tdf#91228 Fix Writer crash

Start Writer, Insert Image, Anchor as character, Go after
image, press enter, writer crash

This is because m_pAnchoredFly is not updated.

JoinPrev, JoinNext and SplitContentNode all rely on CutText with calls
InsertHint. InsertHint calls SetAnchor. SetAnchor calls Modify callback
except if "LockModify"ed. This patch ensures that, whatever the value of
LockModify, the references are kept correct.

Change-Id: Id7254784c6954db4b542b2c4228b388fb924bbc2
Reviewed-on: https://gerrit.libreoffice.org/16041Reviewed-by: Michael Stahl <mstahl@redhat.com>
Tested-by: Michael Stahl <mstahl@redhat.com>

sw/source/core/txtnode/thints.cxx

@@ -1276,19 +1276,45 @@ bool SwTextNode::InsertHint( SwTextAttr * const pAttr, const SetAttrMode nMode )
             {
                 SwTextFlyCnt *pFly = static_cast<SwTextFlyCnt *>(pAttr);
                 SwFrameFormat* pFormat = pAttr->GetFlyCnt().GetFrameFormat();
+
+                // In order to maintain data coherency, if the hint is a fly
+                // moved from a text node to another, we have to remove it from
+                // the first textnode then to add it to the new (this) textnode
+                const SwFormatAnchor* pAnchor = 0;
+                pFormat->GetItemState( RES_ANCHOR, false,
+                    reinterpret_cast<const SfxPoolItem**>(&pAnchor) );
+
+                SwIndex aIdx( this, pAttr->GetStart() );
+
+                bool bChangeFlyParentNode( false );
+                if (pAnchor &&
+                    pAnchor->GetAnchorId() == FLY_AS_CHAR &&
+                    pAnchor->GetContentAnchor() &&
+                    pAnchor->GetContentAnchor()->nNode != *this)
+                {
+                    assert(pAnchor->GetContentAnchor()->nNode.GetNode().IsTextNode());
+                    SwTextNode* textNode = pAnchor->GetContentAnchor()->nNode.GetNode().GetTextNode();
+
+                    if ( textNode->IsModifyLocked() )
+                    {
+                        //  Fly parent has changed but the FlyFormat is locked, so it will
+                        //  not be updated by SetAnchor (that calls Modify that updates
+                        //  relationships)
+                        textNode->RemoveAnchoredFly( pFormat );
+                        bChangeFlyParentNode = true;
+                    }
+                }
+
                 if( !(SetAttrMode::NOTXTATRCHR & nInsMode) )
                 {
+
                     // Wir muessen zuerst einfuegen, da in SetAnchor()
                     // dem FlyFrm GetStart() uebermittelt wird.
                     //JP 11.05.98: falls das Anker-Attribut schon richtig
                     // gesetzt ist, dann korrigiere dieses nach dem Einfuegen
                     // des Zeichens. Sonst muesste das immer  ausserhalb
                     // erfolgen (Fehleranfaellig !)
-                    const SwFormatAnchor* pAnchor = 0;
-                    pFormat->GetItemState( RES_ANCHOR, false,
-                        reinterpret_cast<const SfxPoolItem**>(&pAnchor) );
 
-                    SwIndex aIdx( this, pAttr->GetStart() );
                     const OUString c(GetCharOfTextAttr(*pAttr));
                     OUString const ins( InsertText(c, aIdx, nInsertFlags) );
                     if (ins.isEmpty())
@@ -1352,6 +1378,11 @@ bool SwTextNode::InsertHint( SwTextAttr * const pAttr, const SetAttrMode nMode )
                         return false;
                     }
                 }
+
+                // Finish relationships update now that SetAnchor has fixed part of it.
+                if (bChangeFlyParentNode)
+                    AddAnchoredFly( pFormat );
+
                 break;
             }