Fix crash when closing master with children and grandchildren

In some cases, it is possible that the BufferPositionMap has
dangling pointers. We thus check whether the Buffer is loaded
before accessing it.

Fixes: #10766
(cherry picked from commit 4f50cbcfe405a840459be8682fd4c7521b235798)

diff --git a/src/Buffer.cpp b/src/Buffer.cpp
index e3cd6ac24ce1d0c77b61b590fee7eaca7e6a47f6..77c815196b3a5adbefd6e6560551e45c53e352f5 100644 (file)
--- a/src/Buffer.cpp
+++ b/src/Buffer.cpp
@@ -3583,8 +3583,12 @@ void Buffer::listMacroNames(MacroNameSet & macros) const
        // loop over children
        Impl::BufferPositionMap::iterator it = d->children_positions.begin();
        Impl::BufferPositionMap::iterator end = d->children_positions.end();
-       for (; it != end; ++it)
-               it->first->listMacroNames(macros);
+       for (; it != end; ++it) {
+               Buffer * child = const_cast<Buffer *>(it->first);
+               // The buffer might have been closed (see #10766).
+               if (theBufferList().isLoaded(child))
+                       child->listMacroNames(macros);
+       }
 
        // call parent
        Buffer const * const pbuf = d->parent();

diff --git a/status.22x b/status.22x
index 5753b32c5a42242892b0ff59132207b044f712c9..91a8a3ec63f99e9b3d402de01a1564dab4960ad3 100644 (file)
--- a/status.22x
+++ b/status.22x
@@ -78,6 +78,9 @@ What's new
 - Fix crash when closing master document with dirty child while Document
   Settings dialog is open (bug 9979).
 
+- Fix crash when closing master with children and grandchildren
+  (bug 10766).
+
 - Fix random crash when dissolving inset (bug 10667).
 
 - Fix potential crash when cursor enters an inset (bug 10691).