Workaround/Fix T43139: Calling bpy.ops.screen.screen_full_area() multiple times in python console causes Blender to crash

This was sort of a chicken<->egg dilemma, because after a maximized screen was restored, the screen handling used region
coordinates which weren't updated yet. I'm still not sure why, but this resulted in area coords that go beond INT_MAX.

To fix this I made sure the first screen handling after restoring a maximized screen is skipped, so that it's delayed to
the next call of wm_event_do_handlers (since this is called from main loop there shouldn't be a noticable delay or any
handling glitches).

3 files changed, 16 insertions, 2 deletions

diff --git a/source/blender/editors/screen/screen_edit.c b/source/blender/editors/screen/screen_edit.c
index 3f814084238..3972d00293c 100644
--- a/source/blender/editors/screen/screen_edit.c
+++ b/source/blender/editors/screen/screen_edit.c
@@ -1881,6 +1881,11 @@ ScrArea *ED_screen_state_toggle(bContext *C, wmWindow *win, ScrArea *sa, const s
 		BKE_screen_free(oldscreen);
 		BKE_libblock_free(CTX_data_main(C), oldscreen);
 
+		/* After we've restored back to SCREENNORMAL, we have to wait with
+		 * screen handling as it uses the area coords which aren't updated yet.
+		 * Without doing so, the screen handling gets wrong area coords,
+		 * which in worst case can lead to crashes (see T43139) */
+		sc->skip_handling = true;
 	}
 	else {
 		/* change from SCREENNORMAL to new state */
diff --git a/source/blender/makesdna/DNA_screen_types.h b/source/blender/makesdna/DNA_screen_types.h
index 941a7d020bc..f23d02f190c 100644
--- a/source/blender/makesdna/DNA_screen_types.h
+++ b/source/blender/makesdna/DNA_screen_types.h
@@ -69,11 +69,12 @@ typedef struct bScreen {
 	short do_draw_paintcursor;			/* notifier for paint cursor draw. */
 	short do_draw_drag;					/* notifier for dragging draw. */
 	short swap;							/* indicator to survive swap-exchange systems */
+	short skip_handling;				/* set to delay screen handling after switching back from maximized area */
 	
 	short mainwin;						/* screensize subwindow, for screenedges and global menus */
 	short subwinactive;					/* active subwindow */
 	
-	short pad;
+	double pad;
 	
 	struct wmTimer *animtimer;			/* if set, screen has timer handler added in window */
 	void *context;						/* context callback */
@@ -215,7 +216,7 @@ typedef struct ScrArea {
 	short do_refresh;				/* private, for spacetype refresh callback */
 	short flag;
 	short region_active_win;		/* index of last used region of 'RGN_TYPE_WINDOW'
-									 * runtuime variable, updated by executing operators */
+									 * runtime variable, updated by executing operators */
 	char temp, pad;
 	
 	struct SpaceType *type;		/* callbacks for this space type */
diff --git a/source/blender/windowmanager/intern/wm_event_system.c b/source/blender/windowmanager/intern/wm_event_system.c
index f50744bf99e..d5c88ff156c 100644
--- a/source/blender/windowmanager/intern/wm_event_system.c
+++ b/source/blender/windowmanager/intern/wm_event_system.c
@@ -2318,6 +2318,14 @@ void wm_event_do_handlers(bContext *C)
 				}
 
 				for (sa = win->screen->areabase.first; sa; sa = sa->next) {
+					/* after restoring a screen from SCREENMAXIMIZED we have to wait
+					 * with the screen handling till the region coordinates are updated */
+					if (win->screen->skip_handling == true) {
+						/* restore for the next iteration of wm_event_do_handlers */
+						win->screen->skip_handling = false;
+						break;
+					}
+
 					if (wm_event_inside_i(event, &sa->totrct)) {
 						CTX_wm_area_set(C, sa);