The problem, in a nutshell, is that SwDrawContact::Changed() is called
during layout, and recursively starts another layout that removes a
drawing object that is being iterated over in frame #28
SwObjectFormatter::FormatObjsAtFrame_() from the layout.

Apparently SwDrawContact::Changed() is by far the most dangerous
function to call during layout; set the quite targeted flag
SetCallbackActionEnabled() to prevent the recursion.

0  SwSortedObjs::Remove(SwAnchoredObject&) (this=0x73e4a00, _rAnchoredObj=...) at sw/source/core/layout/sortedobjs.cxx:228
1  SwFrame::RemoveDrawObj(SwAnchoredObject&) (this=0x9430e20, _rToRemoveObj=...) at sw/source/core/layout/fly.cxx:2076
2  SwDrawVirtObj::RemoveFromWriterLayout() (this=0x95ce130) at sw/source/core/draw/dcontact.cxx:2199
3  SwDrawContact::DisconnectObjFromLayout(SdrObject*) (this=0x70fef00, _pDrawObj=0x95ce130) at sw/source/core/draw/dcontact.cxx:1663
4  SwLayoutFrame::DestroyImpl() (this=0x91c6c60) at sw/source/core/layout/ssfrm.cxx:489
5  SwFrame::DestroyFrame(SwFrame*) (pFrame=0x91c6c60) at sw/source/core/layout/ssfrm.cxx:389
6  SwLayoutFrame::DestroyImpl() (this=0x9435cd0) at sw/source/core/layout/ssfrm.cxx:500
7  SwPageFrame::DestroyImpl() (this=0x9435cd0) at sw/source/core/layout/pagechg.cxx:270
8  SwFrame::DestroyFrame(SwFrame*) (pFrame=0x9435cd0) at sw/source/core/layout/ssfrm.cxx:389
9  SwRootFrame::RemovePage(SwPageFrame**, SwRemoveResult) (this=0x36b26f0, pDelRef=0x7ffeafbf2e38, eResult=SwRemoveResult::Prev) at sw/source/core/layout/pagechg.cxx:1351
10 SwRootFrame::RemoveSuperfluous() (this=0x36b26f0) at sw/source/core/layout/pagechg.cxx:1426
11 SwLayAction::InternalAction(OutputDevice*) (this=0x7ffeafbf3250, pRenderContext=0x3595030) at sw/source/core/layout/layact.cxx:502
12 SwLayAction::Action(OutputDevice*) (this=0x7ffeafbf3250, pRenderContext=0x3595030) at sw/source/core/layout/layact.cxx:351
13 SwViewShell::ImplEndAction(bool) (this=0x364cc00, bIdleEnd=false) at sw/source/core/view/viewsh.cxx:279
14 SwViewShell::EndAction(bool) (this=0x364cc00, bIdleEnd=false) at sw/inc/viewsh.hxx:605
15 SwCursorShell::EndAction(bool, bool) (this=0x364cc00, bIdleEnd=false, DoSetPosX=false) at sw/source/core/crsr/crsrsh.cxx:259
16 SwRootFrame::EndAllAction(bool) (this=0x36b26f0, bVirDev=false) at sw/source/core/layout/pagechg.cxx:1728
17 SwDrawContact::Changed(SdrObject const&, SdrUserCallType, tools::Rectangle const&) (this=0x70fef00, rObj=..., eType=SdrUserCallType::MoveOnly, rOldBoundRect=...) at sw/source/core/draw/dcontact.cxx:985
18 SdrObject::SendUserCall(SdrUserCallType, tools::Rectangle const&) const (this=0x95ce130, eUserCall=SdrUserCallType::MoveOnly, rBoundRect=...) at svx/source/svdraw/svdobj.cxx:2736
19 SdrObject::Move(Size const&) (this=0x95ce130, rSiz=Size = {...}) at svx/source/svdraw/svdobj.cxx:1482
20 SwDrawVirtObj::Move(Size const&) (this=0x95ce130, rSiz=Size = {...}) at sw/source/core/draw/dcontact.cxx:2366
21 SwAnchoredDrawObject::SetObjTop_(long) (this=0x95ce250, _nTop=777490) at sw/source/core/layout/anchoreddrawobject.cxx:677
22 SwAnchoredObject::SetObjTop(long) (this=0x95ce250, _nTop=777490) at sw/source/core/layout/anchoredobject.cxx:593
23 objectpositioning::SwToContentAnchoredObjectPosition::CalcPosition() (this=0x7ffeafbf3980) at sw/source/core/objectpositioning/tocntntanchoredobjectposition.cxx:739
24 SwAnchoredDrawObject::MakeObjPosAnchoredAtPara() (this=0x95ce250) at sw/source/core/layout/anchoreddrawobject.cxx:421
25 SwAnchoredDrawObject::MakeObjPos() (this=0x95ce250) at sw/source/core/layout/anchoreddrawobject.cxx:318
26 SwObjectFormatter::FormatObj_(SwAnchoredObject&) (this=0x90623d0, _rAnchoredObj=...) at sw/source/core/layout/objectformatter.cxx:374
27 SwObjectFormatterTextFrame::DoFormatObj(SwAnchoredObject&, bool) (this=0x90623d0, _rAnchoredObj=..., _bCheckForMovedFwd=false) at sw/source/core/layout/objectformattertxtfrm.cxx:126
28 SwObjectFormatter::FormatObjsAtFrame_(SwTextFrame*) (this=0x90623d0, _pMasterTextFrame=0x0) at sw/source/core/layout/objectformatter.cxx:443
29 SwObjectFormatterTextFrame::DoFormatObjs() (this=0x90623d0) at sw/source/core/layout/objectformattertxtfrm.cxx:328
30 SwObjectFormatter::FormatObjsAtFrame(SwFrame&, SwPageFrame const&, SwLayAction*) (_rAnchorFrame=..., _rPageFrame=..., _pLayAction=0x0) at sw/source/core/layout/objectformatter.cxx:191
31 SwHeadFootFrame::FormatSize(long, SwBorderAttrs const*) (this=0x91c6c60, nUL=663, pAttrs=0x8fbc530) at sw/source/core/layout/hffrm.cxx:263
32 SwHeadFootFrame::Format(OutputDevice*, SwBorderAttrs const*) (this=0x91c6c60, pRenderContext=0x3595030, pAttrs=0x8fbc530) at sw/source/core/layout/hffrm.cxx:416
33 SwLayoutFrame::MakeAll(OutputDevice*) (this=0x91c6c60) at sw/source/core/layout/calcmove.cxx:913
34 SwFrame::PrepareMake(OutputDevice*) (this=0x91c6c60, pRenderContext=0x3595030) at sw/source/core/layout/calcmove.cxx:346
35 SwFrame::Calc(OutputDevice*) const (this=0x91c6c60, pRenderContext=0x3595030) at sw/source/core/layout/trvlfrm.cxx:1783
36 lcl_FormatLay(SwLayoutFrame*) (pLay=0x91c6c60) at sw/source/core/layout/pagechg.cxx:360
37 lcl_FormatLay(SwLayoutFrame*) (pLay=0x9435cd0) at sw/source/core/layout/pagechg.cxx:357
38 SwPageFrame::PreparePage(bool) (this=0x9435cd0, bFootnote=false) at sw/source/core/layout/pagechg.cxx:456
39 (anonymous namespace)::doInsertPage(SwRootFrame*, SwPageFrame**, SwFrameFormat*, SwPageDesc*, bool, SwPageFrame**) (pRoot=0x36b26f0, pRefSibling=0x7ffeafbf43c8, pFormat=0x3076050, pDesc=0x3076010, bFootnote=false, pRefPage=0x7ffeafbf43d8) at sw/source/core/layout/pagechg.cxx:1210
40 SwFrame::InsertPage(SwPageFrame*, bool) (this=0x3620d70, pPrevPage=0x9227900, bFootnote=false) at sw/source/core/layout/pagechg.cxx:1269
41 SwFrame::GetNextLeaf(MakePageType) (this=0x3620d70, eMakePage=MAKEPAGE_INSERT) at sw/source/core/layout/flowfrm.cxx:994
42 SwFrame::GetLeaf(MakePageType, bool) (this=0x3620d70, eMakePage=MAKEPAGE_INSERT, bFwd=true) at sw/source/core/layout/flowfrm.cxx:797
43 SwFlowFrame::MoveFwd(bool, bool, bool) (this=0x3620e18, bMakePage=true, bPageBreak=false, bMoveAlways=false) at sw/source/core/layout/flowfrm.cxx:1851
44 SwContentFrame::MakeAll(OutputDevice*) (this=0x3620d70) at sw/source/core/layout/calcmove.cxx:1681
45 SwFrame::PrepareMake(OutputDevice*) (this=0x707a340, pRenderContext=0x3595030) at sw/source/core/layout/calcmove.cxx:312
46 SwFrame::Calc(OutputDevice*) const (this=0x707a340, pRenderContext=0x3595030) at sw/source/core/layout/trvlfrm.cxx:1783
47 GetFrameOfModify(SwRootFrame const*, SwModify const&, SwFrameType, Point const*, SwPosition const*, bool) (pLayout=0x36b26f0, rMod=..., nFrameType=(SwFrameType::Txt | SwFrameType::NoTxt), pPoint=0x707c6f0, pPos=0x707c720, bCalcFrame=true) at sw/source/core/layout/frmtool.cxx:3247
48 SwContentNode::getLayoutFrame(SwRootFrame const*, Point const*, SwPosition const*, bool) const (this=0x71328c0, _pRoot=0x36b26f0, pPoint=0x707c6f0, pPos=0x707c720, bCalcFrame=true) at sw/source/core/docnode/node.cxx:1118
49 SwRootFrame::CalcFrameRects(SwShellCursor&) (this=0x36b26f0, rCursor=...) at sw/source/core/layout/trvlfrm.cxx:2028
50 SwShellCursor::FillRects() (this=0x707c680) at sw/source/core/crsr/viscrs.cxx:609
51 SwSelPaintRects::Show(std::__debug::vector<rtl::OString, std::allocator<rtl::OString> >*) (this=0x707c680, pSelectionRectangles=0x7ffeafbf5570) at sw/source/core/crsr/viscrs.cxx:332
52 SwShellCursor::Show(SfxViewShell*) (this=0x707c680, pViewShell=0x0) at sw/source/core/crsr/viscrs.cxx:619
53 SwCursorShell::Paint(OutputDevice&, tools::Rectangle const&) (this=0x364cc00, rRenderContext=..., rRect=...) at sw/source/core/crsr/crsrsh.cxx:1283
54 SwEditWin::Paint(OutputDevice&, tools::Rectangle const&) (this=0x3595030, rRenderContext=..., rRect=...) at sw/source/uibase/docvw/edtwin2.cxx:476

Change-Id: I1b237f0f425e58bb95bae9f19019f26fe5da21fd