Blind fix for ubusan error

from https://ci.libreoffice.org/job/lo_ubsan/2189/

  [_RUN_____] Test::testCellBroadcaster
[...]
  ==24129==ERROR: AddressSanitizer: heap-use-after-free on address 0x61700006c470 at pc 0x2ab6e05145e4 bp 0x7ffecaa28d70 sp 0x7ffecaa28d68
  READ of size 8 at 0x61700006c470 thread T0
      #0 0x2ab6e05145e3 in sc::CellStoreEvent::element_block_released(mdds::mtv::base_element_block const*) /sc/source/core/data/mtvelements.cxx:47:13
      #1 0x2ab6de749427 in mdds::mtv::soa::multi_type_vector<mdds::mtv::custom_block_func3<mdds::mtv::default_element_block<52, svl::SharedString>, mdds::mtv::noncopyable_managed_element_block<53, EditTextObject>, mdds::mtv::noncopyable_managed_element_block<54, ScFormulaCell> >, sc::CellStoreTrait>::delete_element_block(unsigned long) /workdir/UnpackedTarball/mdds/include/mdds/multi_type_vector/soa/main_def.inl:403:17
      #2 0x2ab6de74921b in mdds::mtv::soa::multi_type_vector<mdds::mtv::custom_block_func3<mdds::mtv::default_element_block<52, svl::SharedString>, mdds::mtv::noncopyable_managed_element_block<53, EditTextObject>, mdds::mtv::noncopyable_managed_element_block<54, ScFormulaCell> >, sc::CellStoreTrait>::delete_element_blocks(unsigned long, unsigned long) /workdir/UnpackedTarball/mdds/include/mdds/multi_type_vector/soa/main_def.inl:412:9
      #3 0x2ab6de733225 in mdds::mtv::soa::multi_type_vector<mdds::mtv::custom_block_func3<mdds::mtv::default_element_block<52, svl::SharedString>, mdds::mtv::noncopyable_managed_element_block<53, EditTextObject>, mdds::mtv::noncopyable_managed_element_block<54, ScFormulaCell> >, sc::CellStoreTrait>::clear() /workdir/UnpackedTarball/mdds/include/mdds/multi_type_vector/soa/main_def.inl:1088:5
      #4 0x2ab6df024987 in ScColumn::FreeAll() /sc/source/core/data/column3.cxx:161:13
      #5 0x2ab6decff134 in ScColumn::~ScColumn() /sc/source/core/data/column.cxx:97:5
      #6 0x2ab6decf708a in o3tl::default_delete<ScColumn>::operator()(ScColumn*) /include/o3tl/deleter.hxx:55:38
      #7 0x2ab6decf5999 in std::unique_ptr<ScColumn, o3tl::default_delete<ScColumn> >::reset(ScColumn*) /home/tdf/lode/opt_private/gcc-7.3.0/lib/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/unique_ptr.h:376:4
      #8 0x2ab6decf4c8e in ScColContainer::Clear() /sc/source/core/data/colcontainer.cxx:42:21
      #9 0x2ab6decf4a84 in ScColContainer::~ScColContainer() /sc/source/core/data/colcontainer.cxx:33:5
      #10 0x2ab6e070e3c6 in ScTable::~ScTable() /sc/source/core/data/table1.cxx:344:1
      #11 0x2ab6df50abba in o3tl::default_delete<ScTable>::operator()(ScTable*) /include/o3tl/deleter.hxx:55:38
      #12 0x2ab6df4c3483 in std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >::~unique_ptr() /home/tdf/lode/opt_private/gcc-7.3.0/lib/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/unique_ptr.h:268:4
      #13 0x2ab6df4dc87c in void std::_Destroy<std::unique_ptr<ScTable, o3tl::default_delete<ScTable> > >(std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >*) /home/tdf/lode/opt_private/gcc-7.3.0/lib/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/stl_construct.h:98:19
      #14 0x2ab6df4dc7c6 in void std::_Destroy_aux<false>::__destroy<std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >*>(std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >*, std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >*) /home/tdf/lode/opt_private/gcc-7.3.0/lib/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/stl_construct.h:108:6
      #15 0x2ab6df4dc744 in void std::_Destroy<std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >*>(std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >*, std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >*) /home/tdf/lode/opt_private/gcc-7.3.0/lib/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/stl_construct.h:136:7
      #16 0x2ab6df4dc488 in void std::_Destroy<std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >*, std::unique_ptr<ScTable, o3tl::default_delete<ScTable> > >(std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >*, std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >*, std::allocator<std::unique_ptr<ScTable, o3tl::default_delete<ScTable> > >&) /home/tdf/lode/opt_private/gcc-7.3.0/lib/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/stl_construct.h:206:7
      #17 0x2ab6df50df73 in std::__cxx1998::vector<std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >, std::allocator<std::unique_ptr<ScTable, o3tl::default_delete<ScTable> > > >::_M_erase_at_end(std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >*) /home/tdf/lode/opt_private/gcc-7.3.0/lib/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/stl_vector.h:1513:2
      #18 0x2ab6df70f5b0 in std::__cxx1998::vector<std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >, std::allocator<std::unique_ptr<ScTable, o3tl::default_delete<ScTable> > > >::clear() /home/tdf/lode/opt_private/gcc-7.3.0/lib/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/stl_vector.h:1248:9
      #19 0x2ab6df70b5d4 in std::__debug::vector<std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >, std::allocator<std::unique_ptr<ScTable, o3tl::default_delete<ScTable> > > >::clear() /home/tdf/lode/opt_private/gcc-7.3.0/lib/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/debug/vector:699:9
      #20 0x2ab6df704cb2 in ScDocument::Clear(bool) /sc/source/core/data/documen9.cxx:506:12
      #21 0x2ab6df490652 in ScDocument::~ScDocument() /sc/source/core/data/documen2.cxx:363:5
      #22 0x2ab6e363315d in ScDocShell::~ScDocShell() /sc/source/ui/docshell/docsh.cxx:2925:1
      #23 0x2ab6e363333b in ScDocShell::~ScDocShell() /sc/source/ui/docshell/docsh.cxx:2894:1
      #24 0x2ab6e3633514 in ScDocShell::~ScDocShell() /sc/source/ui/docshell/docsh.cxx:2894:1
      #25 0x2ab6de4f105d in SvRefBase::ReleaseRef() /include/tools/ref.hxx:163:29
      #26 0x2ab6de4a6259 in tools::SvRef<ScDocShell>::clear() /include/tools/ref.hxx:64:22
      #27 0x2ab6de2b1aaa in Test::closeDocShell(tools::SvRef<ScDocShell>&) /sc/qa/unit/ucalc.cxx:365:18
      #28 0x2ab6de2b2102 in Test::tearDown() /sc/qa/unit/ucalc.cxx:380:5
      #29 0x2ab6de543787 in CppUnit::TestCaller<Test>::tearDown() /workdir/UnpackedTarball/cppunit/include/cppunit/TestCaller.h:185:15
      #30 0x2ab69335765a in CppUnit::TestCaseMethodFunctor::operator()() const /workdir/UnpackedTarball/cppunit/src/cppunit/TestCase.cpp:32:5
      #31 0x2ab6ae4f3957 in (anonymous namespace)::Protector::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) /test/source/vclbootstrapprotector.cxx:46:14
      #32 0x2ab693328cd7 in CppUnit::ProtectorChain::ProtectFunctor::operator()() const /workdir/UnpackedTarball/cppunit/src/cppunit/ProtectorChain.cpp:20:25
      #33 0x2ab6a2974ff7 in (anonymous namespace)::Prot::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) /unotest/source/cpp/unobootstrapprotector/unobootstrapprotector.cxx:78:12
      #34 0x2ab693328cd7 in CppUnit::ProtectorChain::ProtectFunctor::operator()() const /workdir/UnpackedTarball/cppunit/src/cppunit/ProtectorChain.cpp:20:25
      #35 0x2ab69f4479c2 in (anonymous namespace)::Prot::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) /unotest/source/cpp/unoexceptionprotector/unoexceptionprotector.cxx:62:16
      #36 0x2ab693328cd7 in CppUnit::ProtectorChain::ProtectFunctor::operator()() const /workdir/UnpackedTarball/cppunit/src/cppunit/ProtectorChain.cpp:20:25
      #37 0x2ab6932bfff4 in CppUnit::DefaultProtector::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) /workdir/UnpackedTarball/cppunit/src/cppunit/DefaultProtector.cpp:15:12
      #38 0x2ab693328cd7 in CppUnit::ProtectorChain::ProtectFunctor::operator()() const /workdir/UnpackedTarball/cppunit/src/cppunit/ProtectorChain.cpp:20:25
      #39 0x2ab69332272c in CppUnit::ProtectorChain::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) /workdir/UnpackedTarball/cppunit/src/cppunit/ProtectorChain.cpp:86:18
      #40 0x2ab6933c1b39 in CppUnit::TestResult::protect(CppUnit::Functor const&, CppUnit::Test*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /workdir/UnpackedTarball/cppunit/src/cppunit/TestResult.cpp:182:28
      #41 0x2ab693356092 in CppUnit::TestCase::run(CppUnit::TestResult*) /workdir/UnpackedTarball/cppunit/src/cppunit/TestCase.cpp:95:11
      #42 0x2ab693359af2 in CppUnit::TestComposite::doRunChildTests(CppUnit::TestResult*) /workdir/UnpackedTarball/cppunit/src/cppunit/TestComposite.cpp:64:30
      #43 0x2ab693358cea in CppUnit::TestComposite::run(CppUnit::TestResult*) /workdir/UnpackedTarball/cppunit/src/cppunit/TestComposite.cpp:23:3
      #44 0x2ab693359af2 in CppUnit::TestComposite::doRunChildTests(CppUnit::TestResult*) /workdir/UnpackedTarball/cppunit/src/cppunit/TestComposite.cpp:64:30
      #45 0x2ab693358cea in CppUnit::TestComposite::run(CppUnit::TestResult*) /workdir/UnpackedTarball/cppunit/src/cppunit/TestComposite.cpp:23:3
      #46 0x2ab6933ef6ce in CppUnit::TestRunner::WrappingSuite::run(CppUnit::TestResult*) /workdir/UnpackedTarball/cppunit/src/cppunit/TestRunner.cpp:47:27
      #47 0x2ab6933c059e in CppUnit::TestResult::runTest(CppUnit::Test*) /workdir/UnpackedTarball/cppunit/src/cppunit/TestResult.cpp:149:9
      #48 0x2ab6933f062b in CppUnit::TestRunner::run(CppUnit::TestResult&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /workdir/UnpackedTarball/cppunit/src/cppunit/TestRunner.cpp:96:14
      #49 0x4ff1d5 in (anonymous namespace)::ProtectedFixtureFunctor::run() const /sal/cppunittester/cppunittester.cxx:329:20
      #50 0x4fbbc5 in main2() /sal/cppunittester/cppunittester.cxx:478:16
      #51 0x4fa052 in sal_main() /sal/cppunittester/cppunittester.cxx:614:14
      #52 0x4f9e9e in main /sal/cppunittester/cppunittester.cxx:609:1
      #53 0x2ab69517d554 in __libc_start_main (/lib64/libc.so.6+0x22554)
      #54 0x425894 in _start (/workdir/LinkTarget/Executable/cppunittester+0x425894)

  0x61700006c470 is located 752 bytes inside of 768-byte region [0x61700006c180,0x61700006c480)
  freed by thread T0 here:
      #0 0x4f7548 in operator delete(void*, unsigned long) /home/tdf/lode/packages/llvm-llvmorg-9.0.1.src/compiler-rt/lib/asan/asan_new_delete.cc:172
      #1 0x2ab6decf709b in o3tl::default_delete<ScColumn>::operator()(ScColumn*) /include/o3tl/deleter.hxx:55:38
      #2 0x2ab6decf5999 in std::unique_ptr<ScColumn, o3tl::default_delete<ScColumn> >::reset(ScColumn*) /home/tdf/lode/opt_private/gcc-7.3.0/lib/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/unique_ptr.h:376:4
      #3 0x2ab6decf4c8e in ScColContainer::Clear() /sc/source/core/data/colcontainer.cxx:42:21
      #4 0x2ab6decf4a84 in ScColContainer::~ScColContainer() /sc/source/core/data/colcontainer.cxx:33:5
      #5 0x2ab6e070e3c6 in ScTable::~ScTable() /sc/source/core/data/table1.cxx:344:1
      #6 0x2ab6df50abba in o3tl::default_delete<ScTable>::operator()(ScTable*) /include/o3tl/deleter.hxx:55:38
      #7 0x2ab6df4c3483 in std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >::~unique_ptr() /home/tdf/lode/opt_private/gcc-7.3.0/lib/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/unique_ptr.h:268:4
      #8 0x2ab6df4dc87c in void std::_Destroy<std::unique_ptr<ScTable, o3tl::default_delete<ScTable> > >(std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >*) /home/tdf/lode/opt_private/gcc-7.3.0/lib/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/stl_construct.h:98:19
      #9 0x2ab6df4dc7c6 in void std::_Destroy_aux<false>::__destroy<std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >*>(std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >*, std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >*) /home/tdf/lode/opt_private/gcc-7.3.0/lib/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/stl_construct.h:108:6
      #10 0x2ab6df4dc744 in void std::_Destroy<std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >*>(std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >*, std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >*) /home/tdf/lode/opt_private/gcc-7.3.0/lib/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/stl_construct.h:136:7
      #11 0x2ab6df4dc488 in void std::_Destroy<std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >*, std::unique_ptr<ScTable, o3tl::default_delete<ScTable> > >(std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >*, std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >*, std::allocator<std::unique_ptr<ScTable, o3tl::default_delete<ScTable> > >&) /home/tdf/lode/opt_private/gcc-7.3.0/lib/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/stl_construct.h:206:7
      #12 0x2ab6df50df73 in std::__cxx1998::vector<std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >, std::allocator<std::unique_ptr<ScTable, o3tl::default_delete<ScTable> > > >::_M_erase_at_end(std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >*) /home/tdf/lode/opt_private/gcc-7.3.0/lib/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/stl_vector.h:1513:2
      #13 0x2ab6df70f5b0 in std::__cxx1998::vector<std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >, std::allocator<std::unique_ptr<ScTable, o3tl::default_delete<ScTable> > > >::clear() /home/tdf/lode/opt_private/gcc-7.3.0/lib/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/stl_vector.h:1248:9
      #14 0x2ab6df70b5d4 in std::__debug::vector<std::unique_ptr<ScTable, o3tl::default_delete<ScTable> >, std::allocator<std::unique_ptr<ScTable, o3tl::default_delete<ScTable> > > >::clear() /home/tdf/lode/opt_private/gcc-7.3.0/lib/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/debug/vector:699:9
      #15 0x2ab6df704cb2 in ScDocument::Clear(bool) /sc/source/core/data/documen9.cxx:506:12
      #16 0x2ab6df490652 in ScDocument::~ScDocument() /sc/source/core/data/documen2.cxx:363:5
      #17 0x2ab6e363315d in ScDocShell::~ScDocShell() /sc/source/ui/docshell/docsh.cxx:2925:1
      #18 0x2ab6e363333b in ScDocShell::~ScDocShell() /sc/source/ui/docshell/docsh.cxx:2894:1
      #19 0x2ab6e3633514 in ScDocShell::~ScDocShell() /sc/source/ui/docshell/docsh.cxx:2894:1
      #20 0x2ab6de4f105d in SvRefBase::ReleaseRef() /include/tools/ref.hxx:163:29
      #21 0x2ab6de4a6259 in tools::SvRef<ScDocShell>::clear() /include/tools/ref.hxx:64:22
      #22 0x2ab6de2b1aaa in Test::closeDocShell(tools::SvRef<ScDocShell>&) /sc/qa/unit/ucalc.cxx:365:18
      #23 0x2ab6de2b2102 in Test::tearDown() /sc/qa/unit/ucalc.cxx:380:5
      #24 0x2ab6de543787 in CppUnit::TestCaller<Test>::tearDown() /workdir/UnpackedTarball/cppunit/include/cppunit/TestCaller.h:185:15
      #25 0x2ab69335765a in CppUnit::TestCaseMethodFunctor::operator()() const /workdir/UnpackedTarball/cppunit/src/cppunit/TestCase.cpp:32:5
      #26 0x2ab6ae4f3957 in (anonymous namespace)::Protector::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) /test/source/vclbootstrapprotector.cxx:46:14
      #27 0x2ab693328cd7 in CppUnit::ProtectorChain::ProtectFunctor::operator()() const /workdir/UnpackedTarball/cppunit/src/cppunit/ProtectorChain.cpp:20:25
      #28 0x2ab6a2974ff7 in (anonymous namespace)::Prot::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) /unotest/source/cpp/unobootstrapprotector/unobootstrapprotector.cxx:78:12
      #29 0x2ab693328cd7 in CppUnit::ProtectorChain::ProtectFunctor::operator()() const /workdir/UnpackedTarball/cppunit/src/cppunit/ProtectorChain.cpp:20:25

during CppunitTest_sc_ucalc

Change-Id: I778984beb9d1e355d3b8f9617b193424f332a32e
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/124709
Tested-by: Jenkins
Reviewed-by: Kohei Yoshida <kohei@libreoffice.org>

5 files changed, 11 insertions, 4 deletions

diff --git a/sc/inc/column.hxx b/sc/inc/column.hxx
index 6300fe70bca1..4c08e7b41479 100644
--- a/sc/inc/column.hxx
+++ b/sc/inc/column.hxx
@@ -123,8 +123,6 @@ class ScColumn
     // Broadcasters for formula cells.
     sc::BroadcasterStoreType maBroadcasters;
 
-    sc::CellStoreEvent maCellsEvent;
-
     // Cell values.
     sc::CellStoreType maCells;
 
diff --git a/sc/inc/mtvelements.hxx b/sc/inc/mtvelements.hxx
index 636706e0c234..05a0970bd64d 100644
--- a/sc/inc/mtvelements.hxx
+++ b/sc/inc/mtvelements.hxx
@@ -95,6 +95,9 @@ public:
 
     void element_block_acquired(const mdds::mtv::base_element_block* block);
     void element_block_released(const mdds::mtv::base_element_block* block);
+
+    /** Stop processing events. */
+    void stop();
 };
 
 struct CellStoreTrait
diff --git a/sc/source/core/data/column.cxx b/sc/source/core/data/column.cxx
index 4bd91f60f3a0..3b148dda6b88 100644
--- a/sc/source/core/data/column.cxx
+++ b/sc/source/core/data/column.cxx
@@ -82,8 +82,7 @@ ScColumn::ScColumn(ScSheetLimits const & rSheetLimits) :
     maCellTextAttrs(rSheetLimits.GetMaxRowCount()),
     maCellNotes(rSheetLimits.GetMaxRowCount()),
     maBroadcasters(rSheetLimits.GetMaxRowCount()),
-    maCellsEvent(this),
-    maCells(maCellsEvent),
+    maCells(sc::CellStoreEvent(this)),
     mnBlkCountFormula(0),
     nCol( 0 ),
     nTab( 0 ),
diff --git a/sc/source/core/data/column3.cxx b/sc/source/core/data/column3.cxx
index 9bbd9c1bca77..4a062a476a32 100644
--- a/sc/source/core/data/column3.cxx
+++ b/sc/source/core/data/column3.cxx
@@ -156,6 +156,8 @@ void ScColumn::Delete( SCROW nRow )
 
 void ScColumn::FreeAll()
 {
+    maCells.event_handler().stop();
+
     auto maxRowCount = GetDoc().GetSheetLimits().GetMaxRowCount();
     // Keep a logical empty range of 0-rDoc.MaxRow() at all times.
     maCells.clear();
diff --git a/sc/source/core/data/mtvelements.cxx b/sc/source/core/data/mtvelements.cxx
index c7d7e52bfccf..ee6c9cf1499c 100644
--- a/sc/source/core/data/mtvelements.cxx
+++ b/sc/source/core/data/mtvelements.cxx
@@ -51,6 +51,11 @@ void CellStoreEvent::element_block_released(const mdds::mtv::base_element_block*
     }
 }
 
+void CellStoreEvent::stop()
+{
+    mpCol = nullptr;
+}
+
 ColumnBlockPositionSet::ColumnBlockPositionSet(ScDocument& rDoc) : mrDoc(rDoc) {}
 
 ColumnBlockPosition* ColumnBlockPositionSet::getBlockPosition(SCTAB nTab, SCCOL nCol)