From 72af60c22e8964409ed0856c69dd02548c11ee05 Mon Sep 17 00:00:00 2001 From: wmayer Date: Mon, 24 Oct 2022 16:49:29 +0200 Subject: [PATCH] App: fixes issue #7628: Crash after creating Sketch for Body The problem is that inside Transaction::addObjectNew() a transaction object is deleted before removing it from the container. When deleting the corresponding transactional object (i.e. a DocumentObject or ViewProvider) it can happen that it e.g. calls Transaction::addOrRemoveProperty() that now finds the dangling pointer in the container. The safe way is to first remove the object from the container before deleting it. --- src/App/Transactions.cpp | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/App/Transactions.cpp b/src/App/Transactions.cpp index 4ab3334b56..2f31fa4c08 100644 --- a/src/App/Transactions.cpp +++ b/src/App/Transactions.cpp @@ -194,9 +194,12 @@ void Transaction::addObjectNew(TransactionalObject *Obj) auto pos = index.find(Obj); if (pos != index.end()) { if (pos->second->status == TransactionObject::Del) { - delete pos->second; - delete pos->first; + // first remove the item from the container before deleting it + auto second = pos->second; + auto first = pos->first; index.erase(pos); + delete second; + delete first; } else { pos->second->status = TransactionObject::New;