Fix crash when removing columns in merged row

Change 4b709b41f5a7ae8dc6e537b644158f5201ce0a98 tried to make sure that
rows with merged cells would not be completely removed, as this would
cause a crash. However, when removing just a few columns from a merged
cell, the span of the cell should be reduced by the number of columns
removed. The "touched" guard would cause the span to be decreased a
maximum of one time, regardless of how many columns were removed,
leaving the table in an invalid state, as the column count would be
smaller than the span of the cell. This would assert later on.
To avoid this, we only guard against removal, not against decreasing
the span.

Task-number: QTBUG-11646
Reviewed-by: Thomas Zander

1 files changed, 4 insertions, 3 deletions

diff --git a/src/gui/text/qtexttable.cpp b/src/gui/text/qtexttable.cpp
index 5100176..ada18c8 100644
--- a/src/gui/text/qtexttable.cpp
+++ b/src/gui/text/qtexttable.cpp
@@ -915,12 +915,13 @@ void QTextTable::removeColumns(int pos, int num)
     for (int r = 0; r < d->nRows; ++r) {
         for (int c = pos; c < pos + num; ++c) {
             int cell = d->grid[r*d->nCols + c];
-            if (touchedCells.contains(cell))
-                continue;
-            touchedCells << cell;
             QTextDocumentPrivate::FragmentIterator it(&p->fragmentMap(), cell);
             QTextCharFormat fmt = collection->charFormat(it->format);
             int span = fmt.tableCellColumnSpan();
+            if (touchedCells.contains(cell) && span <= 1)
+                continue;
+            touchedCells << cell;
+
             if (span > 1) {
                 fmt.setTableCellColumnSpan(span - 1);
                 p->setCharFormat(it.position(), 1, fmt);