fix heap-use-after-free on "Unlink Clone"

Reverts part of 6e5d89bf9595

2 files changed, 4 insertions, 0 deletions

diff --git a/src/object/sp-tref.cpp b/src/object/sp-tref.cpp
index 60ce63639..a99f8686f 100644
--- a/src/object/sp-tref.cpp
+++ b/src/object/sp-tref.cpp
@@ -483,6 +483,7 @@ sp_tref_convert_to_tspan(SPObject *obj)
             new_tspan->updateRepr();
 
             // Hold onto our SPObject and repr for now.
+            sp_object_ref(tref);
             Inkscape::GC::anchor(tref_repr);
 
             // Remove ourselves, not propagating delete events to avoid a
@@ -495,6 +496,7 @@ sp_tref_convert_to_tspan(SPObject *obj)
 
             // Establish the succession and let go of our object.
             tref->setSuccessor(new_tspan);
+            sp_object_unref(tref);
         }
     }
     ////////////////////
diff --git a/src/object/sp-use.cpp b/src/object/sp-use.cpp
index c451b4e91..6fb8a206c 100644
--- a/src/object/sp-use.cpp
+++ b/src/object/sp-use.cpp
@@ -699,6 +699,7 @@ SPItem *SPUse::unlink() {
     unlinked->updateRepr();
 
     // Hold onto our SPObject and repr for now.
+    sp_object_ref(this);
     Inkscape::GC::anchor(repr);
 
     // Remove ourselves, not propagating delete events to avoid a
@@ -718,6 +719,7 @@ SPItem *SPUse::unlink() {
 
     // Establish the succession and let go of our object.
     this->setSuccessor(unlinked);
+    sp_object_unref(this);
 
     SPItem *item = dynamic_cast<SPItem *>(unlinked);
     g_assert(item != nullptr);