From cd489d2a8b2e368c9aea31caf99b7ecdfdbf5d9e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
Date: Sun, 5 Jul 2026 14:32:45 +0000
Subject: [PATCH] crashtesting: leave a result on the stack after running a
 callable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Interpreting a callable consumes its arguments off the interpreter stack
and must leave exactly one result token behind.

Two paths returned without pushing anything: a lambda whose result was
empty, and a macro whose arguments could not be built.

Each such call left the stack one entry short, so a later token read
past the stack base. That surfaces later as the "underflow" abort in
Interpret, and as the matrix count mismatch in ConvertMatrixParameters.

Push the error, or an empty result, on those two paths.

crash converting forum-en-34250.ods to xlsx:

  #21 ScInterpreter::Interpret at sc/source/core/tool/interpr4.cxx:4328
  #22 ScFormulaCell::InterpretTail at sc/source/core/data/formulacell.cxx:2201
  #24 ScFormulaCell::GetMatrix at sc/source/core/data/formulacell.cxx:3267
  #25 ScInterpreter::ScMatRef at sc/source/core/tool/interpr5.cxx:3764
  #26 ScInterpreter::DispatchOpCode at sc/source/core/tool/interpr4.cxx:4050
  #27 ScInterpreter::Interpret at sc/source/core/tool/interpr4.cxx:4333
  #30 ScFormulaCell::MaybeInterpret at sc/inc/formulacell.hxx:515

the same problem also aborts in ScInterpreter::ConvertMatrixParameters
at sc/source/core/tool/interpr4.cxx:1555.

since:

commit 837cf12bc45c72e08c4629d07a43c27763b263b2
Date:   Sat Jun 20 23:28:17 2026 -0400

    Implemented callables as first-class objects in Calc formulas

Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I46a9fa77872ac1c540f9b0904da2e3f9397e71c9
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6153
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit f239eafadbb1c539d0c6dfbb459ca25bc10b7456)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207976
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
---
 sc/source/core/tool/interpr1.cxx | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sc/source/core/tool/interpr1.cxx b/sc/source/core/tool/interpr1.cxx
index 4cba0ca8e92e..7ad6bdcdb2d6 100644
--- a/sc/source/core/tool/interpr1.cxx
+++ b/sc/source/core/tool/interpr1.cxx
@@ -10872,6 +10872,10 @@ void ScInterpreter::ScCall( FormulaCallableRef pCallable, const std::vector<Form
         }
         else if (xLambdaResult)
             PushTokenRef(xLambdaResult);
+        else if (nGlobalError != FormulaError::NONE)
+            PushError(nGlobalError);
+        else
+            PushNoValue();
     }
     else if (eOpCode == ocMacro)
     {
@@ -11009,6 +11013,8 @@ void ScInterpreter::ScCall( FormulaCallableRef pCallable, const std::vector<Form
             else
                 PushString( refRes->GetOUString() );
         }
+        else
+            PushError(nGlobalError);      // the arguments could not be built
 
         // prevent cycles from leaking memory
         refArgs->Clear();