PutMatrixValue cloned the referenced cell's formula result token for a
single, double or list reference, but a reference can point at an ordinary
value, string or empty cell, where ScDocument::GetFormulaCell returns null
and cloning its result token dereferences null. Read the plain cell value
into the matrix in that case.
crash finalizing an xlsx import (forum-mso-en4-792534.xlsx):
#0 ScFormulaCell::NeedsInterpret (this=0x0) at sc/inc/formulacell.hxx:487
#1 ScFormulaCell::MaybeInterpret (this=0x0) at sc/inc/formulacell.hxx:501
#2 ScFormulaCell::CloneResultToken (this=0x0) at sc/source/core/data/formulacell.cxx:3236
#3 ScInterpreter::PutMatrixValue at sc/source/core/tool/interpr5.cxx:1285
#4 ScInterpreter::ScByRow at sc/source/core/tool/interpr5.cxx:1521
#5 ScInterpreter::DispatchOpCode (eOp=ocByRow) at sc/source/core/tool/interpr4.cxx:4090
#6 ScInterpreter::Interpret at sc/source/core/tool/interpr4.cxx:4371
#11 ScCellFormat::GetString at sc/source/core/tool/cellform.cxx:90
#19 ScColumn::GetOptimalHeight at sc/source/core/data/column2.cxx:950
#24 ScDocShell::UpdateAllRowHeights at sc/source/ui/docshell/docsh5.cxx:450
#25 oox::xls::WorkbookGlobals::finalize at sc/source/filter/oox/workbookhelper.cxx:665
since:
commit e95c50471e6553f04ec814184456c50209a7e970
Date: Sat Jun 20 23:53:18 2026 -0400
Implemented functions which rely on callables
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Iadede9c4c75e9d1ee79fe2156d356389827595d6
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6151
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
(cherry picked from commit 0abe27b56512e1d524e23f1b759d9647cba85a87)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207975
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
Caolán McNamara
2cdb8ce0ac