Fixing exception when filled expression produces out of bounds addresses

js/spreadsheet.js

@@ -343,6 +343,9 @@ class CellExpressionSet {
 
 			case CellExpressionOperation.Reference: {
 				const refAddress = expr.arguments[0];
+				if (refAddress === null) {
+					throw new CellEvaluationException(`Invalid cell address`, '#REF');
+				}
 				const cell = this.#grid.cellAt(refAddress);
 				if (cell === null) {
 					throw new CellEvaluationException(`No cell at ${refAddress.name}`, '#REF');
@@ -1470,7 +1473,7 @@ class CellExpression {
 		const exp = this.#tryExpression(tokens, start, end - 1, address);
 		const columnIndex = address.columnIndex;
 		exp.fillRanges = [
-			new CellAddressRange(new CellAddress(columnIndex, -1), new CellAddress(columnIndex, -1)),
+			new CellAddressRange(new CellAddress(columnIndex, address.rowIndex), new CellAddress(columnIndex, 999999)),
 		];
 		return exp;
 	}
@@ -1690,6 +1693,7 @@ class CellExpression {
 		if (!tokens[start].type.isPotentialAddress()) return null;
 		const ref = tokens[start].content.toUpperCase();
 		const refAddress = CellAddress.fromString(ref, address, true);
+		if (refAddress === null) return null;
 		return new CellExpression(CellExpressionOperation.Reference, [ refAddress ]);
 	}
 

jstest/spreadsheet/SpreadsheetMarkdownIntegrationTests.js

@@ -60,6 +60,17 @@ class SpreadsheetMarkdownIntegrationTests extends BaseTest {
 		this.assertEqual(expected, actual);
 	}
 
+	test_observedError2() {
+		// A FILLed difference formula in row 2 of `=B2-B1` threw an exception
+		// due to a transposed address to the row above of `=B1-B0`.
+		const markdown = `| TB | Price | $/TB | Incr |
+| --- | --- | --- | --- |
+| 2 | $99.99 | =B/A FILL | |
+| 4 | $186.41 | | =B2-B1 FILL |
+| 6 | $209.99 | | |`;
+		const actual = this.md(markdown);
+	}
+
 	test_styledValue() {
 		const markdown = "| A | B | C |\n| --- | --- | --- |\n| **3** | _4_ | =A*B |";
 		const expected = '<table><thead>' +

php/spreadsheet.php

@@ -302,6 +302,9 @@ class CellExpressionSet {
 
 			case CellExpressionOperation::Reference: {
 				$refAddress = $expr->arguments[0];
+				if ($refAddress === null) {
+					throw new CellEvaluationException("Invalid cell address", '#REF');
+				}
 				$cell = $this->grid->cellAt($refAddress);
 				if ($cell === null) {
 					throw new CellEvaluationException("No cell at {$refAddress->name}", '#REF');
@@ -1394,7 +1397,7 @@ class CellExpression {
 		$exp = self::tryExpression($tokens, $start, $end - 1, $address);
 		$columnIndex = $address->columnIndex;
 		$exp->fillRanges = [
-			new CellAddressRange(new CellAddress($columnIndex, -1), new CellAddress($columnIndex, -1)),
+			new CellAddressRange(new CellAddress($columnIndex, $address->rowIndex), new CellAddress($columnIndex, 999999)),
 		];
 		return $exp;
 	}
@@ -1624,6 +1627,7 @@ class CellExpression {
 		if (!$tokens[$start]->type->isPotentialAddress()) return null;
 		$ref = mb_strtoupper($tokens[$start]->content);
 		$refAddress = CellAddress::fromString($ref, $address, true);
+		if ($refAddress === null) return null;
 		return new CellExpression(CellExpressionOperation::Reference, [ $refAddress ]);
 	}
 

phptest/spreadsheet/SpreadsheetMarkdownIntegrationTests.php

@@ -74,6 +74,14 @@ final class SpreadsheetMarkdownIntegrationTests extends TestCase {
 		$this->assertSame($expected, $actual);
 	}
 
+	public function test_observedError2() {
+		// A FILLed difference formula in row 2 of `=B2-B1` threw an exception
+		// due to a transposed address to the row above of `=B1-B0`.
+		$markdown = "| TB | Price | $/TB | Incr |\n| --- | --- | --- | --- |\n| 2 | $99.99 | =B/A FILL | |\n| 4 | $186.41 | | =B2-B1 FILL |\n| 6 | $209.99 | | |";
+		$actual = $this->md($markdown);
+		$this->assertTrue(true);
+	}
+
 	public function test_styledValue() {
 		$markdown = "| A | B | C |\n| --- | --- | --- |\n| **3** | _4_ | =A*B |";
 		$expected = '<table><thead>' .