Fix #37192, Rendered preview causes crash when deleting a material node in shader node editor. The 'free' callback for node execution data was accessed from the node->typeinfo, but this pointer can

become invalid because the render database is not immediately freed after the job finishes. To avoid access to dangling node pointers, store the function callback in the exec data itself. The node
pointer must not be accessed in the free function (wasn't used before either), these functions are purely for the execution data.

5 files changed, 8 insertions, 6 deletions

diff --git a/source/blender/blenkernel/BKE_node.h b/source/blender/blenkernel/BKE_node.h
index 7cc8c7290f7..15c14c7a707 100644
--- a/source/blender/blenkernel/BKE_node.h
+++ b/source/blender/blenkernel/BKE_node.h
@@ -132,7 +132,7 @@ typedef struct bNodeSocketType {
 } bNodeSocketType;
 
 typedef void *(*NodeInitExecFunction)(struct bNodeExecContext *context, struct bNode *node, bNodeInstanceKey key);
-typedef void (*NodeFreeExecFunction)(struct bNode *node, void *nodedata);
+typedef void (*NodeFreeExecFunction)(void *nodedata);
 typedef void (*NodeExecFunction)(void *data, int thread, struct bNode *, struct bNodeExecData *execdata, struct bNodeStack **in, struct bNodeStack **out);
 typedef int (*NodeGPUExecFunction)(struct GPUMaterial *mat, struct bNode *node, struct bNodeExecData *execdata, struct GPUNodeStack *in, struct GPUNodeStack *out);
 
diff --git a/source/blender/nodes/intern/node_exec.c b/source/blender/nodes/intern/node_exec.c
index 812fe5b4ae7..37018b3a98d 100644
--- a/source/blender/nodes/intern/node_exec.c
+++ b/source/blender/nodes/intern/node_exec.c
@@ -207,6 +207,7 @@ bNodeTreeExec *ntree_exec_begin(bNodeExecContext *context, bNodeTree *ntree, bNo
 	/* prepare all nodes for execution */
 	for (n = 0, nodeexec = exec->nodeexec; n < totnodes; ++n, ++nodeexec) {
 		node = nodeexec->node = nodelist[n];
+		nodeexec->freeexecfunc = node->typeinfo->freeexecfunc;
 		
 		/* tag inputs */
 		for (sock = node->inputs.first; sock; sock = sock->next) {
@@ -245,9 +246,8 @@ void ntree_exec_end(bNodeTreeExec *exec)
 		MEM_freeN(exec->stack);
 	
 	for (n = 0, nodeexec = exec->nodeexec; n < exec->totnodes; ++n, ++nodeexec) {
-		if (nodeexec->node->typeinfo)
-			if (nodeexec->node->typeinfo->freeexecfunc)
-				nodeexec->node->typeinfo->freeexecfunc(nodeexec->node, nodeexec->data.data);
+		if (nodeexec->freeexecfunc)
+			nodeexec->freeexecfunc(nodeexec->data.data);
 	}
 	
 	if (exec->nodeexec)
diff --git a/source/blender/nodes/intern/node_exec.h b/source/blender/nodes/intern/node_exec.h
index 7d76ef34934..4101c6c4c4d 100644
--- a/source/blender/nodes/intern/node_exec.h
+++ b/source/blender/nodes/intern/node_exec.h
@@ -51,6 +51,8 @@ struct bNodeStack;
 typedef struct bNodeExec {
 	struct bNode *node;				/* backpointer to node */
 	bNodeExecData data;
+	
+	NodeFreeExecFunction freeexecfunc; /* free function, stored in exec itself to avoid dangling node pointer access */
 } bNodeExec;
 
 /* Execution Data for each instance of node tree execution */
diff --git a/source/blender/nodes/shader/nodes/node_shader_common.c b/source/blender/nodes/shader/nodes/node_shader_common.c
index 72178018de4..e229fc75686 100644
--- a/source/blender/nodes/shader/nodes/node_shader_common.c
+++ b/source/blender/nodes/shader/nodes/node_shader_common.c
@@ -85,7 +85,7 @@ static void *group_initexec(bNodeExecContext *context, bNode *node, bNodeInstanc
 	return exec;
 }
 
-static void group_freeexec(bNode *UNUSED(node), void *nodedata)
+static void group_freeexec(void *nodedata)
 {
 	bNodeTreeExec *gexec = (bNodeTreeExec *)nodedata;
 	
diff --git a/source/blender/nodes/texture/nodes/node_texture_common.c b/source/blender/nodes/texture/nodes/node_texture_common.c
index fec6abbf062..7e65c472eef 100644
--- a/source/blender/nodes/texture/nodes/node_texture_common.c
+++ b/source/blender/nodes/texture/nodes/node_texture_common.c
@@ -72,7 +72,7 @@ static void *group_initexec(bNodeExecContext *context, bNode *node, bNodeInstanc
 	return exec;
 }
 
-static void group_freeexec(bNode *UNUSED(node), void *nodedata)
+static void group_freeexec(void *nodedata)
 {
 	bNodeTreeExec *gexec = (bNodeTreeExec *)nodedata;