fix ScJumpMatrixToken memory handling

ScJumpMatrixToken unconditionally deletes the ScJumpMatrix pointer it
receives. But it's copy constructor also just copies that pointer,
meaning that we could end up freeing that pointer twice.

ScJumpMatrix has no copy constructor, so I just managed it via
shared_ptr.

Change-Id: I9cf13312afb4f2869fdc878e5f34060614e31842
Reviewed-on: https://gerrit.libreoffice.org/41728
Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk>
Tested-by: Noel Grandin <noel.grandin@collabora.co.uk>

1 files changed, 4 insertions, 5 deletions

diff --git a/sc/inc/token.hxx b/sc/inc/token.hxx
index 7e20b691d96b..9019ebf0ed89 100644
--- a/sc/inc/token.hxx
+++ b/sc/inc/token.hxx
@@ -20,6 +20,7 @@
 #ifndef INCLUDED_SC_INC_TOKEN_HXX
 #define INCLUDED_SC_INC_TOKEN_HXX
 
+#include <memory>
 #include <vector>
 #include <boost/intrusive_ptr.hpp>
 
@@ -247,12 +248,10 @@ private:
 class ScJumpMatrixToken : public formula::FormulaToken
 {
 private:
-            ScJumpMatrix*       pJumpMatrix;
+    std::shared_ptr<ScJumpMatrix> mpJumpMatrix;
 public:
-                                ScJumpMatrixToken( ScJumpMatrix* p ) :
-                                    FormulaToken( formula::svJumpMatrix ), pJumpMatrix( p ) {}
-                                ScJumpMatrixToken( const ScJumpMatrixToken& r ) :
-                                    FormulaToken( r ), pJumpMatrix( r.pJumpMatrix ) {}
+                                ScJumpMatrixToken( std::shared_ptr<ScJumpMatrix> p );
+                                ScJumpMatrixToken( const ScJumpMatrixToken & p );
     virtual                     ~ScJumpMatrixToken() override;
     virtual ScJumpMatrix*       GetJumpMatrix() const override;
     virtual bool                operator==( const formula::FormulaToken& rToken ) const override;