From 74dc4e87a6df2826f26eb94eaff8fe02a3911c24 Mon Sep 17 00:00:00 2001
From: Campbell Barton <ideasman42@gmail.com>
Date: Mon, 4 May 2015 18:02:56 +1000
Subject: Fix Buttons context, invalid object data access

Another instance of T44376.
Crash where the Python context would access a stale pointer to the active object.
---
 source/blender/editors/include/ED_node.h           |  2 ++
 .../editors/space_buttons/buttons_context.c        |  5 ++++
 source/blender/editors/space_node/node_edit.c      | 28 ++++++++++++++++++++++
 source/blender/editors/util/ed_util.c              |  5 ++++
 4 files changed, 40 insertions(+)

(limited to 'source/blender/editors')

diff --git a/source/blender/editors/include/ED_node.h b/source/blender/editors/include/ED_node.h
index b02ebeb650b..1445308c485 100644
--- a/source/blender/editors/include/ED_node.h
+++ b/source/blender/editors/include/ED_node.h
@@ -103,6 +103,8 @@ void ED_node_set_active(struct Main *bmain, struct bNodeTree *ntree, struct bNod
 
 void ED_node_composite_job(const struct bContext *C, struct bNodeTree *nodetree, struct Scene *scene_owner);
 
+void ED_node_id_unref(struct SpaceNode *snode, const ID *id);
+
 /* node_ops.c */
 void ED_operatormacros_node(void);
 
diff --git a/source/blender/editors/space_buttons/buttons_context.c b/source/blender/editors/space_buttons/buttons_context.c
index b00a2c54ff9..bc42f1dd5bb 100644
--- a/source/blender/editors/space_buttons/buttons_context.c
+++ b/source/blender/editors/space_buttons/buttons_context.c
@@ -1183,6 +1183,11 @@ ID *buttons_context_id_path(const bContext *C)
 
 void ED_buttons_id_unref(SpaceButs *sbuts, const ID *id)
 {
+	if (sbuts->pinid == id) {
+		sbuts->pinid = NULL;
+		sbuts->flag &= ~SB_PIN_CONTEXT;
+	}
+
 	if (sbuts->path) {
 		ButsContextPath *path = sbuts->path;
 		int i;
diff --git a/source/blender/editors/space_node/node_edit.c b/source/blender/editors/space_node/node_edit.c
index 360087d77c7..ffd51bcc44e 100644
--- a/source/blender/editors/space_node/node_edit.c
+++ b/source/blender/editors/space_node/node_edit.c
@@ -740,6 +740,34 @@ void ED_node_set_active(Main *bmain, bNodeTree *ntree, bNode *node)
 	}
 }
 
+void ED_node_id_unref(SpaceNode *snode, const ID *id)
+{
+	if (GS(id->name) == ID_SCE) {
+		if (snode->id == id) {
+			/* nasty DNA logic for SpaceNode:
+			 * ideally should be handled by editor code, but would be bad level call
+			 */
+			bNodeTreePath *path, *path_next;
+			for (path = snode->treepath.first; path; path = path_next) {
+				path_next = path->next;
+				MEM_freeN(path);
+			}
+			BLI_listbase_clear(&snode->treepath);
+
+			snode->id = NULL;
+			snode->from = NULL;
+			snode->nodetree = NULL;
+			snode->edittree = NULL;
+		}
+	}
+	else if (GS(id->name) == ID_OB) {
+		if (snode->from == id) {
+			snode->flag &= ~SNODE_PIN;
+			snode->from = NULL;
+		}
+	}
+}
+
 void ED_node_post_apply_transform(bContext *UNUSED(C), bNodeTree *UNUSED(ntree))
 {
 	/* XXX This does not work due to layout functions relying on node->block,
diff --git a/source/blender/editors/util/ed_util.c b/source/blender/editors/util/ed_util.c
index d162becfe98..433c7603f35 100644
--- a/source/blender/editors/util/ed_util.c
+++ b/source/blender/editors/util/ed_util.c
@@ -62,6 +62,7 @@
 #include "ED_buttons.h"
 #include "ED_image.h"
 #include "ED_mesh.h"
+#include "ED_node.h"
 #include "ED_object.h"
 #include "ED_outliner.h"
 #include "ED_paint.h"
@@ -330,6 +331,7 @@ void ED_region_draw_mouse_line_cb(const bContext *C, ARegion *ar, void *arg_info
  */
 void ED_spacedata_id_unref(struct SpaceLink *sl, const ID *id)
 {
+
 	switch (sl->spacetype) {
 		case SPACE_OUTLINER:
 			ED_outliner_id_unref((SpaceOops *)sl, id);
@@ -337,5 +339,8 @@ void ED_spacedata_id_unref(struct SpaceLink *sl, const ID *id)
 		case SPACE_BUTS:
 			ED_buttons_id_unref((SpaceButs *)sl, id);
 			break;
+		case SPACE_NODE:
+			ED_node_id_unref((SpaceNode *)sl, id);
+			break;
 	}
 }
-- 
cgit v1.2.3