From: mjwybrow <mjwybrow@users.sourceforge.net>
Date: Wed, 2 Jan 2008 06:04:28 +0000 (+0000)
Subject: 2008-01-02  Michael Wybrow  <mjwybrow@users.sourceforge.net>
X-Git-Url: https://git.tokkee.org/?a=commitdiff_plain;h=8ea4b5f23222564dc423ec97930d1d18659d6263;p=inkscape.git

2008-01-02  Michael Wybrow  <mjwybrow@users.sourceforge.net>

    * src/sp-item.cpp: Fix bug #167898, where a triggered document update
      prior to connectoor rerouting could attempt to access a deleted
      object clip_ref during ungrouping, causing a crash.
---

diff --git a/src/sp-item.cpp b/src/sp-item.cpp
index ec168f03f..f064b246c 100644
--- a/src/sp-item.cpp
+++ b/src/sp-item.cpp
@@ -404,6 +404,14 @@ sp_item_release(SPObject *object)
     item->_clip_ref_connection.disconnect();
     item->_mask_ref_connection.disconnect();
 
+    // Note: do this here before the clip_ref is deleted, since calling 
+    // sp_document_ensure_up_to_date for triggered routing may reference 
+    // the deleted clip_ref.
+    if (item->avoidRef) {
+        delete item->avoidRef;
+        item->avoidRef = NULL;
+    }
+
     if (item->clip_ref) {
         item->clip_ref->detach();
         delete item->clip_ref;
@@ -416,11 +424,6 @@ sp_item_release(SPObject *object)
         item->mask_ref = NULL;
     }
 
-    if (item->avoidRef) {
-        delete item->avoidRef;
-        item->avoidRef = NULL;
-    }
-
     if (((SPObjectClass *) (parent_class))->release) {
         ((SPObjectClass *) parent_class)->release(object);
     }