tdf#119109 sw: fix iteration in SwFrame::PrepareCursor() too

This is some copypasta, apply the same fix.

Change-Id: I096594f6d54fef68e63c982c2963499d24af6d15
Reviewed-on: https://gerrit.libreoffice.org/72798
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl@cib.de>
(cherry picked from commit c24299c3)
Reviewed-on: https://gerrit.libreoffice.org/72818Reviewed-by: Thorsten Behrens <Thorsten.Behrens@CIB.de>

sw/source/core/layout/calcmove.cxx

@@ -435,7 +435,20 @@ void SwFrame::PrepareCursor()
                      SwFlowFrame::CastFlowFrame(pFrame)->IsAnFollow( pThis ) )
                     break;
 
+                bool const isLast(pFrame->GetNext() == this);
                 pFrame->MakeAll(getRootFrame()->GetCurrShell()->GetOut());
+                if (isLast && pFrame->GetUpper() != GetUpper())
+                {
+                    assert(GetUpper()->Lower() == this
+                        // tab frame/section frame may split multiple times
+                        || (   SwFlowFrame::CastFlowFrame(pFrame)
+                            && SwFlowFrame::CastFlowFrame(GetUpper()->Lower())
+                            && SwFlowFrame::CastFlowFrame(pFrame)->IsAnFollow(
+                                SwFlowFrame::CastFlowFrame(GetUpper()->Lower()))
+                            && GetUpper()->Lower()->GetNext() == this));
+                    break; // tdf#119109 frame was moved backward, prevent
+                           // FindNext() returning a frame inside this if
+                }          // this is a table!
             }
             // With ContentFrames, the chain may be broken while walking through
             // it. Therefore we have to figure out the next frame in a bit more