[Bf-blender-cvs] SVN commit: /data/svn/bf-blender [59542] trunk/blender/source/blender/ windowmanager/intern/wm_event_system.c: fix for error reading from freed memory when deleting a screen, would free then notifier then check its contents in the notifier queue loop .

[Campbell Barton]

Revision: 59542
          http://projects.blender.org/scm/viewvc.php?view=rev&root=bf-blender&revision=59542
Author:   campbellbarton
Date:     2013-08-26 22:48:14 +0000 (Mon, 26 Aug 2013)
Log Message:
-----------
fix for error reading from freed memory when deleting a screen, would free then notifier then check its contents in the notifier queue loop.

Modified Paths:
--------------
    trunk/blender/source/blender/windowmanager/intern/wm_event_system.c

Modified: trunk/blender/source/blender/windowmanager/intern/wm_event_system.c
===================================================================
--- trunk/blender/source/blender/windowmanager/intern/wm_event_system.c	2013-08-26 22:18:34 UTC (rev 59541)
+++ trunk/blender/source/blender/windowmanager/intern/wm_event_system.c	2013-08-26 22:48:14 UTC (rev 59542)
@@ -85,6 +85,7 @@
 #  include "RNA_enum_types.h"
 #endif
 
+static void wm_notifier_clear(wmNotifier *note);
 static void update_tablet_data(wmWindow *win, wmEvent *event);
 
 static int wm_operator_call_internal(bContext *C, wmOperatorType *ot, PointerRNA *properties, ReportList *reports,
@@ -218,13 +219,20 @@
 			note_next = note->next;
 
 			if (note->reference == reference) {
-				BLI_remlink(&wm->queue, note);
-				MEM_freeN(note);
+				/* don't remove becauise this causes problems for #wm_event_do_notifiers
+				 * which may be looping on the data (deleting screens) */
+				wm_notifier_clear(note);
 			}
 		}
 	}
 }
 
+static void wm_notifier_clear(wmNotifier *note)
+{
+	/* NULL the entire notifier, only leaving (next, prev) members intact */
+	memset(((char *)note) + sizeof(Link), 0, sizeof(*note) - sizeof(Link));
+}
+
 static wmNotifier *wm_notifier_next(wmWindowManager *wm)
 {
 	wmNotifier *note = wm->queue.first;