Fix (unreported) broken logic in proxy to liboverride conversion.

Iterating over scene's objects while we modify those (through proxy to
override conversion code) is call for problems (use after free etc.).

Instead, all proxy objects need to be gathered first in a temporary
list, and processed all at once in a second loop.

1 files changed, 14 insertions, 8 deletions

diff --git a/source/blender/blenkernel/intern/lib_override.c b/source/blender/blenkernel/intern/lib_override.c
index 226b2ea636a..649e7dab5d1 100644
--- a/source/blender/blenkernel/intern/lib_override.c
+++ b/source/blender/blenkernel/intern/lib_override.c
@@ -1107,23 +1107,29 @@ static void lib_override_library_proxy_convert_do(Main *bmain,
 void BKE_lib_override_library_main_proxy_convert(Main *bmain, BlendFileReadReport *reports)
 {
   LISTBASE_FOREACH (Scene *, scene, &bmain->scenes) {
+    LinkNodePair proxy_objects = {NULL};
+
     FOREACH_SCENE_OBJECT_BEGIN (scene, object) {
-      if (object->proxy_group == NULL) {
-        continue;
+      if (object->proxy_group != NULL) {
+        BLI_linklist_append(&proxy_objects, object);
       }
-
-      lib_override_library_proxy_convert_do(bmain, scene, object, reports);
     }
     FOREACH_SCENE_OBJECT_END;
 
     FOREACH_SCENE_OBJECT_BEGIN (scene, object) {
-      if (object->proxy == NULL) {
-        continue;
+      if (object->proxy != NULL && object->proxy_group == NULL) {
+        BLI_linklist_append(&proxy_objects, object);
       }
-
-      lib_override_library_proxy_convert_do(bmain, scene, object, reports);
     }
     FOREACH_SCENE_OBJECT_END;
+
+    for (LinkNode *proxy_object_iter = proxy_objects.list; proxy_object_iter != NULL;
+         proxy_object_iter = proxy_object_iter->next) {
+      Object *proxy_object = proxy_object_iter->link;
+      lib_override_library_proxy_convert_do(bmain, scene, proxy_object, reports);
+    }
+
+    BLI_linklist_free(proxy_objects.list, NULL);
   }
 
   LISTBASE_FOREACH (Object *, object, &bmain->objects) {