From 2f54bcaf37dd54708f5881ea390da4131e3ea654 Mon Sep 17 00:00:00 2001
From: David Capello <david@igara.com>
Date: Wed, 31 May 2023 14:57:37 -0300
Subject: [PATCH] Fix crash (using freed memory) changing Screen/UI
 Scaling/Theme for a very specific ColorBar/PaletteView case (fix #3906)

We were able to reproduce this putting the black border of the
ColorBar's PaletteView touching its viewport, and changing from Screen
Scaling=200% & UI Scaling=100% to Screen Scaling=100% & UI
Scaling=200% (with the memory sanitizer on).
---
 src/ui/widget.cpp | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/ui/widget.cpp b/src/ui/widget.cpp
index c861f7043..917204c35 100644
--- a/src/ui/widget.cpp
+++ b/src/ui/widget.cpp
@@ -1696,7 +1696,12 @@ void Widget::onBroadcastMouseMessage(const gfx::Point& screenPos,
 
 void Widget::onInitTheme(InitThemeEvent& ev)
 {
-  for (auto child : children())
+  // Create a copy of the children list and iterate it, just in case a
+  // initTheme() modifies this list (e.g. this can happen in some
+  // strange cases with viewports, where scrollbars are added/removed
+  // while we init the theme if the UI scale changes).
+  auto children = m_children;
+  for (auto child : children)
     child->initTheme();
 
   if (m_theme) {