From 56db09e2fda694ff2b171913d494c1ab8e20d398 Mon Sep 17 00:00:00 2001
From: Jacques Lucke <jacques@blender.org>
Date: Thu, 17 Jun 2021 13:40:08 +0200
Subject: [PATCH] Geometry Nodes: fix ownership issue in spline to points
 conversion

Previously, `VArray_For_SplineToPoint` did not take ownership of the
virtual array leading to use-after-free errors.
---
 .../blenkernel/intern/geometry_component_curve.cc    | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/source/blender/blenkernel/intern/geometry_component_curve.cc b/source/blender/blenkernel/intern/geometry_component_curve.cc
index de8dc355557..bc85305fea8 100644
--- a/source/blender/blenkernel/intern/geometry_component_curve.cc
+++ b/source/blender/blenkernel/intern/geometry_component_curve.cc
@@ -240,14 +240,18 @@ static GVArrayPtr adapt_curve_domain_point_to_spline(const CurveEval &curve, GVA
  * unless it is necessary (in that case the materialize functions will be called).
  */
 template<typename T> class VArray_For_SplineToPoint final : public VArray<T> {
+  GVArrayPtr original_varray_;
   /* Store existing data materialized if it was not already a span. This is expected
    * to be worth it because a single spline's value will likely be accessed many times. */
-  VArray_Span<T> original_data_;
+  fn::GVArray_Span<T> original_data_;
   Array<int> offsets_;
 
  public:
-  VArray_For_SplineToPoint(const VArray<T> &original_varray, Array<int> offsets)
-      : VArray<T>(offsets.last()), original_data_(original_varray), offsets_(std::move(offsets))
+  VArray_For_SplineToPoint(GVArrayPtr original_varray, Array<int> offsets)
+      : VArray<T>(offsets.last()),
+        original_varray_(std::move(original_varray)),
+        original_data_(*original_varray_),
+        offsets_(std::move(offsets))
   {
   }
 
@@ -309,7 +313,7 @@ static GVArrayPtr adapt_curve_domain_spline_to_point(const CurveEval &curve, GVA
 
     Array<int> offsets = curve.control_point_offsets();
     new_varray = std::make_unique<fn::GVArray_For_EmbeddedVArray<T, VArray_For_SplineToPoint<T>>>(
-        offsets.last(), *varray->typed<T>(), std::move(offsets));
+        offsets.last(), std::move(varray), std::move(offsets));
   });
   return new_varray;
 }