From 5c894b9e0832c3c899d3116dd0fa9caa9214e7d5 Mon Sep 17 00:00:00 2001
Message-Id: <5c894b9e0832c3c899d3116dd0fa9caa9214e7d5.1434202005.git.erack@redhat.com>
From: Eike Rathke <erack@redhat.com>
Date: Sat, 13 Jun 2015 15:12:32 +0200
Subject: [PATCH] do not access token data after token has been destroyed
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="------------erAck-patch-parts"

This is a multi-part message in MIME format.
--------------erAck-patch-parts
Content-Type: text/plain; charset=UTF-8; format=fixed
Content-Transfer-Encoding: 8bit


Change-Id: I624e64745fd3874be3e1bd3df6bac18dfb17aebb
(cherry picked from commit c1fc84ac140d519e0bfa7a607e36771682b08eed)
---
 sc/source/core/tool/token.cxx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


--------------erAck-patch-parts
Content-Type: text/x-patch; name="0001-do-not-access-token-data-after-token-has-been-destro.patch"
Content-Transfer-Encoding: 8bit
Content-Disposition: attachment; filename="0001-do-not-access-token-data-after-token-has-been-destro.patch"

diff --git a/sc/source/core/tool/token.cxx b/sc/source/core/tool/token.cxx
index a83ba8e..c4d53c7 100644
--- a/sc/source/core/tool/token.cxx
+++ b/sc/source/core/tool/token.cxx
@@ -2377,9 +2377,9 @@ void ScTokenArray::ReadjustAbsolute3DReferences( const ScDocument* pOldDoc, cons
                     OUString aTabName;
                     sal_uInt16 nFileId;
                     GetExternalTableData(pOldDoc, pNewDoc, rRef1.Tab(), aTabName, nFileId);
-                    pCode[j]->DecRef();
                     ScExternalDoubleRefToken* pToken = new ScExternalDoubleRefToken(nFileId, aTabName, rRef);
                     pToken->IncRef();
+                    pCode[j]->DecRef(); // ATTENTION: rRef can't be used after this point
                     pCode[j] = pToken;
                 }
             }

--------------erAck-patch-parts--