[Libreoffice-commits] core.git: Branch 'libreoffice-4-3' - sc/source

[Eike Rathke]

 sc/source/core/data/formulacell.cxx |    1 +
 1 file changed, 1 insertion(+)

New commits:
commit b95767d11f3fdc023e17fc9fd42ccbcd5f3938fa
Author: Eike Rathke <erack at redhat.com>
Date:   Tue Dec 9 03:00:47 2014 +0100

    in ScFormulaCell dtor remove cell also from FormulaTrack
    
    It could happen that during a SetDirty/Notify cycle a formula cell is
    appended to the formula track but not tracked yet so doesn't end up in
    the formula tree. If it was deleted then without removing it from the
    track the cell pointer shortly after was moved into the tree, possibly
    setting pFormulaTree (and/or pEOFormulaTree) to that cell if it was the
    last cell, and if immediately after that a new ScFormulaCell was
    allocated at exactly the same memory location it virtually ended up as a
    successor of itself in the formula tree ... leading to a crash if pCode
    was accessed in a subsequent RemoveFromFormulaTree because the cell was
    assumed to be already in the tree.
    
    Change-Id: I9d1885a26b85c2331a084b5f89a2d7373cf2df0f
    (cherry picked from commit 1e9aa174865cc65b132a8b3e728b8a5adbcd8b90)
    Reviewed-on: https://gerrit.libreoffice.org/13386
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    Tested-by: Markus Mohrhard <markus.mohrhard at googlemail.com>

diff --git a/sc/source/core/data/formulacell.cxx b/sc/source/core/data/formulacell.cxx
index 88ad904..db3ccb2 100644
--- a/sc/source/core/data/formulacell.cxx
+++ b/sc/source/core/data/formulacell.cxx
@@ -825,6 +825,7 @@ ScFormulaCell::ScFormulaCell( const ScFormulaCell& rCell, ScDocument& rDoc, cons
 
 ScFormulaCell::~ScFormulaCell()
 {
+    pDocument->RemoveFromFormulaTrack( this );
     pDocument->RemoveFromFormulaTree( this );
     pDocument->RemoveSubTotalCell(this);
     if (pCode->HasOpCode(ocMacro))