fixed fdo#43614 Crash when closing document and several Spreadsheet documents open

During Paint() in ScMultiTextWnd::InitEditEngine(),
ScTabViewShell::GetActiveViewShell() may return a view shell that does not
correspond with the document to be repainted if another document was opened or
when switching between documents. Prevent creating an EditEngine with wrong
SfxItemPool.

2 files changed, 32 insertions, 3 deletions

diff --git a/sc/source/ui/app/inputwin.cxx b/sc/source/ui/app/inputwin.cxx
index a271487714eb..83bdb8a5c757 100644
--- a/sc/source/ui/app/inputwin.cxx
+++ b/sc/source/ui/app/inputwin.cxx
@@ -1094,11 +1094,19 @@ IMPL_LINK( ScInputBarGroup, Impl_ScrollHdl, ScrollBar*, EMPTYARG )
 //                      ScMultiTextWnd
 //========================================================================
 
-ScMultiTextWnd::ScMultiTextWnd( ScInputBarGroup* pParen ) : ScTextWnd( pParen/*, WB_TABSTOP*/ ), mrGroupBar(* pParen )
+ScMultiTextWnd::ScMultiTextWnd( ScInputBarGroup* pParen )
+    :
+        ScTextWnd( pParen/*, WB_TABSTOP*/ ),
+        mrGroupBar(* pParen ),
+        mpAssignedDocument( NULL ),
+        mnLines( 1 ),
+        mnLastExpandedLines( INPUTWIN_MULTILINES )
 {
     nTextStartPos = TEXT_MULTI_STARTPOS;
-    mnLines = 1;
-    mnLastExpandedLines = INPUTWIN_MULTILINES;
+}
+
+ScMultiTextWnd::~ScMultiTextWnd()
+{
 }
 
 int ScMultiTextWnd::GetLineCount()
@@ -1290,6 +1298,24 @@ void ScMultiTextWnd::InitEditEngine(SfxObjectShell* pObjSh)
     if ( pViewSh )
     {
         const ScDocument* pDoc = pViewSh->GetViewData()->GetDocument();
+
+        // fdo#43614 If called from Paint() because pEditEngine==0 it may be
+        // that StopEditEngine() was previously called when opening another
+        // document or switching documents, the Paint() wants to paint the
+        // previous document, but GetActiveViewShell() already returns the
+        // shell of the new document. In that case we'd create an EditEngine
+        // with the wrong item pool that later crashes when the corresponding
+        // document was closed and may lead to other sorts of trouble.
+
+        if (mpAssignedDocument)
+        {
+            if (mpAssignedDocument != pDoc)
+                return;     // Bail out, don't create and remember an
+                            // EditEngine without document pools for this case.
+        }
+        else
+            mpAssignedDocument = pDoc;  // stick with this document
+
         pNew = new ScFieldEditEngine( pDoc->GetEnginePool(), pDoc->GetEditPool() );
     }
     else
diff --git a/sc/source/ui/inc/inputwin.hxx b/sc/source/ui/inc/inputwin.hxx
index 7a1da054614c..c0f42349f339 100644
--- a/sc/source/ui/inc/inputwin.hxx
+++ b/sc/source/ui/inc/inputwin.hxx
@@ -46,6 +46,7 @@ class ScInputHandler;
 class ScAccessibleEditLineTextData;
 struct EENotify;
 class ScRangeList;
+class ScDocument;
 
 //========================================================================
 
@@ -172,6 +173,7 @@ class ScMultiTextWnd : public ScTextWnd
 {
 public:
     ScMultiTextWnd( ScInputBarGroup* pParent );
+    virtual ~ScMultiTextWnd();
     virtual void StartEditEngine();
     virtual void StopEditEngine( sal_Bool bAll );
     int GetLineCount();
@@ -194,6 +196,7 @@ protected:
 private:
     long GetPixelTextHeight();
     ScInputBarGroup& mrGroupBar;
+    const ScDocument* mpAssignedDocument;
     long mnLines;
     long mnLastExpandedLines;
 };