tdf#153724: make sure to retrieve the variable value before checking the type

Commit 5760c94b8847164f9a7a181f031c7c86643944af tried to avoid all cases
which could set an error in SbiRuntime::PushForEach. To do that, it checked
the type of xObjVar before trying to get an object from it, which otherwise
could set an error.

But the type of the contained value can be not known until it is retrieved
(which can happen inside SbxValue::Get in a call to SbxValue::Broadcast with
SfxHintId::BasicDataWanted). This happens e.g. when the container passed to
'for each' is a call to some special function, like VBA's 'Selection'. Then
SbxValue::GetFullType would return SbxEMPTY prior to SbxValue::Get.

Let's make sure to call SbxValue::Get first (asking for a Variant, to avoid
errors on type mismatch), and only then, check the actual result data type.

Change-Id: Iaa697f38285505e50504ae09f9307fbd29e09a53
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147273
Tested-by: Jenkins
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>

1 files changed, 9 insertions, 1 deletions

diff --git a/basic/source/runtime/runtime.cxx b/basic/source/runtime/runtime.cxx
index b521e3e8b458..e6f4f7b68a6b 100644
--- a/basic/source/runtime/runtime.cxx
+++ b/basic/source/runtime/runtime.cxx
@@ -1146,7 +1146,15 @@ void SbiRuntime::PushForEach()
     pForStk = p;
 
     SbxVariableRef xObjVar = PopVar();
-    SbxBase* pObj = xObjVar && xObjVar->GetFullType() == SbxOBJECT ? xObjVar->GetObject() : nullptr;
+    SbxBase* pObj(nullptr);
+    if (xObjVar)
+    {
+        SbxValues v(SbxVARIANT);
+        // Here it may retrieve the value, and change the type from SbxEMPTY to SbxOBJECT
+        xObjVar->Get(v);
+        if (v.eType == SbxOBJECT)
+            pObj = v.pObj;
+    }
 
     if (SbxDimArray* pArray = dynamic_cast<SbxDimArray*>(pObj))
     {