Resolves: tdf#59222 Crash in Basic with an array of values...

from a range address

trying to make all SbxVariables reference count their parents
is ludiciously hard, so just reference count this one known
crashing case

Change-Id: Ie1fa6624e8184146dd00d766cdbacef674153ef6
Reviewed-on: https://gerrit.libreoffice.org/26272
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

2 files changed, 16 insertions, 1 deletions

diff --git a/basic/source/runtime/methods1.cxx b/basic/source/runtime/methods1.cxx
index 3a361038a344..6bddfd5c8570 100644
--- a/basic/source/runtime/methods1.cxx
+++ b/basic/source/runtime/methods1.cxx
@@ -830,7 +830,7 @@ RTLFUNC(Array)
     for( sal_uInt16 i = 0 ; i < nArraySize ; i++ )
     {
         SbxVariable* pVar = rPar.Get(i+1);
-        SbxVariable* pNew = new SbxVariable( *pVar );
+        SbxVariable* pNew = new SbxEnsureParentVariable(*pVar);
         pNew->SetFlag( SbxFlagBits::Write );
         short index = static_cast< short >(i);
         if ( bIncIndex )
diff --git a/basic/source/sbx/sbxvar.cxx b/basic/source/sbx/sbxvar.cxx
index 23d7bfe29ed3..0977c7449d02 100644
--- a/basic/source/sbx/sbxvar.cxx
+++ b/basic/source/sbx/sbxvar.cxx
@@ -100,6 +100,21 @@ SbxVariable::SbxVariable( const SbxVariable& r )
     }
 }
 
+SbxEnsureParentVariable::SbxEnsureParentVariable(const SbxVariable& r)
+    : SbxVariable(r)
+    , xParent(const_cast<SbxVariable&>(r).GetParent())
+{
+    assert(GetParent() == xParent.get());
+}
+
+void SbxEnsureParentVariable::SetParent(SbxObject* p)
+{
+    assert(GetParent() == xParent.get());
+    SbxVariable::SetParent(p);
+    xParent = SbxObjectRef(p);
+    assert(GetParent() == xParent.get());
+}
+
 SbxVariable::SbxVariable( SbxDataType t, void* p ) : SbxValue( t, p )
 {
     pCst = nullptr;