diff options
| author | Eike Rathke <erack@redhat.com> | 2014-12-09 03:00:47 +0100 |
|---|---|---|
| committer | Tor Lillqvist <tml@collabora.com> | 2014-12-15 13:55:23 +0200 |
| commit | 85eb80bfa306bd40abc5a6e687503f58279e8ffe (patch) | |
| tree | 945fb050327bde352510890e5400f94d0b00034b | |
| parent | ff19297223451ce990e8e8442ba3d5087323bbd6 (diff) | |
in ScFormulaCell dtor remove cell also from FormulaTrack
It could happen that during a SetDirty/Notify cycle a formula cell is
appended to the formula track but not tracked yet so doesn't end up in
the formula tree. If it was deleted then without removing it from the
track the cell pointer shortly after was moved into the tree, possibly
setting pFormulaTree (and/or pEOFormulaTree) to that cell if it was the
last cell, and if immediately after that a new ScFormulaCell was
allocated at exactly the same memory location it virtually ended up as a
successor of itself in the formula tree ... leading to a crash if pCode
was accessed in a subsequent RemoveFromFormulaTree because the cell was
assumed to be already in the tree.
Change-Id: I9d1885a26b85c2331a084b5f89a2d7373cf2df0f
(cherry picked from commit 1e9aa174865cc65b132a8b3e728b8a5adbcd8b90)
Reviewed-on: https://gerrit.libreoffice.org/13386
Reviewed-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
Tested-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
| -rw-r--r-- | sc/source/core/data/formulacell.cxx | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/sc/source/core/data/formulacell.cxx b/sc/source/core/data/formulacell.cxx index 88ad904de641..db3ccb28a8b1 100644 --- a/sc/source/core/data/formulacell.cxx +++ b/sc/source/core/data/formulacell.cxx @@ -825,6 +825,7 @@ ScFormulaCell::ScFormulaCell( const ScFormulaCell& rCell, ScDocument& rDoc, cons ScFormulaCell::~ScFormulaCell() { + pDocument->RemoveFromFormulaTrack( this ); pDocument->RemoveFromFormulaTree( this ); pDocument->RemoveSubTotalCell(this); if (pCode->HasOpCode(ocMacro)) |