[gnumeric] Paste: fix crash with array formulas

[Morten Welinder <mortenw src gnome org>]

commit 3cfa9d2bab8406d8c416ebac52540b7cadd09cab
Author: Morten Welinder <terra gnome org>
Date:   Sun Dec 26 11:23:08 2021 -0500

    Paste: fix crash with array formulas

 ChangeLog          |  7 +++++++
 NEWS               |  1 +
 src/xml-sax-read.c | 28 ++++++++++++++--------------
 3 files changed, 22 insertions(+), 14 deletions(-)
---
diff --git a/ChangeLog b/ChangeLog
index 6d52ace88..1cfd27f50 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2021-12-26  Morten Welinder  <terra gnome org>
+
+       * src/xml-sax-read.c (xml_cell_set_array_expr): Take position as
+       argument; fix non-cell case.
+       (xml_sax_cell_content): Fix crash on inter-gnumeric array formula
+       paste.  [#606]
+
 2021-10-04  Morten Welinder  <terra gnome org>
 
        * src/dependent.c (link_unlink_funcall): Ignore excess arguments.
diff --git a/NEWS b/NEWS
index a37813a4e..bdafef691 100644
--- a/NEWS
+++ b/NEWS
@@ -11,6 +11,7 @@ Morten:
        * Add ILOG function.  [#591]
        * Fix MROUND.  [#604]
        * Take evasive action re g_memdup.
+       * Fix inter-gnumeric array formula paste crash.  [#606]
 
 --------------------------------------------------------------------------
 Gnumeric 1.12.50
diff --git a/src/xml-sax-read.c b/src/xml-sax-read.c
index 5190cc65a..22c34f890 100644
--- a/src/xml-sax-read.c
+++ b/src/xml-sax-read.c
@@ -2014,22 +2014,22 @@ xml_sax_cell (GsfXMLIn *xin, xmlChar const **attrs)
  */
 static void
 xml_cell_set_array_expr (XMLSaxParseState *state,
-                        GnmCell *cell, GnmCellCopy *cc, char const *text,
+                        GnmCell *cell, GnmCellCopy *cc, GnmParsePos *pp,
+                        char const *text,
                         int const cols, int const rows)
 {
-       GnmParsePos pp;
-       GnmExprTop const *texpr =
-               gnm_expr_parse_str (text,
-                                   parse_pos_init_cell (&pp, cell),
-                                   GNM_EXPR_PARSE_DEFAULT,
-                                   state->convs,
-                                   NULL);
+       GnmExprTop const *texpr;
        GnmRange r;
 
+       texpr = gnm_expr_parse_str (text, pp, GNM_EXPR_PARSE_DEFAULT,
+                                   state->convs,
+                                   NULL);
        g_return_if_fail (texpr != NULL);
 
        if (!cell) {
-               cc->texpr = texpr;
+               cc->texpr = gnm_expr_top_new_array_corner
+                       (cols, rows, gnm_expr_copy (texpr->expr));
+               gnm_expr_top_unref (texpr);
                return;
        }
 
@@ -2053,7 +2053,7 @@ xml_cell_set_array_expr (XMLSaxParseState *state,
  */
 static gboolean
 xml_not_used_old_array_spec (XMLSaxParseState *state,
-                            GnmCell *cell, GnmCellCopy *cc,
+                            GnmCell *cell, GnmCellCopy *cc, GnmParsePos *pp,
                             char const *content)
 {
        long rows, cols, row, col;
@@ -2083,7 +2083,7 @@ xml_not_used_old_array_spec (XMLSaxParseState *state,
 
        if (row == 0 && col == 0) {
                *expr_end = '\0';
-               xml_cell_set_array_expr (state, cell, cc,
+               xml_cell_set_array_expr (state, cell, cc, pp,
                                         content + 2, rows, cols);
        }
 
@@ -2166,9 +2166,9 @@ xml_sax_cell_content (GsfXMLIn *xin, G_GNUC_UNUSED GsfXMLBlob *blob)
        if (is_post_52_array && has_contents) {
                // Array formula
                g_return_if_fail (content[0] == '=');
-               xml_cell_set_array_expr (state, cell, cc, content + 1,
+               xml_cell_set_array_expr (state, cell, cc, &pos, content + 1,
                                         array_cols, array_rows);
-               texpr = cell->base.texpr;
+               texpr = cc ? cc->texpr : cell->base.texpr;
                if (texpr) gnm_expr_top_ref (texpr);
                goto store_shared;
        }
@@ -2176,7 +2176,7 @@ xml_sax_cell_content (GsfXMLIn *xin, G_GNUC_UNUSED GsfXMLBlob *blob)
        // ----------------------------------------
 
        if (has_contents && state->version < GNM_XML_V3 &&
-           !xml_not_used_old_array_spec (state, cell, cc, content)) {
+           !xml_not_used_old_array_spec (state, cell, cc, &pos, content)) {
                // Very old array syntax -- irrelevant
                goto done;
        }