From aadef0360d416523db483755e08d268cc499240b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
Date: Mon, 4 Nov 2013 13:07:00 +0000
Subject: [PATCH] fdo#69971 formula dialog crash when Paint restores EditEngine
 listener

We need the EditEngine Modification handler of the inputbar that we are feeding
to be disabled while this dialog is open. Otherwise we end up in a situation
where...
a) this ScFormulaDlg changes the editengine
b) the modify callback gets called
c) which also modifies the editengine
d) on return from that modify handler the editengine attempts to use
   old node pointers which were replaced and removed by c

We turn it off in the ctor and back on in the dtor, but if calc has to repaint,
e.g. when switching to another window and back, then in ScMultiTextWnd::Paint a
new editengine will have been created via GetEditView with its default
Modification handler enabled. So ensure its off everytime we will access it via
InputReplaceSelection pScMod->InputEnterHandler();

I wonder if we should really be calling ScMultiTextWnd::GetEditView
(which creates an EditView if one does not already exist) in
ScMultiTextWnd::Paint or just check for pEditView directly, but that
then leading to the need for it to be explicitly created somewhere else.
As it stands in ScMultiTextWnd::Paint(...) the "if ( pView )" can never
be false.

Change-Id: I2f6df9ce0cc7ec59e8be33f4e67d91422796d251
(cherry picked from commit a9d85d62a889288b17899c8defc020da487d8b36)
Reviewed-on: https://gerrit.libreoffice.org/6566
Tested-by: Eike Rathke <erack@redhat.com>
Reviewed-by: Eike Rathke <erack@redhat.com>
---
 sc/source/ui/formdlg/formula.cxx | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/sc/source/ui/formdlg/formula.cxx b/sc/source/ui/formdlg/formula.cxx
index 522a277..80268da 100644
--- a/sc/source/ui/formdlg/formula.cxx
+++ b/sc/source/ui/formdlg/formula.cxx
@@ -606,6 +606,23 @@ formula::FormEditData* ScFormulaDlg::getFormEditData() const
 void ScFormulaDlg::setCurrentFormula(const String& _sReplacement)
 {
     ScModule* pScMod = SC_MOD();
+    {
+        //fdo#69971 We need the EditEngine Modification handler of the inputbar that we
+        //are feeding to be disabled while this dialog is open. Otherwise we end up in
+        //a situation where...
+        //a) this ScFormulaDlg changes the editengine
+        //b) the modify callback gets called
+        //c) which also modifies the editengine
+        //d) on return from that modify handler the editengine attempts to use
+        //   old node pointers which were replaced and removed by c
+        //
+        //We turn it off in the ctor and back on in the dtor, but if calc has
+        //to repaint, e.g. when switching to another window and back, then in
+        //ScMultiTextWnd::Paint a new editengine will have been created via
+        //GetEditView with its default Modification handler enabled. So ensure
+        //its off when we will access it via InputReplaceSelection
+        pScMod->InputEnterHandler();
+    }
     pScMod->InputReplaceSelection(_sReplacement);
 }
 void ScFormulaDlg::setSelection(xub_StrLen _nStart,xub_StrLen _nEnd)
-- 
1.8.3.1