crashtesting: don't parallelize a conditional sum that grows its range

A three argument SUMIF or AVERAGEIF grows a small sum range to the shape of
the criteria range. It then reads cells that no reference token names.

The parallel-calc dependency scan only follows reference tokens, so it
misses those cells, and a worker hits one uninterpreted and trips the
group-calc assert.

Drop that form, like the nearby ocRange guard. The two argument form
sums the criteria range itself and stays parallel.

  sc/inc/formulacell.hxx:514: void ScFormulaCell::MaybeInterpret():
      Assertion `!rDocument.IsThreadedGroupCalcInProgress()' failed.

seen reloading forum-mso-en4-35616.xlsx saved as xls, M9 is
=IFERROR(SUMIF(B9:E33,B9,L9:L33)/SUM(L9:L33),0): the sum range grows from
L9:L33 to L9:O33 and reads the uninterpreted O9.

Only started asserting once the callables work landed, which doesn't touch
this path, so that seems to have uncovered an older gap.

maybe since:

    commit 837cf12bc45c72e08c4629d07a43c27763b263b2
    Date:   Sat Jun 20 23:28:17 2026 -0400

        Implemented callables as first-class objects in Calc formulas

Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I861c7f645a65cd0c7564ccb96bf040e401cd2f08
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6160
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Tomaž Vajngerl <tomaz.vajngerl@collabora.com>
(cherry picked from commit 04ad1ed4ba2c9a78ed260fc4e18249a40137db94)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207824
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>

sc/source/core/data/formulacell.cxx

@@ -5008,6 +5008,17 @@ struct ScDependantsCalculator
                 return false;
             }
 
+            if ((p->GetOpCode() == ocSumIf || p->GetOpCode() == ocAverageIf) && p->GetParamCount() >= 3)
+            {
+                // With a separate sum range these functions grow it to the criteria range's shape
+                // when it is smaller, and read cells beyond the sum range's own reference. Those
+                // extra cells are not named by any reference token, so examining the arguments alone
+                // does not capture the true range of dependencies. The two argument form sums the
+                // criteria range itself and stays a candidate for parallelizing.
+                SAL_WARN("sc.core.formulacell", "conditional sum range extension, dropping as candidate for parallelizing");
+                return false;
+            }
+
             switch (p->GetType())
             {
             case svSingleRef: