i#74153 RTF import: fix track changes vs superscript char prop

Since 9dbf817f (handle scope of
w:pPrChange and w:rPrChange properly (bnc#821804), 2014-10-01), this
caused an assertion failure -> crash.

Change-Id: I680edf58854d0c9be6e77c44c1e6beb1e0442a49

writerfilter/qa/cppunittests/rtftok/data/pass/i74153.rtf

+{\rtf1
+{\*\revtbl 
+{Unknown;}
+{TAMUS HSC Mac User;}
+}
+{\revised\super\revauth1\revdttm-1501115711 hello}
+\par
+}

writerfilter/source/rtftok/rtfdocumentimpl.cxx

@@ -5671,8 +5671,13 @@ int RTFDocumentImpl::popState()
         RTFSprms aTCSprms;
         RTFValue::Pointer_t pValue(new RTFValue(0));
         aTCSprms.set(NS_ooxml::LN_endtrackchange, pValue);
-        writerfilter::Reference<Properties>::Pointer_t const pProperties(new RTFReferenceProperties(RTFSprms(), aTCSprms));
-        Mapper().props(pProperties);
+        if (!m_aStates.top().pCurrentBuffer)
+        {
+            writerfilter::Reference<Properties>::Pointer_t const pProperties(new RTFReferenceProperties(RTFSprms(), aTCSprms));
+            Mapper().props(pProperties);
+        }
+        else
+            m_aStates.top().pCurrentBuffer->push_back(Buf_t(BUFFER_PROPS, RTFValue::Pointer_t(new RTFValue(RTFSprms(), aTCSprms))));
     }
 
     // This is the end of the doc, see if we need to close the last section.