[vte/wip/sixels: 18/111] sixels: Ring: Don't leave iterator dangling after delete during traverse

[Christian Persch <chpe src gnome org>]

commit daa24be0763a29a04c0ab790998846f0c03dcdba
Author: Hans Petter Jansson <hpj cl no>
Date:   Sat Aug 8 20:42:48 2020 +0200

    sixels: Ring: Don't leave iterator dangling after delete during traverse
    
    This was causing crashes when appending an image that completely
    covered an existing one.

 src/ring.cc | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)
---
diff --git a/src/ring.cc b/src/ring.cc
index c1ac3844..8cd473db 100644
--- a/src/ring.cc
+++ b/src/ring.cc
@@ -1534,7 +1534,7 @@ Ring::append_image (cairo_surface_t *surface, gint pixelwidth, gint pixelheight,
        char_height = pixelwidth / height;
 
        /* composition */
-       for (auto it = m_image_map->lower_bound (top); it != m_image_map->end (); ++it) {
+       for (auto it = m_image_map->lower_bound (top); it != m_image_map->end (); ) {
                image_object *current = it->second;
 
                /* Combine two images if one's area includes another's area */
@@ -1549,12 +1549,15 @@ Ring::append_image (cairo_surface_t *surface, gint pixelwidth, gint pixelheight,
                         *  | :.........:  |
                         *  +--------------+
                         */
-                       m_image_map->erase (image->get_bottom ());
                        if (current->is_freezed())
                                m_image_offscreen_resource_counter -= current->resource_size ();
                        else
                                m_image_onscreen_resource_counter -= current->resource_size ();
+
+                        /* We must advance the iterator before erasure */
+                       m_image_map->erase (it++);
                        delete current;
+                        continue;
                } else if (current->includes (image)) {
                        /*
                         * Copy new image to current image's sub-area.
@@ -1612,6 +1615,8 @@ Ring::append_image (cairo_surface_t *surface, gint pixelwidth, gint pixelheight,
                        delete current;
                        goto end;
                }
+
+                it++;
        }
 
        /*