problem with a c++ construct in calc, fdo#54498

[Markus Mohrhard]

Hey guys,

I was debugging a calc crash for the last days that seems to be
related to ScRangeList::UpdateReference ([1]). As Kohei found out
removing

    // delete all entries that are fully deleted
    if( eUpdateRefMode == URM_INSDEL && (nDx < 0 || nDy < 0) )
    {
        vector<ScRange*>::iterator itr =
std::remove_if(maRanges.begin(), maRanges.end(), FindDeletedRange(nDx,
nDy));
        for_each(itr, maRanges.end(), ScDeleteObjectByPtr<ScRange>());
        maRanges.erase(itr, maRanges.end());
    }

from the method prevents this crash. At least according to my
understanding of c++ this piece of code is at least from a c++ POV
correct (from a calc POV it is wrong).

When I failed to find anything obviously wrong with this code I tried
to rewrite it with a simple own loop:

        for(size_t i = 0; i < maRanges.size();)
        {
            if(FindDeletedRange(nDx, nDy)(maRanges[i]))
            {
                ScRange* pRange = Remove(i);
                delete pRange;
            }
            else
                ++i;
        }

As soon as I did this the crash vanishs and memcheck seems to be
happy. So I concluded that there must be an error in my first version
but somehow we missed the point.

Does anyone have an explanation for this problem?

Regards,
Markus

[1] http://opengrok.libreoffice.org/xref/core/sc/source/core/tool/rangelst.cxx#398