Fix: Crash on file read with active VR session

Add null check for runtime data since it could already have been
freed via wm_xr_exit() (called on file read) prior to the session
exit callback.

Also, fix potential memory leak by freeing session data in
wm_xr_runtime_data_free() instead of session exit callback.

3 files changed, 6 insertions, 2 deletions

diff --git a/source/blender/windowmanager/xr/intern/wm_xr.c b/source/blender/windowmanager/xr/intern/wm_xr.c
index cffe14a2146..4877addbb77 100644
--- a/source/blender/windowmanager/xr/intern/wm_xr.c
+++ b/source/blender/windowmanager/xr/intern/wm_xr.c
@@ -166,6 +166,7 @@ void wm_xr_runtime_data_free(wmXrRuntimeData **runtime)
      * first call, see comment above. */
     (*runtime)->context = NULL;
 
+    wm_xr_session_data_free(&(*runtime)->session_state);
     WM_xr_actionmaps_clear(*runtime);
 
     GHOST_XrContextDestroy(context);
diff --git a/source/blender/windowmanager/xr/intern/wm_xr_intern.h b/source/blender/windowmanager/xr/intern/wm_xr_intern.h
index 4d4df43f796..fc54e261f79 100644
--- a/source/blender/windowmanager/xr/intern/wm_xr_intern.h
+++ b/source/blender/windowmanager/xr/intern/wm_xr_intern.h
@@ -174,6 +174,7 @@ typedef struct wmXrActionSet {
 
 wmXrRuntimeData *wm_xr_runtime_data_create(void);
 void wm_xr_runtime_data_free(wmXrRuntimeData **runtime);
+void wm_xr_session_data_free(wmXrSessionState *state);
 
 void wm_xr_session_draw_data_update(const wmXrSessionState *state,
                                     const XrSessionSettings *settings,
diff --git a/source/blender/windowmanager/xr/intern/wm_xr_session.c b/source/blender/windowmanager/xr/intern/wm_xr_session.c
index ba30b0dd864..dc15b579e9d 100644
--- a/source/blender/windowmanager/xr/intern/wm_xr_session.c
+++ b/source/blender/windowmanager/xr/intern/wm_xr_session.c
@@ -68,7 +68,7 @@ static void wm_xr_session_controller_data_free(wmXrSessionState *state)
   BLI_freelistN(&state->controllers);
 }
 
-static void wm_xr_session_data_free(wmXrSessionState *state)
+void wm_xr_session_data_free(wmXrSessionState *state)
 {
   wm_xr_session_controller_data_free(state);
 }
@@ -76,6 +76,9 @@ static void wm_xr_session_data_free(wmXrSessionState *state)
 static void wm_xr_session_exit_cb(void *customdata)
 {
   wmXrData *xr_data = customdata;
+  if (!xr_data->runtime) {
+    return;
+  }
 
   xr_data->runtime->session_state.is_started = false;
 
@@ -84,7 +87,6 @@ static void wm_xr_session_exit_cb(void *customdata)
   }
 
   /* Free the entire runtime data (including session state and context), to play safe. */
-  wm_xr_session_data_free(&xr_data->runtime->session_state);
   wm_xr_runtime_data_free(&xr_data->runtime);
 }