sw: fix crash in SwContentTree::HasContentChanged()

Remove() will remove the node including its children, but
SvTreeList::Next() will actually return the first child, so the pChild
points to an entry that has been deleted.

Change-Id: Ia4bd75d64c8436ea03c0727a8d49ee0c34fda16f
(cherry picked from commit cdbe4863)
Reviewed-on: https://gerrit.libreoffice.org/63427
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 9968f6bc)

sw/source/uibase/utlui/content.cxx

@@ -2180,14 +2180,11 @@ bool SwContentTree::HasContentChanged()
                     }
                     if(bRemoveChildren)
                     {
-                        SvTreeListEntry* pChild = FirstChild(pEntry);
-                        SvTreeListEntry* pRemove = pChild;
                         for(size_t j = 0; j < nChildCount; ++j)
                         {
-                            pChild = Next(pRemove);
+                            SvTreeListEntry *const pRemove = FirstChild(pEntry);
                             assert(pRemove);
                             GetModel()->Remove(pRemove);
-                            pRemove = pChild;
                         }
                     }
                     if(!nChildCount)