tdf#96275 RTF import: fix anchor of shapes inside tables

Table text is buffered, so buffer the shape import as well, otherwise
the anchor will precede the buffered text -> incorrect anchor position.

Change-Id: I527b898e2cd5fafaf122a20e11df66ba8d3185cf
Reviewed-on: https://gerrit.libreoffice.org/24822Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Miklos Vajna <vmiklos@collabora.co.uk>

sw/qa/extras/rtfimport/data/tdf96275.rtf

+{\rtf1
+\ltrrow\trowd \cellx4703\cellx9514\pard\plain \intbl
+{A
+\par B
+\par }
+{\shp
+{\*\shpinst\shpleft1418\shptop104\shpright2903\shpbottom629\shpfhdr0\shpbxcolumn\shpbxignore\shpbypara\shpbyignore\shpwr3\shpwrk0
+{\sp
+{\sn shapeType}
+{\sv 3}
+}
+}
+}
+{C\cell \cell }
+\pard\plain \intbl
+{\row}
+\pard\plain\par
+}

sw/qa/extras/rtfimport/rtfimport.cxx

@@ -2590,6 +2590,15 @@ DECLARE_RTFIMPORT_TEST(testTdf95707, "tdf95707.rtf")
     CPPUNIT_ASSERT(getProperty<OUString>(getShape(1), "GraphicURL") != "vnd.sun.star.GraphicObject:0000000000000000000000000000000000000000");
 }
 
+DECLARE_RTFIMPORT_TEST(testTdf96275, "tdf96275.rtf")
+{
+    uno::Reference<text::XTextTable> xTable(getParagraphOrTable(1), uno::UNO_QUERY);
+    uno::Reference<text::XTextRange> xCell(xTable->getCellByName("A1"), uno::UNO_QUERY);
+    uno::Reference<text::XTextRange> xParagraph = getParagraphOfText(3, xCell->getText());
+    // This was text: the shape's frame was part of the 1st paragraph instead of the 3rd one.
+    CPPUNIT_ASSERT_EQUAL(OUString("Frame"), getProperty<OUString>(getRun(xParagraph, 1), "TextPortionType"));
+}
+
 CPPUNIT_PLUGIN_IMPLEMENT();
 
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */

writerfilter/source/rtftok/rtfdocumentimpl.cxx

@@ -1521,6 +1521,8 @@ void RTFDocumentImpl::replayBuffer(RTFBuffer_t& rBuffer,
             parBreak();
         else if (std::get<0>(aTuple) == BUFFER_STARTSHAPE)
             m_pSdrImport->resolve(std::get<1>(aTuple)->getShape(), false, RTFSdrImport::SHAPE);
+        else if (std::get<0>(aTuple) == BUFFER_RESOLVESHAPE)
+            m_pSdrImport->resolve(std::get<1>(aTuple)->getShape(), true, RTFSdrImport::SHAPE);
         else if (std::get<0>(aTuple) == BUFFER_ENDSHAPE)
             m_pSdrImport->close();
         else if (std::get<0>(aTuple) == BUFFER_RESOLVESUBSTREAM)
@@ -2059,7 +2061,14 @@ RTFError RTFDocumentImpl::popState()
         {
             // Don't trigger a shape import in case we're only leaving the \shpinst of the groupshape itself.
             RTFSdrImport::ShapeOrPict eType = (aState.eDestination == Destination::SHAPEINSTRUCTION) ? RTFSdrImport::SHAPE : RTFSdrImport::PICT;
-            m_pSdrImport->resolve(m_aStates.top().aShape, true, eType);
+            if (!m_aStates.top().pCurrentBuffer || eType != RTFSdrImport::SHAPE)
+                m_pSdrImport->resolve(m_aStates.top().aShape, true, eType);
+            else
+            {
+                // Shape inside table: buffer the import to have correct anchor position.
+                auto pValue = std::make_shared<RTFValue>(m_aStates.top().aShape);
+                m_aStates.top().pCurrentBuffer->push_back(Buf_t(BUFFER_RESOLVESHAPE, pValue, nullptr));
+            }
         }
         else if (aState.bInShapeGroup && !aState.bInShape)
         {

writerfilter/source/rtftok/rtfdocumentimpl.hxx

@@ -44,7 +44,7 @@ enum class RTFBorderState
     CHARACTER
 };
 
-/// Minimalistic buffer of elements for nested cells.
+/// Different kind of buffers for table cell contents.
 enum RTFBufferTypes
 {
     BUFFER_PROPS,
@@ -56,6 +56,8 @@ enum RTFBufferTypes
     BUFFER_ENDRUN,
     BUFFER_PAR,
     BUFFER_STARTSHAPE,
+    /// Imports a shape.
+    BUFFER_RESOLVESHAPE,
     BUFFER_ENDSHAPE,
     BUFFER_RESOLVESUBSTREAM
 };