Related: tdf#149325 Fix yet another VbaRange empty ScRangeList access

Change-Id: If2c44795ab794482b841138bdd55f37c4d30b592
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/135824
Reviewed-by: Eike Rathke <erack@redhat.com>
Tested-by: Jenkins
diff --git a/sc/source/ui/unoobj/cellsuno.cxx b/sc/source/ui/unoobj/cellsuno.cxx
index 529830d..b2117ce 100644
--- a/sc/source/ui/unoobj/cellsuno.cxx
+++ b/sc/source/ui/unoobj/cellsuno.cxx
@@ -6714,7 +6714,9 @@ uno::Reference<sheet::XSheetCellCursor> SAL_CALL ScTableSheetObj::createCursorBy
        if (pRangesImp)
        {
            const ScRangeList& rRanges = pRangesImp->GetRangeList();
            OSL_ENSURE( rRanges.size() == 1, "Range? Ranges?" );
            SAL_WARN_IF( rRanges.size() != 1, "sc", "ScTableSheetObj::createCursorByRange: Range? Ranges?");
            if (rRanges.empty())
                return nullptr;
            return new ScCellCursorObj( pDocSh, rRanges[ 0 ] );
        }
    }
diff --git a/sc/source/ui/vba/vbarange.cxx b/sc/source/ui/vba/vbarange.cxx
index d277d44..b98b547 100644
--- a/sc/source/ui/vba/vbarange.cxx
+++ b/sc/source/ui/vba/vbarange.cxx
@@ -1288,9 +1288,12 @@ uno::Reference< sheet::XSheetCellRange > lclExpandToMerged( const uno::Reference
    {
        aOldAddress = aNewAddress;
        uno::Reference< sheet::XSheetCellCursor > xCursor( xSheet->createCursorByRange( xNewCellRange ), uno::UNO_SET_THROW );
        xCursor->collapseToMergedArea();
        xNewCellRange.set( xCursor, uno::UNO_QUERY_THROW );
        aNewAddress = lclGetRangeAddress( xNewCellRange );
        if (xCursor.is())
        {
            xCursor->collapseToMergedArea();
            xNewCellRange.set( xCursor, uno::UNO_QUERY_THROW );
            aNewAddress = lclGetRangeAddress( xNewCellRange );
        }
    }
    while( bRecursive && (aOldAddress != aNewAddress) );
    return xNewCellRange;