Resolves: #i125071# check SwFmt::GetItemState()'s ppItem parameter...

for NULL before assigning something into it. The ppItem default value is NULL
so it is allowed. The method should be prepared to handle that.

(cherry picked from commit 7d096ff2e25e422f55c821ecce99cecac6ee4b95)

Conflicts:
	sw/source/core/attr/format.cxx

Change-Id: I5b4bc84cf10f6f2955af21ae80a43e985f0555fb
(cherry picked from commit 6de99d2d046a4fefbd9c264b8b19e3283099ed81)
Related: fdo#80140 a11y crash on changing text via spellchecker in impress

i.e. with French dictionary available, open test case of fdo#80140, open
spell checking dialog and choose "correct" on the first example.

Every version of LibreOffice crashes on this, so its an old bug.

As can be seen from the following bt, if a11y is enabled then on calling
ImpEditEngine::ImpInsertText from ImpEditEngine::ImpDeleteSelection then
FormatDoc may be called and throw away all the old portions so the following
ParaPortion* pPortion = FindParaPortion(aStartPaM.GetNode()) will get the new
ParaPortion, not the old one, and so the MarkInvalid that uses the old
ParaPortion invalid range is not correct anymore.

Seeing as the only caller of ImpRemoveChars is ImpDeleteSelection and
ImpDeleteSelection calls TextModified after ImpRemoveChars and after the use of
MarkInvalid, it seems safe and logical to remove the TextModified from
ImpRemoveChars and rely on the ImpDeleteSelection TextModified.

 #0  TextPortion::TextPortion (this=0x30bd020, nL=5) at /home/caolan/LibreOffice/core/editeng/source/editeng/editdoc.hxx:401
 #1  0x00007fffd93f4d5a in ImpEditEngine::CreateTextPortions (this=0x3f42700, pParaPortion=0x3584930, rStart=@0x7fffffffa234: 0)
     at /home/caolan/LibreOffice/core/editeng/source/editeng/impedit3.cxx:2372
 #2  0x00007fffd93ed087 in ImpEditEngine::CreateLines (this=0x3f42700, nPara=0, nStartPosY=0)
     at /home/caolan/LibreOffice/core/editeng/source/editeng/impedit3.cxx:687
 #3  0x00007fffd93ebb3b in ImpEditEngine::FormatDoc (this=0x3f42700)
     at /home/caolan/LibreOffice/core/editeng/source/editeng/impedit3.cxx:394
 #4  0x00007fffd93fd239 in ImpEditEngine::FormatAndUpdate (this=0x3f42700, pCurView=0x0)
     at /home/caolan/LibreOffice/core/editeng/source/editeng/impedit3.cxx:4156
 #5  0x00007fffd937c3f4 in EditEngine::GetDocPosTopLeft (this=0x3f42690, nParagraph=0)
     at /home/caolan/LibreOffice/core/editeng/source/editeng/editeng.cxx:1920
 #6  0x00007fffd94d298a in Outliner::GetDocPosTopLeft (this=0x3f42390, nParagraph=0)
     at /home/caolan/LibreOffice/core/editeng/source/outliner/outlin2.cxx:429
 #7  0x00007fffd951c2d3 in SvxOutlinerForwarder::GetParaBounds (this=0x36015a0, nPara=0)
     at /home/caolan/LibreOffice/core/editeng/source/uno/unoforou.cxx:344
 #8  0x00007fffd950efe5 in SvxAccessibleTextAdapter::GetParaBounds (this=0x3394e88, nPara=0)
     at /home/caolan/LibreOffice/core/editeng/source/uno/unoedprx.cxx:798
 #9  0x00007fffd9aa25b5 in accessibility::AccessibleTextHelper_Impl::UpdateVisibleChildren (this=0x3394e00, bBroadcastEvents=true)
     at /home/caolan/LibreOffice/core/svx/source/accessibility/AccessibleTextHelper.cxx:851
 #10 0x00007fffd9aa38b3 in accessibility::AccessibleTextHelper_Impl::ProcessQueue (this=0x3394e00)
     at /home/caolan/LibreOffice/core/svx/source/accessibility/AccessibleTextHelper.cxx:1332
 #11 0x00007fffd9aa400c in accessibility::AccessibleTextHelper_Impl::Notify (this=0x3394e00, rHint=...)
     at /home/caolan/LibreOffice/core/svx/source/accessibility/AccessibleTextHelper.cxx:1482
 #12 0x00007ffff548c6ba in SfxBroadcaster::Broadcast (this=0x3394ac0, rHint=...)
     at /home/caolan/LibreOffice/core/svl/source/notify/brdcst.cxx:43
 #13 0x00007fffd895ce27 in SvxTextEditSourceImpl::NotifyHdl (this=0x3394a50, aNotify=0x7fffffffb4c0)
     at /home/caolan/LibreOffice/core/svx/source/unodraw/unoshtxt.cxx:1030
 #14 0x00007fffd895cd61 in SvxTextEditSourceImpl::LinkStubNotifyHdl (pThis=0x3394a50, pCaller=0x7fffffffb4c0)
     at /home/caolan/LibreOffice/core/svx/source/unodraw/unoshtxt.cxx:1023
 #15 0x00007fffd936252a in Link::Call (this=0x3f426a8, pCaller=0x7fffffffb4c0)
     at /home/caolan/LibreOffice/core/include/tools/link.hxx:123
 #16 0x00007fffd94db186 in Outliner::EditEngineNotifyHdl (this=0x3f42390, pNotify=0x7fffffffb4c0)
     at /home/caolan/LibreOffice/core/editeng/source/outliner/outliner.cxx:2041
 #17 0x00007fffd94db149 in Outliner::LinkStubEditEngineNotifyHdl (pThis=0x3f42390, pCaller=0x7fffffffb4c0)
     at /home/caolan/LibreOffice/core/editeng/source/outliner/outliner.cxx:2038
 #18 0x00007fffd936252a in Link::Call (this=0x7fffffffb490, pCaller=0x7fffffffb4c0)
     at /home/caolan/LibreOffice/core/include/tools/link.hxx:123
 #19 0x00007fffd93e0155 in ImpEditEngine::CallNotify (this=0x3f42700, rNotify=...)
     at /home/caolan/LibreOffice/core/editeng/source/editeng/impedit2.cxx:4339
 #20 0x00007fffd93cf462 in ImpEditEngine::TextModified (this=0x3f42700)
     at /home/caolan/LibreOffice/core/editeng/source/editeng/impedit2.cxx:707
 #21 0x00007fffd93d5a73 in ImpEditEngine::ImpRemoveChars (this=0x3f42700, rPaM=..., nChars=8, pCurUndo=0x0)
     at /home/caolan/LibreOffice/core/editeng/source/editeng/impedit2.cxx:2064
 #22 0x00007fffd93d77bd in ImpEditEngine::ImpDeleteSelection (this=0x3f42700, rCurSel=...)
     at /home/caolan/LibreOffice/core/editeng/source/editeng/impedit2.cxx:2424
 #23 0x00007fffd93d89f6 in ImpEditEngine::ImpInsertText (this=0x3f42700, aCurSel=..., rStr="Smoothie")
     at /home/caolan/LibreOffice/core/editeng/source/editeng/impedit2.cxx:2645
 #24 0x00007fffd94139f7 in ImpEditEngine::ApplyChangedSentence (this=0x3f42700, rEditView=...,
     rNewPortions=std::__debug::vector of length 2, capacity 2 = {...}, bRecheck=false)
     at /home/caolan/LibreOffice/core/editeng/source/editeng/impedit4.cxx:2172
 #25 0x00007fffd937d0f1 in EditEngine::ApplyChangedSentence (this=0x3f42690, rEditView=...,
     rNewPortions=std::__debug::vector of length 2, capacity 2 = {...}, bRecheck=false)

Change-Id: I6d0a96c8875858d8a25455f0dd1408f07e1f6e14
(cherry picked from commit ce61e7f9debfc7572ce4bb30d13e13aca79f010a)