4 files changed, 31 insertions, 12 deletions

diff --git a/source/blender/editors/mesh/mesh_data.c b/source/blender/editors/mesh/mesh_data.c
index b825de58678..4cbb5f303f0 100644
--- a/source/blender/editors/mesh/mesh_data.c
+++ b/source/blender/editors/mesh/mesh_data.c
@@ -138,7 +138,7 @@ static void delete_customdata_layer(Mesh *me, CustomDataLayer *layer)
 		BM_data_layer_free_n(me->edit_btmesh->bm, data, type, n);
 	}
 	else {
-		CustomData_free_layer(data, type, tot, n);
+		CustomData_free_layer(data, type, tot, layer_index + n);
 		BKE_mesh_update_customdata_pointers(me, true);
 	}
 }
diff --git a/source/blender/editors/render/render_opengl.c b/source/blender/editors/render/render_opengl.c
index 93ae913cee0..6b55518552a 100644
--- a/source/blender/editors/render/render_opengl.c
+++ b/source/blender/editors/render/render_opengl.c
@@ -728,6 +728,9 @@ static int screen_opengl_render_invoke(bContext *C, wmOperator *op, const wmEven
 	oglrender = op->customdata;
 	render_view_open(C, event->x, event->y);
 	
+	/* view may be changed above (R_OUTPUT_WINDOW) */
+	oglrender->win = CTX_wm_window(C);
+
 	WM_event_add_modal_handler(C, op);
 	oglrender->timer = WM_event_add_timer(oglrender->wm, oglrender->win, TIMER, 0.01f);
 	
diff --git a/source/blender/editors/sculpt_paint/paint_image_proj.c b/source/blender/editors/sculpt_paint/paint_image_proj.c
index 017232d1856..db55dc271f1 100644
--- a/source/blender/editors/sculpt_paint/paint_image_proj.c
+++ b/source/blender/editors/sculpt_paint/paint_image_proj.c
@@ -2816,7 +2816,11 @@ static void project_paint_begin(ProjPaintState *ps)
 
 	int a, i; /* generic looping vars */
 	int image_index = -1, face_index;
-	int *mpoly_origindex;
+
+	/* double lookup */
+	const int *index_mf_to_mpoly = NULL;
+	const int *index_mp_to_orig  = NULL;
+
 	MVert *mv;
 
 	MemArena *arena; /* at the moment this is just ps->arena_mt[0], but use this to show were not multithreading */
@@ -2871,12 +2875,17 @@ static void project_paint_begin(ProjPaintState *ps)
 	ps->dm_totface = ps->dm->getNumTessFaces(ps->dm);
 
 	if (ps->do_face_sel) {
-		mpoly_orig = ((Mesh *)ps->ob->data)->mpoly;
-		mpoly_origindex = ps->dm->getPolyDataArray(ps->dm, CD_ORIGINDEX);
+		index_mf_to_mpoly = ps->dm->getTessFaceDataArray(ps->dm, CD_ORIGINDEX);
+		index_mp_to_orig  = ps->dm->getPolyDataArray(ps->dm, CD_ORIGINDEX);
+		if (index_mf_to_mpoly == NULL) {
+			index_mp_to_orig = NULL;
+		}
+		else {
+			mpoly_orig = ((Mesh *)ps->ob->data)->mpoly;
+		}
 	}
 	else {
 		mpoly_orig = NULL;
-		mpoly_origindex = NULL;
 	}
 
 	/* use clone mtface? */
@@ -3166,8 +3175,10 @@ static void project_paint_begin(ProjPaintState *ps)
 
 		if (ps->do_face_sel) {
 			int orig_index;
-			if (mpoly_origindex && ((orig_index = mpoly_origindex[face_index])) != ORIGINDEX_NONE) {
-				MPoly *mp = mpoly_orig + orig_index;
+			if (index_mp_to_orig && ((orig_index = DM_origindex_mface_mpoly(index_mf_to_mpoly, index_mp_to_orig,
+			                                                                face_index))) != ORIGINDEX_NONE)
+			{
+				MPoly *mp = &mpoly_orig[orig_index];
 				is_face_sel = ((mp->flag & ME_FACE_SEL) != 0);
 			}
 			else {
diff --git a/source/blender/editors/sculpt_paint/sculpt.c b/source/blender/editors/sculpt_paint/sculpt.c
index c7f8161c7ed..f67cc0359a2 100644
--- a/source/blender/editors/sculpt_paint/sculpt.c
+++ b/source/blender/editors/sculpt_paint/sculpt.c
@@ -4652,13 +4652,18 @@ void sculpt_dynamic_topology_disable(bContext *C,
 		sculptsession_bm_to_me(ob, TRUE);
 	}
 
-	BM_mesh_free(ss->bm);
-
 	/* Clear data */
 	me->flag &= ~ME_SCULPT_DYNAMIC_TOPOLOGY;
-	ss->bm = NULL;
-	BM_log_free(ss->bm_log);
-	ss->bm_log = NULL;
+
+	/* typically valid but with global-undo they can be NULL, [#36234] */
+	if (ss->bm) {
+		BM_mesh_free(ss->bm);
+		ss->bm = NULL;
+	}
+	if (ss->bm_log) {
+		BM_log_free(ss->bm_log);
+		ss->bm_log = NULL;
+	}
 
 	/* Refresh */
 	sculpt_update_after_dynamic_topology_toggle(C);