Fix access freed memory when doing constraints ID counter on main free

Basically just made constraints free function aware of possible do_id_users
argument, same as we've got for objects, object data and so on.

4 files changed, 17 insertions, 6 deletions

diff --git a/source/blender/blenkernel/BKE_constraint.h b/source/blender/blenkernel/BKE_constraint.h
index ca03dd00521..1346feec82c 100644
--- a/source/blender/blenkernel/BKE_constraint.h
+++ b/source/blender/blenkernel/BKE_constraint.h
@@ -118,10 +118,12 @@ bConstraintTypeInfo *BKE_constraint_typeinfo_from_type(int type);
 void BKE_constraint_unique_name(struct bConstraint *con, struct ListBase *list);
 
 void BKE_constraints_free(struct ListBase *list);
+void BKE_constraints_free_ex(struct ListBase *list, bool do_id_user);
 void BKE_constraints_copy(struct ListBase *dst, const struct ListBase *src, bool do_extern);
 void BKE_constraints_relink(struct ListBase *list);
 void BKE_constraints_id_loop(struct ListBase *list, ConstraintIDFunc func, void *userdata);
 void BKE_constraint_free_data(struct bConstraint *con);
+void BKE_constraint_free_data_ex(struct bConstraint *con, bool do_id_user);
 
 /* Constraint API function prototypes */
 struct bConstraint *BKE_constraints_active_get(struct ListBase *list);
diff --git a/source/blender/blenkernel/intern/action.c b/source/blender/blenkernel/intern/action.c
index 1bae65a7fb4..f9556bf39ab 100644
--- a/source/blender/blenkernel/intern/action.c
+++ b/source/blender/blenkernel/intern/action.c
@@ -733,7 +733,7 @@ void BKE_pose_channel_free_ex(bPoseChannel *pchan, bool do_id_user)
 		pchan->mpath = NULL;
 	}
 
-	BKE_constraints_free(&pchan->constraints);
+	BKE_constraints_free_ex(&pchan->constraints, do_id_user);
 	
 	if (pchan->prop) {
 		IDP_FreeProperty(pchan->prop);
diff --git a/source/blender/blenkernel/intern/constraint.c b/source/blender/blenkernel/intern/constraint.c
index 93f524a5439..c38a1239f12 100644
--- a/source/blender/blenkernel/intern/constraint.c
+++ b/source/blender/blenkernel/intern/constraint.c
@@ -4370,7 +4370,7 @@ static void con_unlink_refs_cb(bConstraint *UNUSED(con), ID **idpoin, bool is_re
  * be sure to run BIK_clear_data() when freeing an IK constraint,
  * unless DAG_relations_tag_update is called. 
  */
-void BKE_constraint_free_data(bConstraint *con)
+void BKE_constraint_free_data_ex(bConstraint *con, bool do_id_user)
 {
 	if (con->data) {
 		bConstraintTypeInfo *cti = BKE_constraint_typeinfo_get(con);
@@ -4381,7 +4381,7 @@ void BKE_constraint_free_data(bConstraint *con)
 				cti->free_data(con);
 				
 			/* unlink the referenced resources it uses */
-			if (cti->id_looper)
+			if (do_id_user && cti->id_looper)
 				cti->id_looper(con, con_unlink_refs_cb, NULL);
 		}
 		
@@ -4390,19 +4390,28 @@ void BKE_constraint_free_data(bConstraint *con)
 	}
 }
 
+void BKE_constraint_free_data(bConstraint *con)
+{
+	BKE_constraint_free_data_ex(con, true);
+}
+
 /* Free all constraints from a constraint-stack */
-void BKE_constraints_free(ListBase *list)
+void BKE_constraints_free_ex(ListBase *list, bool do_id_user)
 {
 	bConstraint *con;
 	
 	/* Free constraint data and also any extra data */
 	for (con = list->first; con; con = con->next)
-		BKE_constraint_free_data(con);
+		BKE_constraint_free_data_ex(con, do_id_user);
 	
 	/* Free the whole list */
 	BLI_freelistN(list);
 }
 
+void BKE_constraints_free(ListBase *list)
+{
+	BKE_constraints_free_ex(list, true);
+}
 
 /* Remove the specified constraint from the given constraint stack */
 bool BKE_constraint_remove(ListBase *list, bConstraint *con)
diff --git a/source/blender/blenkernel/intern/object.c b/source/blender/blenkernel/intern/object.c
index da6d4e27cf8..8a6c6414266 100644
--- a/source/blender/blenkernel/intern/object.c
+++ b/source/blender/blenkernel/intern/object.c
@@ -385,7 +385,7 @@ void BKE_object_free_ex(Object *ob, bool do_id_user)
 	free_controllers(&ob->controllers);
 	free_actuators(&ob->actuators);
 	
-	BKE_constraints_free(&ob->constraints);
+	BKE_constraints_free_ex(&ob->constraints, do_id_user);
 	
 	free_partdeflect(ob->pd);
 	BKE_rigidbody_free_object(ob);