To reproduce:
- Open file from https://developer.blender.org/T66707#718639
- Enter Armature edit mode
- Delete bone host.antenna.base
- Crash caused by heap-use-after-free
Trace from ASAN:
==23269==ERROR: AddressSanitizer: heap-use-after-free on address 0x6190028db6e0 at pc 0x5576bf071c63 bp 0x7fff843ac020 sp 0x7fff843ac010
READ of size 1 at 0x6190028db6e0 thread T0
#0 0x5576bf071c62 in BLI_findstring /home/clement/Blender/blender/source/blender/blenlib/intern/listbase.c:649
#1 0x5576c04bc7f1 in ED_armature_ebone_find_name /home/clement/Blender/blender/source/blender/editors/armature/armature_utils.c:270
#2 0x5576c049d047 in armature_delete_ebone_cb /home/clement/Blender/blender/source/blender/editors/armature/armature_edit.c:1417
#3 0x5576be8dd96b in BKE_pose_channels_remove /home/clement/Blender/blender/source/blender/blenkernel/intern/action.c:785
#4 0x5576c049d44f in armature_delete_selected_exec /home/clement/Blender/blender/source/blender/editors/armature/armature_edit.c:1444
#5 0x5576bf8eb1a5 in wm_operator_invoke /home/clement/Blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1450
#6 0x5576bf8ec1d3 in wm_operator_call_internal /home/clement/Blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1664
#7 0x5576bf8ec3fa in WM_operator_name_call_ptr /home/clement/Blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1699
#8 0x5576c032a5fd in ui_apply_but_funcs_after /home/clement/Blender/blender/source/blender/editors/interface/interface_handlers.c:827
#9 0x5576c0372123 in ui_popup_handler /home/clement/Blender/blender/source/blender/editors/interface/interface_handlers.c:10264
#10 0x5576bf8e51fe in wm_handler_ui_call /home/clement/Blender/blender/source/blender/windowmanager/intern/wm_event_system.c:623
#11 0x5576bf8f1fae in wm_handlers_do_intern /home/clement/Blender/blender/source/blender/windowmanager/intern/wm_event_system.c:2699
#12 0x5576bf8f3e05 in wm_handlers_do /home/clement/Blender/blender/source/blender/windowmanager/intern/wm_event_system.c:2945
#13 0x5576bf8f677e in wm_event_do_handlers /home/clement/Blender/blender/source/blender/windowmanager/intern/wm_event_system.c:3319
#14 0x5576bf8d7185 in WM_main /home/clement/Blender/blender/source/blender/windowmanager/intern/wm.c:417
#15 0x5576be7f78db in main /home/clement/Blender/blender/source/creator/creator.c:500
#16 0x7f62dab0cee2 in __libc_start_main (/usr/lib/libc.so.6+0x26ee2)
#17 0x5576be7f6e2d in _start (/home/clement/Blender/build_linux/bin/blender+0x2392e2d)
0x6190028db6e0 is located 96 bytes inside of 960-byte region [0x6190028db680,0x6190028dba40)
freed by thread T0 here:
#0 0x7f62dd75c6c0 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122
#1 0x5576bf2b39df in rem_memblock /home/clement/Blender/blender/intern/guardedalloc/intern/mallocn_guarded_impl.c:1094
#2 0x5576bf2b30c3 in MEM_guarded_freeN /home/clement/Blender/blender/intern/guardedalloc/intern/mallocn_guarded_impl.c:980
#3 0x5576bf06d299 in BLI_freelinkN /home/clement/Blender/blender/source/blender/blenlib/intern/listbase.c:291
#4 0x5576be8dd569 in BKE_pose_channels_remove /home/clement/Blender/blender/source/blender/blenkernel/intern/action.c:755
#5 0x5576c049d44f in armature_delete_selected_exec /home/clement/Blender/blender/source/blender/editors/armature/armature_edit.c:1444
#6 0x5576bf8eb1a5 in wm_operator_invoke /home/clement/Blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1450
#7 0x5576bf8ec1d3 in wm_operator_call_internal /home/clement/Blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1664
#8 0x5576bf8ec3fa in WM_operator_name_call_ptr /home/clement/Blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1699
#9 0x5576c032a5fd in ui_apply_but_funcs_after /home/clement/Blender/blender/source/blender/editors/interface/interface_handlers.c:827
#10 0x5576c0372123 in ui_popup_handler /home/clement/Blender/blender/source/blender/editors/interface/interface_handlers.c:10264
#11 0x5576bf8e51fe in wm_handler_ui_call /home/clement/Blender/blender/source/blender/windowmanager/intern/wm_event_system.c:623
#12 0x5576bf8f1fae in wm_handlers_do_intern /home/clement/Blender/blender/source/blender/windowmanager/intern/wm_event_system.c:2699
#13 0x5576bf8f3e05 in wm_handlers_do /home/clement/Blender/blender/source/blender/windowmanager/intern/wm_event_system.c:2945
#14 0x5576bf8f677e in wm_event_do_handlers /home/clement/Blender/blender/source/blender/windowmanager/intern/wm_event_system.c:3319
#15 0x5576bf8d7185 in WM_main /home/clement/Blender/blender/source/blender/windowmanager/intern/wm.c:417
#16 0x5576be7f78db in main /home/clement/Blender/blender/source/creator/creator.c:500
#17 0x7f62dab0cee2 in __libc_start_main (/usr/lib/libc.so.6+0x26ee2)