From 9e706a36a08dce0d6434cc3186961bcf813533c0 Mon Sep 17 00:00:00 2001
From: Friedrich Beckmann <friedrich.beckmann@gmx.de>
Date: Tue, 3 Oct 2017 21:59:51 +0200
Subject: Fix bug: crash - iterator corrupted by removing objects from
 container

On MacOS El Capitan with XCode 7.3 inkscape crashes when a
second item is drawn in the drawing area. The crash is
triggered by clearing the selection from the previous drawing
activity. The reason for the crash is that the iterator
is corrupted because during iteration the objects are removed
from the container.

This patch uses a safe way to remove items from the container and
going to the next iteration. Using this patch, inkscape does
not crash anymore.
---
 src/object-set.cpp | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

(limited to 'src/object-set.cpp')

diff --git a/src/object-set.cpp b/src/object-set.cpp
index 8fcb4215e..55da22bdf 100644
--- a/src/object-set.cpp
+++ b/src/object-set.cpp
@@ -104,14 +104,18 @@ void ObjectSet::_removeDescendantsFromSet(SPObject *object) {
     }
 }
 
-void ObjectSet::_remove(SPObject *object) {
+void ObjectSet::_disconnect(SPObject *object) {
     _releaseConnections[object].disconnect();
     _releaseConnections.erase(object);
-    _container.get<hashed>().erase(object);
     _remove3DBoxesRecursively(object);
     _releaseSignals(object);
 }
 
+void ObjectSet::_remove(SPObject *object) {
+    _disconnect(object);
+    _container.get<hashed>().erase(object);
+}
+
 void ObjectSet::_add(SPObject *object) {
     _releaseConnections[object] = object->connectRelease(sigc::hide_return(sigc::mem_fun(*this, &ObjectSet::remove)));
     _container.push_back(object);
@@ -120,8 +124,10 @@ void ObjectSet::_add(SPObject *object) {
 }
 
 void ObjectSet::_clear() {
-    for (auto object: _container) {
-        _remove(object);
+    MultiIndexContainer::iterator it = _container.begin();
+    while (it != _container.end()){
+        _disconnect(*it);
+        it = _container.erase(it);
     }
 }
 
-- 
cgit v1.2.3