2008-01-02 Michael Wybrow <mjwybrow@users.sourceforge.net>

    * src/sp-item.cpp: Fix bug #167898, where a triggered document update
      prior to connectoor rerouting could attempt to access a deleted
      object clip_ref during ungrouping, causing a crash.

diff --git a/src/sp-item.cpp b/src/sp-item.cpp
index ec168f03ff969771ff596d78fca4596d0a43cb4c..f064b246c619e7e88c61ea68d404b9f71925c9a7 100644 (file)
--- a/src/sp-item.cpp
+++ b/src/sp-item.cpp
@@ -404,6 +404,14 @@ sp_item_release(SPObject *object)
     item->_clip_ref_connection.disconnect();
     item->_mask_ref_connection.disconnect();
 
+    // Note: do this here before the clip_ref is deleted, since calling 
+    // sp_document_ensure_up_to_date for triggered routing may reference 
+    // the deleted clip_ref.
+    if (item->avoidRef) {
+        delete item->avoidRef;
+        item->avoidRef = NULL;
+    }
+
     if (item->clip_ref) {
         item->clip_ref->detach();
         delete item->clip_ref;
@@ -416,11 +424,6 @@ sp_item_release(SPObject *object)
         item->mask_ref = NULL;
     }
 
-    if (item->avoidRef) {
-        delete item->avoidRef;
-        item->avoidRef = NULL;
-    }
-
     if (((SPObjectClass *) (parent_class))->release) {
         ((SPObjectClass *) parent_class)->release(object);
     }