DocxAttributeOutput::WritePostponedDMLDrawing: allow recursion

This method calls DocxSdrExport::writeDMLDrawing(), which may call back
WriteTextBox(), which may call WritePostponedDMLDrawing() again.  The
result is that we try to flush drawings inside a shape which were
postponed outside of it.  Luckily, StartRunProperties() asserts this, so
instaed of silent corruption, such an attempt crashes.

Fix the crash by saving the postponed drawings on the stack, and
restoring them after the shape export finished.

CppunitTest_sw_ooxmlsdrexport's testAnchorIdForWP14AndW14 is a
reproducer for this problem (when shape with text is imported as shape
with textbox).

Change-Id: Id5aeda33472655697717401c24dd54e7efabacd9

sw/source/filter/ww8/docxattributeoutput.cxx

@@ -4330,8 +4330,14 @@ void DocxAttributeOutput::WritePostponedDMLDrawing()
     if(m_postponedDMLDrawing == NULL)
         return;
 
-    for( std::list< PostponedDrawing >::iterator it = m_postponedDMLDrawing->begin();
-         it != m_postponedDMLDrawing->end();
+    // Clear the list early, this method may be called recursively.
+    std::list<PostponedDrawing>* postponedDMLDrawing = m_postponedDMLDrawing;
+    m_postponedDMLDrawing = NULL;
+    std::list<PostponedOLE>* postponedOLE = m_postponedOLE;
+    m_postponedOLE = 0;
+
+    for( std::list< PostponedDrawing >::iterator it = postponedDMLDrawing->begin();
+         it != postponedDMLDrawing->end();
          ++it )
     {
         // Avoid w:drawing within another w:drawing.
@@ -4340,8 +4346,9 @@ void DocxAttributeOutput::WritePostponedDMLDrawing()
         else
             m_rExport.SdrExporter().writeDMLAndVMLDrawing(it->object, *(it->frame), *(it->point), m_anchorId++);
     }
-    delete m_postponedDMLDrawing;
-    m_postponedDMLDrawing = NULL;
+
+    delete postponedDMLDrawing;
+    m_postponedOLE = postponedOLE;
 }
 
 void DocxAttributeOutput::OutputFlyFrame_Impl( const sw::Frame &rFrame, const Point& rNdTopLeft )