summaryrefslogtreecommitdiff
path: root/sc/source/core/data
diff options
context:
space:
mode:
authorEike Rathke <erack@redhat.com>2014-12-09 03:00:47 +0100
committerEike Rathke <erack@redhat.com>2014-12-09 04:13:06 +0100
commit8cb37cc090f754c4dafe5731c827539f01743671 (patch)
treea3b36b7cf90719703653610e3111218565d6b788 /sc/source/core/data
parenta1571dcad2e656d5a5d9184ca138e58c0b73e182 (diff)
in ScFormulaCell dtor remove cell also from FormulaTrack
It could happen that during a SetDirty/Notify cycle a formula cell is appended to the formula track but not tracked yet so doesn't end up in the formula tree. If it was deleted then without removing it from the track the cell pointer shortly after was moved into the tree, possibly setting pFormulaTree (and/or pEOFormulaTree) to that cell if it was the last cell, and if immediately after that a new ScFormulaCell was allocated at exactly the same memory location it virtually ended up as a successor of itself in the formula tree ... leading to a crash if pCode was accessed in a subsequent RemoveFromFormulaTree because the cell was assumed to be already in the tree. Change-Id: I9d1885a26b85c2331a084b5f89a2d7373cf2df0f (cherry picked from commit 1e9aa174865cc65b132a8b3e728b8a5adbcd8b90)
Diffstat (limited to 'sc/source/core/data')
-rw-r--r--sc/source/core/data/formulacell.cxx1
1 files changed, 1 insertions, 0 deletions
diff --git a/sc/source/core/data/formulacell.cxx b/sc/source/core/data/formulacell.cxx
index 65c21e40951b..b4e56b2807a1 100644
--- a/sc/source/core/data/formulacell.cxx
+++ b/sc/source/core/data/formulacell.cxx
@@ -889,6 +889,7 @@ ScFormulaCell::ScFormulaCell( const ScFormulaCell& rCell, ScDocument& rDoc, cons
ScFormulaCell::~ScFormulaCell()
{
+ pDocument->RemoveFromFormulaTrack( this );
pDocument->RemoveFromFormulaTree( this );
pDocument->RemoveSubTotalCell(this);
if (pCode->HasOpCode(ocMacro))