Depsgraph: Guarantee order of backup of action and ID using it

It was possible to have object copy-on-write happening during
action's copy-on-write, which was causing access to a freed
memory from animation backup.

Solves crash reported in T73029.

2 files changed, 17 insertions, 3 deletions

diff --git a/source/blender/depsgraph/intern/builder/deg_builder_relations.cc b/source/blender/depsgraph/intern/builder/deg_builder_relations.cc
index 3e0ab9684da..a3439f80e4b 100644
--- a/source/blender/depsgraph/intern/builder/deg_builder_relations.cc
+++ b/source/blender/depsgraph/intern/builder/deg_builder_relations.cc
@@ -2674,6 +2674,21 @@ void DepsgraphRelationBuilder::build_copy_on_write_relations(IDNode *id_node)
       BLI_assert(object->type == OB_EMPTY);
     }
   }
+
+  /* Copy-on-write of write will iterate over f-curves to store current values corresponding
+   * to their RNA path. This means that action must be copied prior to the ID's copy-on-write,
+   * otherwise depsgraph might try to access freed data. */
+  AnimData *animation_data = BKE_animdata_from_id(id_orig);
+  if (animation_data != NULL) {
+    if (animation_data->action != NULL) {
+      OperationKey action_copy_on_write_key(
+          &animation_data->action->id, NodeType::COPY_ON_WRITE, OperationCode::COPY_ON_WRITE);
+      add_relation(action_copy_on_write_key,
+                   copy_on_write_key,
+                   "Eval Order",
+                   RELATION_FLAG_GODMODE | RELATION_FLAG_NO_FLUSH);
+    }
+  }
 }
 
 /* **** ID traversal callbacks functions **** */
diff --git a/source/blender/depsgraph/intern/eval/deg_eval_runtime_backup_animation.cc b/source/blender/depsgraph/intern/eval/deg_eval_runtime_backup_animation.cc
index ec3ab6edc17..d5f29006434 100644
--- a/source/blender/depsgraph/intern/eval/deg_eval_runtime_backup_animation.cc
+++ b/source/blender/depsgraph/intern/eval/deg_eval_runtime_backup_animation.cc
@@ -114,9 +114,8 @@ void AnimationBackup::restore_to_id(ID *id)
   for (const AnimationValueBackup &value_backup : values_backup) {
     /* Resolve path to the property.
      *
-     * NOTE: Do it again (after storing), since the sub-data [ointers might be
-     * changed after copy-on-write.
-     */
+     * NOTE: Do it again (after storing), since the sub-data pointers might be
+     * changed after copy-on-write. */
     PathResolvedRNA resolved_rna;
     if (!BKE_animsys_store_rna_setting(&id_pointer_rna,
                                        value_backup.rna_path.c_str(),