archive/blender-archive
Archived
1
1
Fork 0
Code Pull Requests Packages Activity

Fix T37709: Memory corruption when freeing custom bone shape objects

Browse Source 
Summary:
Issue was caused by access to pchan->custom object from channel free
function when freeing all objects from main. Order of objects free
is not defined and such an access might easily end up with access
to freed memory.

We don't need to do user counter stuff when freeing main, so added
an _ex functions with do_id_user flag which is used when freeing main.

We had the same issue with other datablocks, so now it should be
easier to support relevant user counter.

This issue was caused by the fix for T36391, so perhaps that's indeed
high time to do real user counter.

Reviewers: brecht, campbellbarton

Reviewed By: campbellbarton

Maniphest Tasks: T37709

Differential Revision: https://developer.blender.org/D137
This commit is contained in:
Sergey Sharybin
2013-12-25 16:43:26 +06:00
parent ad0a3de3ce
commit 122e2b4bfa
6 changed files with 76 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
source/blender/blenkernel/intern/object.c
View File

@@ -321,7 +321,7 @@ void BKE_object_free_derived_caches(Object *ob)
}
/* do not free object itself */
void BKE_object_free(Object *ob)
void BKE_object_free_ex(Object *ob, bool do_id_user)
{
int a;
@@ -364,7 +364,7 @@ void BKE_object_free(Object *ob)
if (ob->defbase.first)
BLI_freelistN(&ob->defbase);
if (ob->pose)
BKE_pose_free(ob->pose);
BKE_pose_free_ex(ob->pose, do_id_user);
if (ob->mpath)
animviz_free_motionpath(ob->mpath);
BKE_bproperty_free_list(&ob->prop);
@@ -399,6 +399,11 @@ void BKE_object_free(Object *ob)
}
}
void BKE_object_free(Object *ob)
{
BKE_object_free_ex(ob, true);
}
static void unlink_object__unlinkModifierLinks(void *userData, Object *ob, Object **obpoin)
{
Object *unlinkOb = userData;