Depsgraph: Fix crash deleting Viewer image from Outliner

Was happening when having compositor open with Viewer node attached
directly to Render Layers output.

There were two things involved here:

1. The code which was storing CoW-ed versions of IDs was checking all
   IDs for whether they are expanded or not. This was causing access
   of freed memory for deleted IDs which do not need CoW (such as IM).

   Simple fix: store ID type as a scalar and use early check before
   doing more elaborate check based on accessing fields of id_cow.

2. The code which was ensuring view layer pointer is doing CoW for
   scene. This isn't an issue on its own, but scene might have an
   embedded ID such as compositor which was actually traversed by the
   ID remap routines. This was causing remapping procedure to go into
   non-updated copy of compositor, accessing freed Viewer image ID.

   Solved by not recursing into embedded IDs for datablocks as those
   are supposed to have own copy-on-write operations which takes care
   of re-mapping.

Reported my Bastien, and also pair-coded with him.

1 files changed, 12 insertions, 0 deletions

diff --git a/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc b/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc
index 01d84f6b5d8..c512300200e 100644
--- a/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc
+++ b/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc
@@ -319,6 +319,18 @@ void DepsgraphNodeBuilder::begin_build()
    * them for new ID nodes. */
   id_info_hash_ = BLI_ghash_ptr_new("Depsgraph id hash");
   for (IDNode *id_node : graph_->id_nodes) {
+    /* It is possible that the ID does not need to have CoW version in which case id_cow is the
+     * same as id_orig. Additionally, such ID might have been removed, which makes the check
+     * for whether id_cow is expanded to access freed memory. In orderr to deal with this we
+     * check whether CoW is needed based on a scalar value which does not lead to access of
+     * possibly deleted memory.
+     * Additionally, this saves some space in the map by skipping mapping for datablocks which
+     * do not need CoW, */
+    if (!deg_copy_on_write_is_needed(id_node->id_type)) {
+      id_node->id_cow = nullptr;
+      continue;
+    }
+
     IDInfo *id_info = (IDInfo *)MEM_mallocN(sizeof(IDInfo), "depsgraph id info");
     if (deg_copy_on_write_is_expanded(id_node->id_cow) && id_node->id_orig != id_node->id_cow) {
       id_info->id_cow = id_node->id_cow;