Revert "Revert "check bounds in RPN tokens, tdf#90694 related and others""

This reverts commit 3caa8c63.

Rather let's solve that instead of reverting..

sc/source/core/tool/token.cxx

@@ -114,6 +114,30 @@ namespace
         rRef.SetAbsTab(0);
     }
 
+    struct TokenPointerRange
+    {
+        FormulaToken**  mpStart;
+        FormulaToken**  mpStop;
+
+        TokenPointerRange( FormulaToken** p, sal_uInt16 n ) :
+            mpStart(p), mpStop( p + static_cast<size_t>(n)) {}
+    };
+    struct TokenPointers
+    {
+        TokenPointerRange maPointerRange[2];
+
+        TokenPointers( FormulaToken** pCode, sal_uInt16 nLen, FormulaToken** pRPN, sal_uInt16 nRPN ) :
+            maPointerRange{ TokenPointerRange( pCode, nLen), TokenPointerRange( pRPN, nRPN)} {}
+
+        static bool skipToken( size_t i, const FormulaToken* const * pp )
+        {
+            // Handle all tokens in RPN, and code tokens only if they have a
+            // reference count of 1, which means they are not referenced in
+            // RPN.
+            return i == 0 && (*pp)->GetRef() > 1;
+        }
+    };
+
 } // namespace
 
 // Align MemPools on 4k boundaries - 64 bytes (4k is a MUST for OS/2)
@@ -3850,10 +3874,16 @@ void checkBounds(
 void ScTokenArray::CheckRelativeReferenceBounds(
     const sc::RefUpdateContext& rCxt, const ScAddress& rPos, SCROW nGroupLen, std::vector<SCROW>& rBounds ) const
 {
-    FormulaToken** p = pCode;
-    FormulaToken** pEnd = p + static_cast<size_t>(nLen);
+    TokenPointers aPtrs( pCode, nLen, pRPN, nRPN);
+    for (size_t j=0; j<2; ++j)
+    {
+        FormulaToken** p = aPtrs.maPointerRange[j].mpStart;
+        FormulaToken** pEnd = aPtrs.maPointerRange[j].mpStop;
         for (; p != pEnd; ++p)
         {
+            if (TokenPointers::skipToken(j,p))
+                continue;
+
             switch ((*p)->GetType())
             {
                 case svSingleRef:
@@ -3874,15 +3904,22 @@ void ScTokenArray::CheckRelativeReferenceBounds(
                     ;
             }
         }
+    }
 }
 
 void ScTokenArray::CheckRelativeReferenceBounds(
     const ScAddress& rPos, SCROW nGroupLen, const ScRange& rRange, std::vector<SCROW>& rBounds ) const
 {
-    FormulaToken** p = pCode;
-    FormulaToken** pEnd = p + static_cast<size_t>(nLen);
+    TokenPointers aPtrs( pCode, nLen, pRPN, nRPN);
+    for (size_t j=0; j<2; ++j)
+    {
+        FormulaToken** p = aPtrs.maPointerRange[j].mpStart;
+        FormulaToken** pEnd = aPtrs.maPointerRange[j].mpStop;
         for (; p != pEnd; ++p)
         {
+            if (TokenPointers::skipToken(j,p))
+                continue;
+
             switch ((*p)->GetType())
             {
                 case svSingleRef:
@@ -3904,16 +3941,23 @@ void ScTokenArray::CheckRelativeReferenceBounds(
                     ;
             }
         }
+    }
 }
 
 void ScTokenArray::CheckExpandReferenceBounds(
     const sc::RefUpdateContext& rCxt, const ScAddress& rPos, SCROW nGroupLen, std::vector<SCROW>& rBounds ) const
 {
     const SCROW nInsRow = rCxt.maRange.aStart.Row();
-    const FormulaToken* const * p = pCode;
-    const FormulaToken* const * pEnd = p + static_cast<size_t>(nLen);
+    TokenPointers aPtrs( pCode, nLen, pRPN, nRPN);
+    for (size_t j=0; j<2; ++j)
+    {
+        const FormulaToken* const * p = aPtrs.maPointerRange[j].mpStart;
+        const FormulaToken* const * pEnd = aPtrs.maPointerRange[j].mpStop;
         for (; p != pEnd; ++p)
         {
+            if (TokenPointers::skipToken(j,p))
+                continue;
+
             switch ((*p)->GetType())
             {
                 case svDoubleRef:
@@ -3997,6 +4041,7 @@ void ScTokenArray::CheckExpandReferenceBounds(
                     ;
             }
         }
+    }
 }
 
 namespace {