Fix T96289: Crash when accessing mesh via `ob.data` in a driver

Fix a crash when a driver variable targets an object and uses
`data.shape_keys.key["name"].value` in its expression.

The fix consists of adding an extra relation from the targeted object's
`GEOMETRY` component to the driver evaluation. This ensures that its
`data` pointer has been evaluated by the depsgraph and is safe to
follow.

This also resolves the concern raised on rB56407432a6aa.

Reviewed by: brecht

Differential Revision: https://developer.blender.org/D14956

1 files changed, 16 insertions, 0 deletions

diff --git a/source/blender/depsgraph/intern/builder/deg_builder_relations.cc b/source/blender/depsgraph/intern/builder/deg_builder_relations.cc
index 23147b63e27..5eccb5a4eb2 100644
--- a/source/blender/depsgraph/intern/builder/deg_builder_relations.cc
+++ b/source/blender/depsgraph/intern/builder/deg_builder_relations.cc
@@ -1693,6 +1693,22 @@ void DepsgraphRelationBuilder::build_driver_variables(ID *id, FCurve *fcu)
           continue;
         }
         add_relation(variable_exit_key, driver_key, "RNA Target -> Driver");
+
+        /* The RNA getter for `object.data` can write to the mesh datablock due
+         * to the call to `BKE_mesh_wrapper_ensure_subdivision()`. This relation
+         * ensures it is safe to call when the driver is evaluated.
+         *
+         * For the sake of making the code more generic/defensive, the relation
+         * is added for any geometry type.
+         *
+         * See T96289 for more info. */
+        if (object != nullptr && OB_TYPE_IS_GEOMETRY(object->type)) {
+          StringRef rna_path(dtar->rna_path);
+          if (rna_path == "data" || rna_path.startswith("data.")) {
+            ComponentKey ob_key(target_id, NodeType::GEOMETRY);
+            add_relation(ob_key, driver_key, "ID -> Driver");
+          }
+        }
       }
       else {
         /* If rna_path is nullptr, and DTAR_FLAG_STRUCT_REF isn't set, this