From 33e8891ea9d75519da56431073897a57ab251d6a Mon Sep 17 00:00:00 2001
From: Michael Stahl <mstahl@redhat.com>
Date: Mon, 13 Feb 2012 18:27:59 +0100
Subject: [PATCH 2/3] fdo#41712: sw: fix crash in layout frame linked lists:
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The pPrecede member is not maintained properly when setting the
corresponding pFollow member.
The change in SwTxtFrm::JoinFrm() fixes the crash, the other changes
are perhaps fixes for other crashes...
(regression from cc3d0d182cafef9649e45f4657233ac2221fdd0a)

Signed-off-by: C├ędric Bosdonnat <cedric.bosdonnat.ooo@free.fr>
---
 sw/source/core/inc/flowfrm.hxx    |    1 +
 sw/source/core/layout/flowfrm.cxx |   21 +++++++++++++++++++++
 sw/source/core/layout/sectfrm.cxx |    2 +-
 sw/source/core/text/frmform.cxx   |    2 +-
 4 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/sw/source/core/inc/flowfrm.hxx b/sw/source/core/inc/flowfrm.hxx
index 1f9009d..9617988 100644
--- a/sw/source/core/inc/flowfrm.hxx
+++ b/sw/source/core/inc/flowfrm.hxx
@@ -150,6 +150,7 @@ protected:
 
 public:
     SwFlowFrm( SwFrm &rFrm );
+    virtual ~SwFlowFrm();
 
     const SwFrm *GetFrm() const 		   { return &rThis; }
           SwFrm *GetFrm()				   { return &rThis; }
diff --git a/sw/source/core/layout/flowfrm.cxx b/sw/source/core/layout/flowfrm.cxx
index 738c7e3..c5e083f 100644
--- a/sw/source/core/layout/flowfrm.cxx
+++ b/sw/source/core/layout/flowfrm.cxx
@@ -88,12 +88,33 @@ SwFlowFrm::SwFlowFrm( SwFrm &rFrm ) :
         bFtnLock = bFlyLock = sal_False;
 }
 
+SwFlowFrm::~SwFlowFrm()
+{
+    if (m_pFollow)
+    {
+        m_pFollow->m_pPrecede = 0;
+    }
+    if (m_pPrecede)
+    {
+        m_pPrecede->m_pFollow = 0;
+    }
+}
 
 void SwFlowFrm::SetFollow(SwFlowFrm *const pFollow)
 {
+    if (m_pFollow)
+    {
+        assert(this == m_pFollow->m_pPrecede);
+        m_pFollow->m_pPrecede = 0;
+    }
     m_pFollow = pFollow;
     if (m_pFollow != NULL)
     {
+        if (m_pFollow->m_pPrecede) // re-chaining pFollow?
+        {
+            assert(m_pFollow == m_pFollow->m_pPrecede->m_pFollow);
+            m_pFollow->m_pPrecede->m_pFollow = 0;
+        }
         m_pFollow->m_pPrecede = this;
     }
 }
diff --git a/sw/source/core/layout/sectfrm.cxx b/sw/source/core/layout/sectfrm.cxx
index 2b21733..eee5a68 100644
--- a/sw/source/core/layout/sectfrm.cxx
+++ b/sw/source/core/layout/sectfrm.cxx
@@ -223,7 +223,7 @@ void SwSectionFrm::DelEmpty( sal_Bool bRemove )
     }
     else if( HasFollow() )
         GetFollow()->bIsFollow = sal_False;
-    m_pFollow = NULL;
+    SetFollow(0);
     if( pUp )
     {
         Frm().Height( 0 );
diff --git a/sw/source/core/text/frmform.cxx b/sw/source/core/text/frmform.cxx
index 619c700..464eab7 100644
--- a/sw/source/core/text/frmform.cxx
+++ b/sw/source/core/text/frmform.cxx
@@ -684,8 +684,8 @@ SwCntntFrm *SwTxtFrm::JoinFrm()
     }
     // <--
     pFoll->Cut();
+    SetFollow(pNxt);
     delete pFoll;
-    m_pFollow = pNxt;
     return pNxt;
 }
 
-- 
1.7.7.6