sw_redlinehide: skip unnecessary updates when undoing redlined delete

When reproducing tdf#135976 and then Undo, an UAF crash happens here:

assert(!pFrame->GetDrawObjs() || !pObjs->Contains(*pObj));

The pObjs was actually deleted and then re-created, because the pObj was
removed from the frame and added again to the same frame.

This is a bit unexpected, so prevent it by taking a shortcut in the
caller UpdateFramesForRemoveDeleteRedline() to insert a check that had
been removed in commit 14e87a4b15d31a34e6053f6194688f3aa23af991.

If the rPam is inside a single node, the sw::RedlineUnDelText hint that
was sent to the SwTextFrame should be sufficient to update it and the
rest of the code in the loop that deals with newly split paragraph can
be skipped.

Change-Id: I5f36eb91bc20003887ee0bad03ea4a6e67135de9
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/135907
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
(cherry picked from commit cf9a16caf5012d65b2a45a5525e36e40585dd35c)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/135892
Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de>
(cherry picked from commit 918f435d48de3f29814f187c8621c1a564c5b835)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136222
Tested-by: Thorsten Behrens <thorsten.behrens@allotropia.de>

1 files changed, 6 insertions, 0 deletions

diff --git a/sw/source/core/doc/DocumentRedlineManager.cxx b/sw/source/core/doc/DocumentRedlineManager.cxx
index 8ae32f266bdb..e11c1c6f2c4b 100644
--- a/sw/source/core/doc/DocumentRedlineManager.cxx
+++ b/sw/source/core/doc/DocumentRedlineManager.cxx
@@ -283,6 +283,12 @@ void UpdateFramesForRemoveDeleteRedline(SwDoc & rDoc, SwPaM const& rPam)
                 break;
             }
 
+            // no nodes can be unmerged by this - skip MakeFrames() etc.
+            if (rPam.GetPoint()->nNode == rPam.GetMark()->nNode)
+            {
+                break; // continue with AppendAllObjs()
+            }
+
             // first, call CheckParaRedlineMerge on the first paragraph,
             // to init flag on new merge range (if any) + 1st node post the merge
             auto eMode(sw::FrameMode::Existing);