fix [#31738] BM_vert_splice modifies loops during iteration

patch by Nicholas Bishop, modified to avoid looping over vert-loops one extra time.

added BM_iter_as_arrayN(), returns an iterator as an array without knowing the length before calling.

3 files changed, 55 insertions, 9 deletions

diff --git a/source/blender/bmesh/intern/bmesh_core.c b/source/blender/bmesh/intern/bmesh_core.c
index 76aa8d55b5e..4d10ef317f3 100644
--- a/source/blender/bmesh/intern/bmesh_core.c
+++ b/source/blender/bmesh/intern/bmesh_core.c
@@ -1798,18 +1798,21 @@ BMFace *bmesh_jfke(BMesh *bm, BMFace *f1, BMFace *f2, BMEdge *e)
 int BM_vert_splice(BMesh *bm, BMVert *v, BMVert *vtarget)
 {
 	BMEdge *e;
-	BMLoop *l;
-	BMIter liter;
+
+	BMLoop **loops;
+	int i, loops_tot;
 
 	/* verts already spliced */
 	if (v == vtarget) {
 		return FALSE;
 	}
 
-	/* retarget all the loops of v to vtarget */
-	BM_ITER_ELEM (l, &liter, v, BM_LOOPS_OF_VERT) {
-		l->v = vtarget;
+	/* we can't modify the vert while iterating so first allocate an array of loops */
+	loops = BM_iter_as_arrayN(bm, BM_LOOPS_OF_VERT, v, &loops_tot);
+	for (i = 0; i < loops_tot; i++) {
+		loops[i]->v = vtarget;
 	}
+	MEM_freeN(loops);
 
 	/* move all the edges from v's disk to vtarget's disk */
 	while ((e = v->e)) {
diff --git a/source/blender/bmesh/intern/bmesh_iterators.c b/source/blender/bmesh/intern/bmesh_iterators.c
index 8103ae1ee11..64920df6e20 100644
--- a/source/blender/bmesh/intern/bmesh_iterators.c
+++ b/source/blender/bmesh/intern/bmesh_iterators.c
@@ -28,6 +28,8 @@
  * See: bmesh_iterators_inlin.c too, some functions are here for speed reasons.
  */
 
+#include "MEM_guardedalloc.h"
+
 #include "BLI_utildefines.h"
 
 #include "bmesh.h"
@@ -105,6 +107,38 @@ int BM_iter_as_array(BMesh *bm, const char itype, void *data, void **array, cons
 }
 
 /**
+ * \brief Iterator as Array
+ *
+ * Allocates a new array, has the advantage that you dont need to know the size ahead of time.
+ *
+ * Takes advantage of less common iterator usage to avoid counting twice,
+ * which you might end up doing when #BM_iter_as_array is used.
+ *
+ * Caller needs to free the array.
+ */
+void *BM_iter_as_arrayN(BMesh *bm, const char itype, void *data, int *r_len)
+{
+	BMIter iter;
+
+	if (BM_iter_init(&iter, bm, itype, data) && iter.count > 0) {
+		BMElem *ele;
+		BMElem **array = MEM_mallocN(sizeof(ele) * iter.count, __func__);
+		int i;
+
+		*r_len = iter.count;  /* set before iterating */
+
+		for (ele = BM_iter_step(&iter), i = 0; ele; ele = BM_iter_step(&iter), i++) {
+			array[i] = ele;
+		}
+		return array;
+	}
+	else {
+		*r_len = 0;
+		return NULL;
+	}
+}
+
+/**
  * \brief Elem Iter Flag Count
  *
  * Counts how many flagged / unflagged items are found in this element.
diff --git a/source/blender/bmesh/intern/bmesh_iterators.h b/source/blender/bmesh/intern/bmesh_iterators.h
index 1361a91a692..8d0eeca31ed 100644
--- a/source/blender/bmesh/intern/bmesh_iterators.h
+++ b/source/blender/bmesh/intern/bmesh_iterators.h
@@ -115,10 +115,19 @@ typedef struct BMIter {
 	char itype;
 } BMIter;
 
-void *BM_iter_at_index(BMesh *bm, const char itype, void *data, int index);
-int   BM_iter_as_array(BMesh *bm, const char itype, void *data, void **array, const int len);
-int   BM_iter_elem_count_flag(const char itype, void *data, const char hflag, const short value);
-int   BM_iter_mesh_count_flag(const char itype, BMesh *bm, const char hflag, const short value);
+void   *BM_iter_at_index(BMesh *bm, const char itype, void *data, int index)
+#ifdef __GNUC__
+__attribute__((warn_unused_result))
+#endif
+;
+int     BM_iter_as_array(BMesh *bm, const char itype, void *data, void **array, const int len);
+void   *BM_iter_as_arrayN(BMesh *bm, const char itype, void *data, int *r_len)
+#ifdef __GNUC__
+__attribute__((warn_unused_result))
+#endif
+;
+int     BM_iter_elem_count_flag(const char itype, void *data, const char hflag, const short value);
+int     BM_iter_mesh_count_flag(const char itype, BMesh *bm, const char hflag, const short value);
 
 /* private for bmesh_iterators_inline.c */
 void  bmiter__vert_of_mesh_begin(struct BMIter *iter);