From 8ea4b5f23222564dc423ec97930d1d18659d6263 Mon Sep 17 00:00:00 2001 From: mjwybrow Date: Wed, 2 Jan 2008 06:04:28 +0000 Subject: [PATCH] 2008-01-02 Michael Wybrow * src/sp-item.cpp: Fix bug #167898, where a triggered document update prior to connectoor rerouting could attempt to access a deleted object clip_ref during ungrouping, causing a crash. --- src/sp-item.cpp | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/src/sp-item.cpp b/src/sp-item.cpp index ec168f03f..f064b246c 100644 --- a/src/sp-item.cpp +++ b/src/sp-item.cpp @@ -404,6 +404,14 @@ sp_item_release(SPObject *object) item->_clip_ref_connection.disconnect(); item->_mask_ref_connection.disconnect(); + // Note: do this here before the clip_ref is deleted, since calling + // sp_document_ensure_up_to_date for triggered routing may reference + // the deleted clip_ref. + if (item->avoidRef) { + delete item->avoidRef; + item->avoidRef = NULL; + } + if (item->clip_ref) { item->clip_ref->detach(); delete item->clip_ref; @@ -416,11 +424,6 @@ sp_item_release(SPObject *object) item->mask_ref = NULL; } - if (item->avoidRef) { - delete item->avoidRef; - item->avoidRef = NULL; - } - if (((SPObjectClass *) (parent_class))->release) { ((SPObjectClass *) parent_class)->release(object); } -- 2.30.2