commit 4f7e8f0d819383a6953ccbb53f704d2265577a2f
author Eike Rathke <erack@redhat.com> Mon Feb 27 23:14:01 2023 +0100
committer Eike Rathke <erack@redhat.com> Mon Feb 27 23:18:16 2023 +0000
tree 708b198060f548d1217aa33134e7603a27799294
parent 1db24b1798b80062a1d06104828d1ec6f32ae8ec

Underflow assert also in already calculated path

Change-Id: I7bd1c4960280a6526bb82e5b95c5253775df1e1a
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147937
Reviewed-by: Eike Rathke <erack@redhat.com>
Tested-by: Jenkins

sc/source/core/tool/interpr4.cxx

diff --git a/sc/source/core/tool/interpr4.cxx b/sc/source/core/tool/interpr4.cxx
index e352f35..97c3d06 100644
--- a/sc/source/core/tool/interpr4.cxx
+++ b/sc/source/core/tool/interpr4.cxx
@@ -4007,9 +4007,20 @@ StackVar ScInterpreter::Interpret()
                (*aTokenMatrixMapIter).second->GetType() != svJumpMatrix)
        {
            // Path already calculated, reuse result.
            nStackBase = sp - pCur->GetParamCount();
            if ( nStackBase > sp )
                nStackBase = sp;        // underflow?!?
            if (sp >= pCur->GetParamCount())
                nStackBase = sp - pCur->GetParamCount();
            else
            {
                SAL_WARN("sc.core", "Stack anomaly with calculated path at "
                        << aPos.Tab() << "," << aPos.Col() << "," << aPos.Row()
                        << "  " << aPos.Format(
                            ScRefFlags::VALID | ScRefFlags::FORCE_DOC | ScRefFlags::TAB_3D, &mrDoc)
                        << "  eOp: " << static_cast<int>(eOp)
                        << "  params: " << static_cast<int>(pCur->GetParamCount())
                        << "  nStackBase: " << nStackBase << "  sp: " << sp);
                nStackBase = sp;
                assert(!"underflow");
            }
            sp = nStackBase;
            PushTokenRef( (*aTokenMatrixMapIter).second);
        }