[Bf-blender-cvs] SVN commit: /data/svn/bf-blender [17928] branches/blender2.5/blender/source /blender: 2.5: fix for crashes due to access to free' d memory in joining areas,

[Brecht Van Lommel]

Revision: 17928
          http://projects.blender.org/plugins/scmsvn/viewcvs.php?view=rev&root=bf-blender&revision=17928
Author:   blendix
Date:     2008-12-18 20:41:36 +0100 (Thu, 18 Dec 2008)

Log Message:
-----------
2.5: fix for crashes due to access to free'd memory in joining areas,
ripping areas and duplicating windows.

Modified Paths:
--------------
    branches/blender2.5/blender/source/blender/editors/interface/interface_handlers.c
    branches/blender2.5/blender/source/blender/editors/screen/screen_ops.c
    branches/blender2.5/blender/source/blender/windowmanager/intern/wm_event_system.c

Modified: branches/blender2.5/blender/source/blender/editors/interface/interface_handlers.c
===================================================================
--- branches/blender2.5/blender/source/blender/editors/interface/interface_handlers.c	2008-12-18 19:21:30 UTC (rev 17927)
+++ branches/blender2.5/blender/source/blender/editors/interface/interface_handlers.c	2008-12-18 19:41:36 UTC (rev 17928)
@@ -3649,16 +3649,25 @@
 static int ui_handler_popup(bContext *C, wmEvent *event, void *userdata)
 {
 	uiMenuBlockHandle *menu= userdata;
+	void (*popup_func)(struct bContext *C, void *arg, int event)= NULL;
+	void *popup_arg= NULL;
+	int retval= 0;
 
 	ui_handle_menus_recursive(C, event, menu);
 
 	/* free if done, does not free handle itself */
 	if(menu->menuretval) {
+		if(menu->menuretval == UI_RETURN_OK) {
+			popup_func= menu->popup_func;
+			popup_arg= menu->popup_arg;
+			retval= menu->retvalue;
+		}
+
 		ui_menu_block_free(C, menu);
 		WM_event_remove_ui_handler(&CTX_wm_window(C)->handlers, ui_handler_popup, ui_handler_remove_popup, menu);
 
-		if(menu->menuretval == UI_RETURN_OK && menu->popup_func)
-			menu->popup_func(C, menu->popup_arg, menu->retvalue);
+		if(popup_func)
+			popup_func(C, popup_arg, retval);
 	}
 	else {
 		/* re-enable tooltips */

Modified: branches/blender2.5/blender/source/blender/editors/screen/screen_ops.c
===================================================================
--- branches/blender2.5/blender/source/blender/editors/screen/screen_ops.c	2008-12-18 19:21:30 UTC (rev 17927)
+++ branches/blender2.5/blender/source/blender/editors/screen/screen_ops.c	2008-12-18 19:41:36 UTC (rev 17928)
@@ -264,7 +264,7 @@
 	
 	/* allocs new screen and adds to newly created window, using window size */
 	newsc= screen_add(newwin, sc->id.name+2);
-	win->screen= newsc;
+	newwin->screen= newsc;
 	
 	/* copy area to new screen */
 	area_copy_data((ScrArea *)newsc->areabase.first, sa, 0);
@@ -767,6 +767,7 @@
 	if (screen_area_join(C, CTX_wm_screen(C), sd->sarea, sd->narea)) {
 		if (CTX_wm_area(C) == sd->narea) {
 			CTX_wm_area_set(C, NULL);
+			CTX_wm_region_set(C, NULL);
 		}
 		sd->narea = NULL;
 	}
@@ -1018,6 +1019,7 @@
 	}
 	if (CTX_wm_area(C) == jd->sa2) {
 		CTX_wm_area_set(C, NULL);
+		CTX_wm_region_set(C, NULL);
 	}
 
 	return 1;

Modified: branches/blender2.5/blender/source/blender/windowmanager/intern/wm_event_system.c
===================================================================
--- branches/blender2.5/blender/source/blender/windowmanager/intern/wm_event_system.c	2008-12-18 19:21:30 UTC (rev 17927)
+++ branches/blender2.5/blender/source/blender/windowmanager/intern/wm_event_system.c	2008-12-18 19:41:36 UTC (rev 17928)
@@ -441,6 +441,12 @@
 	return 1;
 }
 
+static int wm_event_always_pass(wmEvent *event)
+{
+	/* some events we always pass on, to ensure proper communication */
+	return (event->type == TIMER);
+}
+
 /* Warning: this function removes a modal handler, when finished */
 static int wm_handler_operator_call(bContext *C, ListBase *handlers, wmEventHandler *handler, wmEvent *event, IDProperty *properties)
 {
@@ -462,8 +468,15 @@
 			retval= ot->modal(C, op, event);
 
 			/* putting back screen context */
-			CTX_wm_area_set(C, area);
-			CTX_wm_region_set(C, region);
+			if((retval & OPERATOR_PASS_THROUGH) || wm_event_always_pass(event)) {
+				CTX_wm_area_set(C, area);
+				CTX_wm_region_set(C, region);
+			}
+			else {
+				/* this special cases is for areas and regions that get removed */
+				CTX_wm_area_set(C, NULL);
+				CTX_wm_region_set(C, NULL);
+			}
 			
 			if((retval & OPERATOR_FINISHED) && (ot->flag & OPTYPE_REGISTER)) {
 				wm_operator_register(CTX_wm_manager(C), op);
@@ -474,7 +487,6 @@
 				handler->op= NULL;
 			}
 			
-			
 			/* remove modal handler, operator itself should have been cancelled and freed */
 			if(retval & (OPERATOR_CANCELLED|OPERATOR_FINISHED)) {
 				BLI_remlink(handlers, handler);
@@ -524,12 +536,6 @@
 	return WM_HANDLER_CONTINUE;
 }
 
-static int wm_event_always_pass(wmEvent *event)
-{
-	/* some events we always pass on, to ensure proper communication */
-	return (event->type == TIMER);
-}
-
 static int handler_boundbox_test(wmEventHandler *handler, wmEvent *event)
 {
 	if(handler->bbwin) {