//page[2]//section/tab", 1);
 }
+
+void SwUiWriterTest::testTableInSectionInTable()
+{
+    // The document has a table, containing a section, containing a nested
+    // table.
+    // This crashed the layout.
+    createDoc("i95698.odt");
+}
 #endif
 
 void SwUiWriterTest::testParagraphOfTextRange()
diff --git a/sw/source/core/layout/tabfrm.cxx b/sw/source/core/layout/tabfrm.cxx
index 42faedfb2e81..5990b101ba4f 100644
--- a/sw/source/core/layout/tabfrm.cxx
+++ b/sw/source/core/layout/tabfrm.cxx
@@ -925,9 +925,21 @@ static bool lcl_FindSectionsInRow( const SwRowFrame& rRow )
                         if (const SwFrame* pSectionLower = pTmpFrame->GetLower())
                         {
                             if (!pSectionLower->IsColumnFrame())
+                            {
                                 // Section has a single column only, try to
                                 // split that.
                                 bRet = false;
+
+                                for (const SwFrame* pFrame = pSectionLower; pFrame; pFrame = pFrame->GetNext())
+                                {
+                                    if (pFrame->IsTabFrame())
+                                    {
+                                        // Section contains a table, no split in that case.
+                                        bRet = true;
+                                        break;
+                                    }
+                                }
+                            }
                         }
                     }
                 }