Fix T52092: Crash un-grouping nodes
authorCampbell Barton <ideasman42@gmail.com>
Wed, 19 Jul 2017 04:32:31 +0000 (14:32 +1000)
committerCampbell Barton <ideasman42@gmail.com>
Wed, 19 Jul 2017 04:32:31 +0000 (14:32 +1000)
source/blender/editors/space_node/node_group.c

index 914f8ffbe105d80a89fa1d71f41fe6676e758861..9d750bfe3483abcbb9cd7cdc6c8db1f2b8035d58 100644 (file)
@@ -37,6 +37,7 @@
 #include "DNA_anim_types.h"
 
 #include "BLI_listbase.h"
+#include "BLI_linklist.h"
 #include "BLI_math.h"
 
 #include "BLT_translation.h"
@@ -186,6 +187,7 @@ static int node_group_ungroup(bNodeTree *ntree, bNode *gnode)
        bNode *node, *nextnode;
        bNodeTree *ngroup, *wgroup;
        ListBase anim_basepaths = {NULL, NULL};
+       LinkNode *nodes_delayed_free = NULL;
        
        ngroup = (bNodeTree *)gnode->id;
        
@@ -208,8 +210,8 @@ static int node_group_ungroup(bNodeTree *ntree, bNode *gnode)
                 * This also removes remaining links to and from interface nodes.
                 */
                if (ELEM(node->type, NODE_GROUP_INPUT, NODE_GROUP_OUTPUT)) {
-                       nodeFreeNode(wgroup, node);
-                       continue;
+                       /* We must delay removal since sockets will reference this node. see: T52092 */
+                       BLI_linklist_prepend(&nodes_delayed_free, node);
                }
                
                /* keep track of this node's RNA "base" path (the part of the path identifying the node) 
@@ -336,6 +338,11 @@ static int node_group_ungroup(bNodeTree *ntree, bNode *gnode)
                }
        }
        
+       while (nodes_delayed_free) {
+               node = BLI_linklist_pop(&nodes_delayed_free);
+               nodeFreeNode(ntree, node);
+       }
+
        /* delete the group instance */
        nodeFreeNode(ntree, gnode);