fdo#69971 formula dialog crash when Paint restores EditEngine listener

We need the EditEngine Modification handler of the inputbar that we are feeding
to be disabled while this dialog is open. Otherwise we end up in a situation
where...
a) this ScFormulaDlg changes the editengine
b) the modify callback gets called
c) which also modifies the editengine
d) on return from that modify handler the editengine attempts to use
   old node pointers which were replaced and removed by c

We turn it off in the ctor and back on in the dtor, but if calc has to repaint,
e.g. when switching to another window and back, then in ScMultiTextWnd::Paint a
new editengine will have been created via GetEditView with its default
Modification handler enabled. So ensure its off everytime we will access it via
InputReplaceSelection pScMod->InputEnterHandler();

I wonder if we should really be calling ScMultiTextWnd::GetEditView
(which creates an EditView if one does not already exist) in
ScMultiTextWnd::Paint or just check for pEditView directly, but that
then leading to the need for it to be explicitly created somewhere else.
As it stands in ScMultiTextWnd::Paint(...) the "if ( pView )" can never
be false.

Change-Id: I2f6df9ce0cc7ec59e8be33f4e67d91422796d251
(cherry picked from commit a9d85d62a889288b17899c8defc020da487d8b36)
Reviewed-on: https://gerrit.libreoffice.org/6566
Tested-by: Eike Rathke <erack@redhat.com>
Reviewed-by: Eike Rathke <erack@redhat.com>

1 files changed, 17 insertions, 0 deletions

diff --git a/sc/source/ui/formdlg/formula.cxx b/sc/source/ui/formdlg/formula.cxx
index 522a277bf875..80268dae7a86 100644
--- a/sc/source/ui/formdlg/formula.cxx
+++ b/sc/source/ui/formdlg/formula.cxx
@@ -606,6 +606,23 @@ formula::FormEditData* ScFormulaDlg::getFormEditData() const
 void ScFormulaDlg::setCurrentFormula(const String& _sReplacement)
 {
     ScModule* pScMod = SC_MOD();
+    {
+        //fdo#69971 We need the EditEngine Modification handler of the inputbar that we
+        //are feeding to be disabled while this dialog is open. Otherwise we end up in
+        //a situation where...
+        //a) this ScFormulaDlg changes the editengine
+        //b) the modify callback gets called
+        //c) which also modifies the editengine
+        //d) on return from that modify handler the editengine attempts to use
+        //   old node pointers which were replaced and removed by c
+        //
+        //We turn it off in the ctor and back on in the dtor, but if calc has
+        //to repaint, e.g. when switching to another window and back, then in
+        //ScMultiTextWnd::Paint a new editengine will have been created via
+        //GetEditView with its default Modification handler enabled. So ensure
+        //its off when we will access it via InputReplaceSelection
+        pScMod->InputEnterHandler();
+    }
     pScMod->InputReplaceSelection(_sReplacement);
 }
 void ScFormulaDlg::setSelection(xub_StrLen _nStart,xub_StrLen _nEnd)