[gnumeric] Arrays: fix crash on implicit array intersection.

[Morten Welinder <mortenw src gnome org>]

commit 307e79badc74d32852ddbf751e0e2558811657a5
Author: Morten Welinder <terra gnome org>
Date:   Fri Jun 26 07:42:23 2015 -0400

    Arrays: fix crash on implicit array intersection.
    
    value_area_foreach cannot be relied upon to visit every cell
    if the value is a relative cell range and sticks out over an
    edge of the sheet.

 ChangeLog   |    7 +++++++
 NEWS        |    1 +
 src/expr.c  |    3 ++-
 src/value.c |    2 +-
 4 files changed, 11 insertions(+), 2 deletions(-)
---
diff --git a/ChangeLog b/ChangeLog
index cc02fcc..21e6537 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2015-06-26  Morten Welinder  <terra gnome org>
+
+       * src/value.c (value_new_array_empty): Store value_new_empty(),
+       not NULL, in the slots.  We can make this change because
+       value_new_empty() is a singleton that does not need to be
+       released.  Fixes #751502.
+
 2015-06-24  Jean Brefort  <jean brefort normalesup org>
 
        * src/sheet-object-graph.c (dim_start): fix index test. [#751383]
diff --git a/NEWS b/NEWS
index 89ec6be..13005db 100644
--- a/NEWS
+++ b/NEWS
@@ -30,6 +30,7 @@ Morten:
          [#749424] [#749917] [#749919] [#750043] [#750044] [#750046]
          [#750811] [#750810] [#750857] [#750864] [#750862] [#750858]
          [#751126] [#751254] [#751253] [#750851] [#751258] [#751259]
+         [#751502]
        * Make solver check linearity of model.
        * Fix xls saving of marker style.  [#749185]
        * Make compilation with clang work again.  [#749138]
diff --git a/src/expr.c b/src/expr.c
index a470818..0a488ea 100644
--- a/src/expr.c
+++ b/src/expr.c
@@ -1080,7 +1080,7 @@ bin_array_iter_b (GnmEvalPos const *ep,
        iter_info.a = a;
        iter_info.b = b;
 
-       /* b must be a cellrange or array, it can not be NULL */
+       /* b must be a cellrange or array, it cannot be NULL */
        iter_info.res = value_new_array_empty (
                value_area_get_width  (b, ep),
                value_area_get_height (b, ep));
@@ -1597,6 +1597,7 @@ gnm_expr_eval (GnmExpr const *expr, GnmEvalPos const *pos,
                return gnm_expr_range_op (expr, pos, flags);
        }
 
+       g_assert_not_reached ();
        return value_new_error (pos, _("Unknown evaluation error"));
 }
 
diff --git a/src/value.c b/src/value.c
index 62e80a2..31ebd0e 100644
--- a/src/value.c
+++ b/src/value.c
@@ -452,7 +452,7 @@ value_new_array_empty (guint cols, guint rows)
        for (x = 0; x < cols; x++) {
                v->vals[x] = g_new (GnmValue *, rows);
                for (y = 0; y < rows; y++)
-                       v->vals[x][y] = NULL;
+                       v->vals[x][y] = value_new_empty ();
        }
        return (GnmValue *)v;
 }