fdo#87199: sw: fix root cause of a11y crash when merging cells

Commit f9eff2a4 is not quite right
because it will leave the mpNext chain unreachable; that could perhaps
be imporoved by calling RemoveFromLayout(), but...

Actually the problem is basically that one of the deleted SwCellFrms
points to a SwTableBox with getRowSpan() -1 (because it has been merged)
and thus IsInCoveredCell() returns true and that causes ~SwCellFrm() to
skip disposing the SwAccessible stuff, so the SwCellFrm is still
contained in the SwAccessibleMap.

Because it's rather hard to prevent this sort of thing in general,
better change SwAccessibleMap::Dispose() to assume that if it found its
way into the SwAccessibleMap it should be disposed and removed.

Change-Id: Ib4cec6924cb026ae30bdac6857957adf237b4d70

sw/source/core/access/accmap.cxx

@@ -2263,7 +2263,9 @@ void SwAccessibleMap::Dispose( const SwFrm *pFrm,
     OSL_ENSURE( !aFrmOrObj.GetSwFrm() || aFrmOrObj.GetSwFrm()->IsAccessibleFrm(),
             "non accessible frame should be disposed" );
 
-    if( aFrmOrObj.IsAccessible( GetShell()->IsPreview() ) )
+    if (aFrmOrObj.IsAccessible( GetShell()->IsPreview() )
+            // fdo#87199 dispose the darn thing if it ever was accessible
+        || (pFrm && mpFrmMap && mpFrmMap->find(pFrm) != mpFrmMap->end()))
     {
         ::rtl::Reference< SwAccessibleContext > xAccImpl;
         ::rtl::Reference< SwAccessibleContext > xParentAccImpl;

sw/source/core/layout/ssfrm.cxx

@@ -367,12 +367,6 @@ void SwFrm::Destroy()
         delete mpDrawObjs;
         mpDrawObjs = 0;
     }
-
-    SwLayoutFrm *pFrm = GetUpper();
-    if (pFrm && pFrm->m_pLower == this)
-    {
-        pFrm->m_pLower = nullptr;
-    }
 }
 
 SwFrm::~SwFrm()