tdf#154863 Add unit test to cover crash on image move

This reverts commit 332faa6340.

This change adds a CppUnit test that changes the position
of an image in an example document which causes a crash
if the bug exists.

This also adds a delete guard for a SwFrame used to
prevent a use-after-free condition.

Change-Id: I5cfec75681a5877c007df33c23d9a5e61e4292c8
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/162940
Tested-by: Jenkins
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>

sw/qa/core/objectpositioning/objectpositioning.cxx

@@ -25,6 +25,8 @@
 #include <flyfrm.hxx>
 #include <frmatr.hxx>
 
+#include <vcl/scheduler.hxx>
+
 namespace
 {
 /// Covers sw/source/core/objectpositioning/ fixes.
@@ -56,6 +58,18 @@ CPPUNIT_TEST_FIXTURE(Test, testOverlapCrash)
     pWrtShell->SplitNode();
 }
 
+CPPUNIT_TEST_FIXTURE(Test, testImgMoveCrash)
+{
+    createSwDoc("tdf154863-img-move-crash.docx");
+    uno::Reference<drawing::XShape> xShape(getShapeByName(u"Image26"), uno::UNO_QUERY);
+    uno::Reference<beans::XPropertySet> xShapeProps(xShape, uno::UNO_QUERY);
+    xShapeProps->setPropertyValue("VertOrient", uno::Any(static_cast<sal_Int32>(0)));
+    xShapeProps->setPropertyValue("VertOrientPosition", uno::Any(static_cast<sal_Int32>(3000)));
+    Scheduler::ProcessEventsToIdle();
+    // Crash expected before assert if bug exists
+    CPPUNIT_ASSERT(true);
+}
+
 CPPUNIT_TEST_FIXTURE(Test, testVertPosFromBottom)
 {
     // Create a document, insert a shape and position it 1cm above the bottom of the body area.

sw/source/core/layout/tabfrm.cxx

@@ -1754,6 +1754,7 @@ bool SwContentFrame::CalcLowers(SwLayoutFrame & rLay, SwLayoutFrame const& rDont
             {
                 // #i23129#, #i36347# - pass correct page frame to
                 // the object formatter
+                SwFrameDeleteGuard aDeleteGuard(pCnt);
                 if ( !SwObjectFormatter::FormatObjsAtFrame( *pCnt,
                                                           *(pCnt->FindPageFrame()) ) )
                 {