[REVIEW 3-6] Fix for Calc crasher

Hi there,

I'd like the attached patch pushed to the 3-6 branch.

Without this patch, doing the following

1. Create a new Calc document.
2. Type some stuff into Cell D5.
3. Move the cursor to Cell C5.
4. Ctrl-+ to launch the Insert Cells dialog. Select Shift cell right and 
hit OK.
5. Ctrl-Z to undo.

Would crash Calc right away.

I'm actually surprised this has not been reported in bugzilla yet. Or 
perhaps it's there but never confirmed? I don't know which is the case. 
 I just happened to have noticed this while testing Calc for something 
else.

Kohei

--
Kohei Yoshida, LibreOffice hacker, Calc

From 7f576562cb94fba2690298bb16c0b85d1de41f21 Mon Sep 17 00:00:00 2001
From: Kohei Yoshida <kohei.yoshida@gmail.com>
Date: Thu, 1 Nov 2012 20:36:25 -0400
Subject: [PATCH] Remove the correct range, or else maItems would end up with
 invalid pointer.

nStopPos is non-inclusive, and STL's erase() method also expects a
non-inclusive end position (like any other STL methods do).  It's wrong
to -1 here which would end up not erasing the last element containing
a pointer to the deleted cell instance.

Change-Id: Ic09ab4a6bb03d0f56bb854a91bf93a99be867116
---
 sc/source/core/data/column.cxx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sc/source/core/data/column.cxx b/sc/source/core/data/column.cxx
index eebb17a..79bf31f 100644
--- a/sc/source/core/data/column.cxx
+++ b/sc/source/core/data/column.cxx
@@ -1555,7 +1555,7 @@ void ScColumn::MoveTo(SCROW nStartRow, SCROW nEndRow, ScColumn& rCol)
                     rAddress.SetRow( maItems[i].nRow );
                     pDocument->AreaBroadcast( aHint );
                 }
-                maItems.erase(maItems.begin() + nStartPos, maItems.begin() + nStopPos - 1);
+                maItems.erase(maItems.begin() + nStartPos, maItems.begin() + nStopPos);
             }
             pNoteCell->Delete();
         }
-- 
1.8.0