From e3d4b96ba748c3945d66d018531bb6de86a9c622 Mon Sep 17 00:00:00 2001
From: PouleyKetchoupp <pouleyketchoup@gmail.com>
Date: Tue, 22 Oct 2019 16:28:11 +0200
Subject: [PATCH] Fixed crashes when renaming a state in
 AnimationNodeStateMachineEditor

Recursive calls to Control::_modal_stack_remove could cause a crash because of the list element not being invalidated while being erased from the list.

It happens in the state machine case by hiding a line edit control when it loses focus.

Fixes #23808
---
 scene/gui/control.cpp   | 6 ++++--
 scene/main/viewport.cpp | 1 -
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/scene/gui/control.cpp b/scene/gui/control.cpp
index fafbcf0c556..8b4d5d49807 100644
--- a/scene/gui/control.cpp
+++ b/scene/gui/control.cpp
@@ -2221,9 +2221,11 @@ void Control::_modal_stack_remove() {
 	if (!data.MI)
 		return;
 
-	get_viewport()->_gui_remove_from_modal_stack(data.MI, data.modal_prev_focus_owner);
-
+	List<Control *>::Element *element = data.MI;
 	data.MI = NULL;
+
+	get_viewport()->_gui_remove_from_modal_stack(element, data.modal_prev_focus_owner);
+
 	data.modal_prev_focus_owner = 0;
 }
 
diff --git a/scene/main/viewport.cpp b/scene/main/viewport.cpp
index 52ef2253643..95536bbb235 100644
--- a/scene/main/viewport.cpp
+++ b/scene/main/viewport.cpp
@@ -2374,7 +2374,6 @@ void Viewport::_gui_remove_from_modal_stack(List<Control *>::Element *MI, Object
 	List<Control *>::Element *next = MI->next();
 
 	gui.modal_stack.erase(MI);
-	MI = NULL;
 
 	if (p_prev_focus_owner) {