From 43b0ff3054bae229ce033d440b116c6b73fd01bc Mon Sep 17 00:00:00 2001
From: Bastien Montagne <bastien@blender.org>
Date: Wed, 2 Feb 2022 16:25:41 +0100
Subject: [PATCH] Fix (unreported) bug in liboverride resync code.

Part of the resynching code would access collections' objects base
cache, which can be invalid at that point (due to previous ID remapping
and/or deletion). Use a custom recursive iterator over collections'
objects instead, since those 'raw' data like collection's objects list,
and collection's children lists, should always be valid.

Found while investigating a studio production file.
---
 .../blender/blenkernel/intern/lib_override.c  | 40 ++++++++++++++-----
 1 file changed, 31 insertions(+), 9 deletions(-)

diff --git a/source/blender/blenkernel/intern/lib_override.c b/source/blender/blenkernel/intern/lib_override.c
index d1375b1e5b5..c4c5200cfdf 100644
--- a/source/blender/blenkernel/intern/lib_override.c
+++ b/source/blender/blenkernel/intern/lib_override.c
@@ -616,6 +616,35 @@ static void lib_override_linked_group_tag_recursive(LibOverrideGroupTagData *dat
   }
 }
 
+static bool lib_override_linked_group_tag_collections_keep_tagged_check_recursive(
+    LibOverrideGroupTagData *data, Collection *collection)
+{
+  /* NOTE: Collection's object cache (using bases, as returned by #BKE_collection_object_cache_get)
+   * is not usable here, as it may have become invalid from some previous operation and it should
+   * not be updated here. So instead only use collections' reliable 'raw' data to check if some
+   * object in the hierarchy of the given collection is still tagged for override. */
+  for (CollectionObject *collection_object = collection->gobject.first; collection_object != NULL;
+       collection_object = collection_object->next) {
+    Object *object = collection_object->ob;
+    if (object == NULL) {
+      continue;
+    }
+    if ((object->id.tag & data->tag) != 0) {
+      return true;
+    }
+  }
+
+  for (CollectionChild *collection_child = collection->children.first; collection_child != NULL;
+       collection_child = collection_child->next) {
+    if (lib_override_linked_group_tag_collections_keep_tagged_check_recursive(
+            data, collection_child->collection)) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
 static void lib_override_linked_group_tag_clear_boneshapes_objects(LibOverrideGroupTagData *data)
 {
   Main *bmain = data->bmain;
@@ -638,15 +667,8 @@ static void lib_override_linked_group_tag_clear_boneshapes_objects(LibOverrideGr
     if ((collection->id.tag & data->tag) == 0) {
       continue;
     }
-    bool keep_tagged = false;
-    const ListBase object_bases = BKE_collection_object_cache_get(collection);
-    LISTBASE_FOREACH (Base *, base, &object_bases) {
-      if ((base->object->id.tag & data->tag) != 0) {
-        keep_tagged = true;
-        break;
-      }
-    }
-    if (!keep_tagged) {
+
+    if (!lib_override_linked_group_tag_collections_keep_tagged_check_recursive(data, collection)) {
       collection->id.tag &= ~data->tag;
     }
   }