Related: fdo#65090 Fix crash in SwXTextTableCursor::mergeRange()

Regression from b844f06b (fdo#48692: fix
problems with large number of table cells, 2012-09-21), the problem was
that GetSelectedBoxesCount() may return 0, and if that happens, the
prefix decrement operator set nCount to 0xffffffffffffffff, which then
resulted in a call to DeleteBox(), which did not happen before.

Thanks debug STL for pointing out this issue.

Change-Id: I9eee55f642726343c4ce9af479ccd2c4dde03b6a

sw/source/core/unocore/unotbl.cxx

@@ -1720,7 +1720,7 @@ sal_Bool SwXTextTableCursor::mergeRange(void) throw( uno::RuntimeException )
             if(bRet)
             {
                 size_t nCount = pTblCrsr->GetSelectedBoxesCount();
-                while (--nCount)
+                while (nCount--)
                 {
                     pTblCrsr->DeleteBox(nCount);
                 }