diff options
| author | Eike Rathke <erack@redhat.com> | 2021-10-05 20:04:19 +0200 |
|---|---|---|
| committer | Eike Rathke <erack@redhat.com> | 2021-10-05 22:01:58 +0200 |
| commit | ce8a7278e1304f7aaa65bce34aeeda5e83b231f1 (patch) | |
| tree | 647ee7cc3312c0676000e02629dd3a6d7a1b35aa /sc/inc | |
| parent | 057968bbce406efe6564347329df45b7e0f823ce (diff) | |
Fix crash if conditional format triggers recursion with iterations enabled
Could occur if a conditional format is evaluated (for example if
row height is to be obtained) while a formula cell it references
is still running and iterations are enabled so the conditional
format's temporary formula cell is added to the iteration
recursion list but iterations are not triggered if there are no
circular references. In that case the temporary formula cell's
pointer remained in the recursion list and it's dangling instance
was accessed in the next round. Mark such formula cell as
free-flying and remove from recursion list if it was added.
Observed at
https://ask.libreoffice.org/t/lo-calc-crashes-when-calling-a-macro/68800
with the original attached file that now got replaced with another
version that doesn't have iterations enabled so wouldn't trigger
the bug (and apparently even doesn't if enabling iterations).
Change-Id: I23a023356f920b8413874cab14acdc8b25580052
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/123115
Reviewed-by: Eike Rathke <erack@redhat.com>
Tested-by: Jenkins
Diffstat (limited to 'sc/inc')
| -rw-r--r-- | sc/inc/formulacell.hxx | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/sc/inc/formulacell.hxx b/sc/inc/formulacell.hxx index 9ad2ba7b16f7..fd57bde39976 100644 --- a/sc/inc/formulacell.hxx +++ b/sc/inc/formulacell.hxx @@ -137,6 +137,7 @@ private: bool mbPostponedDirty : 1; // if cell needs to be set dirty later bool mbIsExtRef : 1; // has references in ScExternalRefManager; never cleared after set bool mbSeenInPath : 1; // For detecting cycle involving formula groups and singleton formulacells + bool mbFreeFlying : 1; // Cell is out of sheets interpreted, like in conditional format ScMatrixMode cMatrixFlag : 8; sal_uInt16 nSeenInIteration : 16; // Iteration cycle in which the cell was last encountered SvNumFormatType nFormatType : 16; @@ -222,6 +223,8 @@ public: ScFormulaCell(const ScFormulaCell& rCell, ScDocument& rDoc, const ScAddress& rPos, ScCloneFlags nCloneFlags = ScCloneFlags::Default); + void SetFreeFlying( bool b ) { mbFreeFlying = b; } + size_t GetHash() const; void GetFormula( OUString& rFormula, |