check bounds in RPN tokens, tdf#90694 related and others

Listeners are set up from references in RPN, so check those for bounds
to catch also references resulting from named expressions, database
ranges, tables, ... and references in the token code array that are not
referenced in RPN.

Change-Id: I54770b45818f4c0541a39815278d3271a77b345d
(cherry picked from commit 4baf76dd)

sc/source/core/tool/token.cxx

@@ -114,6 +114,30 @@ namespace
         rRef.SetAbsTab(0);
     }
 
+    struct TokenPointerRange
+    {
+        FormulaToken**  mpStart;
+        FormulaToken**  mpStop;
+
+        TokenPointerRange( FormulaToken** p, sal_uInt16 n ) :
+            mpStart(p), mpStop( p + static_cast<size_t>(n)) {}
+    };
+    struct TokenPointers
+    {
+        TokenPointerRange maPointerRange[2];
+
+        TokenPointers( FormulaToken** pCode, sal_uInt16 nLen, FormulaToken** pRPN, sal_uInt16 nRPN ) :
+            maPointerRange{ TokenPointerRange( pCode, nLen), TokenPointerRange( pRPN, nRPN)} {}
+
+        static bool skipToken( size_t i, const FormulaToken* const * pp )
+        {
+            // Handle all tokens in RPN, and code tokens only if they have a
+            // reference count of 1, which means they are not referenced in
+            // RPN.
+            return i == 0 && (*pp)->GetRef() > 1;
+        }
+    };
+
 } // namespace
 
 // Align MemPools on 4k boundaries - 64 bytes (4k is a MUST for OS/2)
@@ -3850,10 +3874,16 @@ void checkBounds(
 void ScTokenArray::CheckRelativeReferenceBounds(
     const sc::RefUpdateContext& rCxt, const ScAddress& rPos, SCROW nGroupLen, std::vector<SCROW>& rBounds ) const
 {
-    FormulaToken** p = pCode;
-    FormulaToken** pEnd = p + static_cast<size_t>(nLen);
+    TokenPointers aPtrs( pCode, nLen, pRPN, nRPN);
+    for (size_t j=0; j<2; ++j)
+    {
+        FormulaToken** p = aPtrs.maPointerRange[j].mpStart;
+        FormulaToken** pEnd = aPtrs.maPointerRange[j].mpStop;
         for (; p != pEnd; ++p)
         {
+            if (TokenPointers::skipToken(j,p))
+                continue;
+
             switch ((*p)->GetType())
             {
                 case svSingleRef:
@@ -3874,15 +3904,22 @@ void ScTokenArray::CheckRelativeReferenceBounds(
                     ;
             }
         }
+    }
 }
 
 void ScTokenArray::CheckRelativeReferenceBounds(
     const ScAddress& rPos, SCROW nGroupLen, const ScRange& rRange, std::vector<SCROW>& rBounds ) const
 {
-    FormulaToken** p = pCode;
-    FormulaToken** pEnd = p + static_cast<size_t>(nLen);
+    TokenPointers aPtrs( pCode, nLen, pRPN, nRPN);
+    for (size_t j=0; j<2; ++j)
+    {
+        FormulaToken** p = aPtrs.maPointerRange[j].mpStart;
+        FormulaToken** pEnd = aPtrs.maPointerRange[j].mpStop;
         for (; p != pEnd; ++p)
         {
+            if (TokenPointers::skipToken(j,p))
+                continue;
+
             switch ((*p)->GetType())
             {
                 case svSingleRef:
@@ -3904,16 +3941,23 @@ void ScTokenArray::CheckRelativeReferenceBounds(
                     ;
             }
         }
+    }
 }
 
 void ScTokenArray::CheckExpandReferenceBounds(
     const sc::RefUpdateContext& rCxt, const ScAddress& rPos, SCROW nGroupLen, std::vector<SCROW>& rBounds ) const
 {
     const SCROW nInsRow = rCxt.maRange.aStart.Row();
-    const FormulaToken* const * p = pCode;
-    const FormulaToken* const * pEnd = p + static_cast<size_t>(nLen);
+    TokenPointers aPtrs( pCode, nLen, pRPN, nRPN);
+    for (size_t j=0; j<2; ++j)
+    {
+        const FormulaToken* const * p = aPtrs.maPointerRange[j].mpStart;
+        const FormulaToken* const * pEnd = aPtrs.maPointerRange[j].mpStop;
         for (; p != pEnd; ++p)
         {
+            if (TokenPointers::skipToken(j,p))
+                continue;
+
             switch ((*p)->GetType())
             {
                 case svDoubleRef:
@@ -3997,6 +4041,7 @@ void ScTokenArray::CheckExpandReferenceBounds(
                     ;
             }
         }
+    }
 }
 
 namespace {