Fix T48667: Bisect-fill crash

BMO iterator would loop over removed faces.

Recent changes to mempool FREEWORD size exposed this bug.

1 files changed, 21 insertions, 17 deletions

diff --git a/source/blender/bmesh/operators/bmo_triangulate.c b/source/blender/bmesh/operators/bmo_triangulate.c
index 6fb09c76ea4..974446f09c0 100644
--- a/source/blender/bmesh/operators/bmo_triangulate.c
+++ b/source/blender/bmesh/operators/bmo_triangulate.c
@@ -244,29 +244,33 @@ void bmo_triangle_fill_exec(BMesh *bm, BMOperator *op)
 		BMO_slot_buffer_flag_enable(bm, bmop.slots_out, "geom.out", BM_FACE | BM_EDGE, ELE_NEW);
 		BMO_op_finish(bm, &bmop);
 	}
-	
-	BMO_slot_buffer_from_enabled_flag(bm, op, op->slots_out, "geom.out", BM_EDGE | BM_FACE, ELE_NEW);
 
 	if (use_dissolve) {
-		BMO_ITER (e, &siter, op->slots_out, "geom.out", BM_EDGE) {
-			if (LIKELY(e->l)) {  /* in rare cases the edges face will have already been removed from the edge */
-				BMFace *f_new;
-				f_new = BM_faces_join_pair(bm, e->l->f,
-				                           e->l->radial_next->f, e,
-				                           false); /* join faces */
-				if (f_new) {
-					BMO_elem_flag_enable(bm, f_new, ELE_NEW);
-					BM_edge_kill(bm, e);
+		BMEdge *e_next;
+		BMIter iter;
+
+		BM_ITER_MESH_MUTABLE (e, e_next, &iter, bm, BM_EDGES_OF_MESH) {
+			if (BMO_elem_flag_test(bm, e, ELE_NEW)) {
+				/* in rare cases the edges face will have already been removed from the edge */
+				if (LIKELY(e->l)) {
+					BMFace *f_new = BM_faces_join_pair(
+					        bm, e->l->f,
+					        e->l->radial_next->f, e,
+					        false); /* join faces */
+					if (f_new) {
+						BMO_elem_flag_enable(bm, f_new, ELE_NEW);
+						BM_edge_kill(bm, e);
+					}
+					else {
+						BMO_error_clear(bm);
+					}
 				}
 				else {
-					BMO_error_clear(bm);
+					BM_edge_kill(bm, e);
 				}
 			}
-			else {
-				BM_edge_kill(bm, e);
-			}
 		}
-
-		BMO_slot_buffer_from_enabled_flag(bm, op, op->slots_out, "geom.out", BM_EDGE | BM_FACE, ELE_NEW);
 	}
+
+	BMO_slot_buffer_from_enabled_flag(bm, op, op->slots_out, "geom.out", BM_EDGE | BM_FACE, ELE_NEW);
 }