[#20093] Consistent Crash in properties window

Fun bug, took me the better part of the day to track down.

Happens because maximizing swaps spacedata lists between the old area and the newly created maximized area (this one being empty) while ui handlers are still hanging with references to the first area (then trying to access spacedata when handled). And then only if a maximizing operator was run before the UI realign timer event from the previous maximize was handled (fun, I told you).

After discussion with Matt on irc, we decided the best way to deal with that was to remove ui handlers that reference areas of a screen that is no longer used. That solution reflects the fact that the bug is more general that the reproducing steps would lead to believe. There's also absolutely no reason to run UI handlers on invisible areas.

2 files changed, 20 insertions, 0 deletions

diff --git a/source/blender/windowmanager/WM_api.h b/source/blender/windowmanager/WM_api.h
index 94cd6ed85a0..4cc116e7bbd 100644
--- a/source/blender/windowmanager/WM_api.h
+++ b/source/blender/windowmanager/WM_api.h
@@ -150,6 +150,7 @@ struct wmEventHandler *WM_event_add_ui_handler(const struct bContext *C, ListBas
 void		WM_event_remove_ui_handler(ListBase *handlers,
 			int (*func)(struct bContext *C, struct wmEvent *event, void *userdata),
 			void (*remove)(struct bContext *C, void *userdata), void *userdata);
+void		WM_event_remove_area_handler(struct ListBase *handlers, void *area);
 
 struct wmEventHandler *WM_event_add_modal_handler(struct bContext *C, struct wmOperator *op);
 void		WM_event_remove_handlers(struct bContext *C, ListBase *handlers);
diff --git a/source/blender/windowmanager/intern/wm_event_system.c b/source/blender/windowmanager/intern/wm_event_system.c
index 9a6d02790e5..f437e096755 100644
--- a/source/blender/windowmanager/intern/wm_event_system.c
+++ b/source/blender/windowmanager/intern/wm_event_system.c
@@ -1620,6 +1620,25 @@ void WM_event_remove_ui_handler(ListBase *handlers, wmUIHandlerFunc func, wmUIHa
 	}
 }
 
+void WM_event_remove_area_handler(ListBase *handlers, void *area)
+{
+	wmEventHandler *handler, *nexthandler;
+
+	for(handler = handlers->first; handler; handler= nexthandler) {
+		nexthandler = handler->next;
+		if (handler->ui_area == area || handler->op_area == area) {
+			BLI_remlink(handlers, handler);
+			wm_event_free_handler(handler);
+		}
+	}
+}
+
+void WM_event_remove_handler(ListBase *handlers, wmEventHandler *handler)
+{
+	BLI_remlink(handlers, handler);
+	wm_event_free_handler(handler);
+}
+
 void WM_event_add_mousemove(bContext *C)
 {
 	wmWindow *window= CTX_wm_window(C);