From aec012a0d9f7b02effd00f60b8527065a38baf18 Mon Sep 17 00:00:00 2001
From: David Capello <david@igarastudio.com>
Date: Thu, 3 Feb 2022 10:51:55 -0300
Subject: [PATCH] Fix crash using a nullptr m_pixelsMovement on
 MovingPixelsState::onCommitMouseMove() (fix #3161)

---
 src/app/ui/editor/delayed_mouse_move.cpp  | 6 ++++++
 src/app/ui/editor/delayed_mouse_move.h    | 5 +++++
 src/app/ui/editor/moving_pixels_state.cpp | 6 ++++++
 3 files changed, 17 insertions(+)

diff --git a/src/app/ui/editor/delayed_mouse_move.cpp b/src/app/ui/editor/delayed_mouse_move.cpp
index d9c44bbc8..d5b21129e 100644
--- a/src/app/ui/editor/delayed_mouse_move.cpp
+++ b/src/app/ui/editor/delayed_mouse_move.cpp
@@ -60,6 +60,12 @@ void DelayedMouseMove::onMouseUp(const ui::MouseMessage* msg)
   commitMouseMove();
 }
 
+void DelayedMouseMove::stopTimer()
+{
+  if (m_timer.isRunning())
+    m_timer.stop();
+}
+
 void DelayedMouseMove::commitMouseMove()
 {
   if (m_timer.isRunning())
diff --git a/src/app/ui/editor/delayed_mouse_move.h b/src/app/ui/editor/delayed_mouse_move.h
index 31dddc486..d42aede56 100644
--- a/src/app/ui/editor/delayed_mouse_move.h
+++ b/src/app/ui/editor/delayed_mouse_move.h
@@ -50,6 +50,11 @@ namespace app {
     bool onMouseMove(const ui::MouseMessage* msg);
     void onMouseUp(const ui::MouseMessage* msg);
 
+    // Forces stopping the timer so we don't receive a Tick event in
+    // case that we've just removed/delete some structure that is
+    // needed in onCommitMouseMove().
+    void stopTimer();
+
     const gfx::PointF& spritePos() const;
 
   private:
diff --git a/src/app/ui/editor/moving_pixels_state.cpp b/src/app/ui/editor/moving_pixels_state.cpp
index 3565b7294..5f9f926d9 100644
--- a/src/app/ui/editor/moving_pixels_state.cpp
+++ b/src/app/ui/editor/moving_pixels_state.cpp
@@ -391,6 +391,8 @@ bool MovingPixelsState::onMouseMove(Editor* editor, MouseMessage* msg)
 void MovingPixelsState::onCommitMouseMove(Editor* editor,
                                           const gfx::PointF& spritePos)
 {
+  ASSERT(m_pixelsMovement);
+
   if (!m_pixelsMovement->isDragging())
     return;
 
@@ -823,6 +825,10 @@ void MovingPixelsState::removeAsEditorObserver()
 
 void MovingPixelsState::removePixelsMovement()
 {
+  // Avoid receiving a onCommitMouseMove() message when
+  // m_pixelsMovement is already nullptr.
+  m_delayedMouseMove.stopTimer();
+
   m_pixelsMovement.reset();
   m_ctxConn.disconnect();
   m_opaqueConn.disconnect();