Area Swap: fix memory leak and access to freed memory.

4 files changed, 7 insertions, 31 deletions

diff --git a/source/blender/blenkernel/BKE_screen.h b/source/blender/blenkernel/BKE_screen.h
index ee9a4db049f..970cdf412e5 100644
--- a/source/blender/blenkernel/BKE_screen.h
+++ b/source/blender/blenkernel/BKE_screen.h
@@ -227,7 +227,6 @@ void BKE_spacetypes_free(void);	/* only for quitting blender */
 /* spacedata */
 void BKE_spacedata_freelist(ListBase *lb);
 void BKE_spacedata_copylist(ListBase *lb1, ListBase *lb2);
-void BKE_spacedata_copyfirst(ListBase *lb1, ListBase *lb2);
 
 /* area/regions */
 struct ARegion *BKE_area_region_copy(struct SpaceType *st, struct ARegion *ar);
diff --git a/source/blender/blenkernel/intern/screen.c b/source/blender/blenkernel/intern/screen.c
index 59a8bd74910..de5f018673f 100644
--- a/source/blender/blenkernel/intern/screen.c
+++ b/source/blender/blenkernel/intern/screen.c
@@ -235,27 +235,6 @@ void BKE_spacedata_copylist(ListBase *lb1, ListBase *lb2)
 	}
 }
 
-/* lb1 should be empty */
-void BKE_spacedata_copyfirst(ListBase *lb1, ListBase *lb2)
-{
-	SpaceLink *sl;
-	
-	lb1->first= lb1->last= NULL;	/* to be sure */
-	
-	sl= lb2->first;
-	if(sl) {
-		SpaceType *st= BKE_spacetype_from_id(sl->spacetype);
-
-		if(st && st->duplicate) {
-			SpaceLink *slnew= st->duplicate(sl);
-
-			BLI_addtail(lb1, slnew);
-
-			region_copylist(st, &slnew->regionbase, &sl->regionbase);
-		}
-	}
-}
-
 /* not region itself */
 void BKE_area_region_free(SpaceType *st, ARegion *ar)
 {
diff --git a/source/blender/editors/screen/area.c b/source/blender/editors/screen/area.c
index a2527bd9d15..7c7f93ee2ab 100644
--- a/source/blender/editors/screen/area.c
+++ b/source/blender/editors/screen/area.c
@@ -954,6 +954,7 @@ void area_copy_data(ScrArea *sa1, ScrArea *sa2, int swap_space)
 {
 	SpaceType *st;
 	ARegion *ar;
+	int spacetype= sa1->spacetype;
 	
 	sa1->headertype= sa2->headertype;
 	sa1->spacetype= sa2->spacetype;
@@ -981,7 +982,7 @@ void area_copy_data(ScrArea *sa1, ScrArea *sa2, int swap_space)
 	}
 	else {
 		if(swap_space<2) {
-			st= BKE_spacetype_from_id(sa1->spacetype);
+			st= BKE_spacetype_from_id(spacetype);
 			for(ar= sa1->regionbase.first; ar; ar= ar->next)
 				BKE_area_region_free(st, ar);
 			BLI_freelistN(&sa1->regionbase);
@@ -1004,10 +1005,6 @@ void ED_area_swapspace(bContext *C, ScrArea *sa1, ScrArea *sa2)
 	ED_area_exit(C, sa1);
 	ED_area_exit(C, sa2);
 
-	tmp->spacetype= sa1->spacetype;
-	tmp->butspacetype= sa1->butspacetype;
-	BKE_spacedata_copyfirst(&tmp->spacedata, &sa1->spacedata);
-
 	area_copy_data(tmp, sa1, 2);
 	area_copy_data(sa1, sa2, 0);
 	area_copy_data(sa2, tmp, 0);
diff --git a/source/blender/editors/screen/screen_ops.c b/source/blender/editors/screen/screen_ops.c
index 53879a55c1f..db670913eaa 100644
--- a/source/blender/editors/screen/screen_ops.c
+++ b/source/blender/editors/screen/screen_ops.c
@@ -614,15 +614,16 @@ static int area_swap_modal(bContext *C, wmOperator *op, wmEvent *event)
 					
 					return area_swap_cancel(C, op);
 				}
-				ED_area_swapspace(C, sad->sa1, sad->sa2);
-				
-				area_swap_exit(C, op);
-				
+
 #ifdef WM_FAST_DRAW
 				ED_area_tag_redraw(sad->sa1);
 				ED_area_tag_redraw(sad->sa2);
 #endif
 
+				ED_area_swapspace(C, sad->sa1, sad->sa2);
+				
+				area_swap_exit(C, op);
+				
 				WM_event_add_notifier(C, NC_SCREEN|NA_EDITED, NULL);
 				
 				return OPERATOR_FINISHED;