fix for error reading from freed memory when deleting a screen, would free then notifier then check its contents in the notifier queue loop.

1 files changed, 10 insertions, 2 deletions

diff --git a/source/blender/windowmanager/intern/wm_event_system.c b/source/blender/windowmanager/intern/wm_event_system.c
index b4f193bdbe6..08432d62720 100644
--- a/source/blender/windowmanager/intern/wm_event_system.c
+++ b/source/blender/windowmanager/intern/wm_event_system.c
@@ -85,6 +85,7 @@
 #  include "RNA_enum_types.h"
 #endif
 
+static void wm_notifier_clear(wmNotifier *note);
 static void update_tablet_data(wmWindow *win, wmEvent *event);
 
 static int wm_operator_call_internal(bContext *C, wmOperatorType *ot, PointerRNA *properties, ReportList *reports,
@@ -218,13 +219,20 @@ void WM_main_remove_notifier_reference(const void *reference)
 			note_next = note->next;
 
 			if (note->reference == reference) {
-				BLI_remlink(&wm->queue, note);
-				MEM_freeN(note);
+				/* don't remove becauise this causes problems for #wm_event_do_notifiers
+				 * which may be looping on the data (deleting screens) */
+				wm_notifier_clear(note);
 			}
 		}
 	}
 }
 
+static void wm_notifier_clear(wmNotifier *note)
+{
+	/* NULL the entire notifier, only leaving (next, prev) members intact */
+	memset(((char *)note) + sizeof(Link), 0, sizeof(*note) - sizeof(Link));
+}
+
 static wmNotifier *wm_notifier_next(wmWindowManager *wm)
 {
 	wmNotifier *note = wm->queue.first;