Fix crash when changing and using between layer and other brushes in

dyntopo

Layer brush would not invalidate the layer_disp arrays in dyntopo mode,
checking only for the existence of the array. This means that if a tool
resized the node due to topology changes, the layer brush code could
index (and write!) out of bounds in the array. Solution is to invalidate
the layer data prior to each stroke in dyntopo.

source/blender/blenkernel/BKE_pbvh.h

@@ -71,6 +71,7 @@ void BKE_pbvh_build_bmesh(PBVH *bvh, struct BMesh *bm, int smooth_shading,
                           struct BMLog *log);
 
 void BKE_pbvh_free(PBVH *bvh);
+void BKE_pbvh_free_layer_disp(PBVH *bvh);
 
 /* Hierarchical Search in the BVH, two methods:
  * - for each hit calling a callback

source/blender/blenkernel/intern/pbvh.c

@@ -626,6 +626,13 @@ void BKE_pbvh_free(PBVH *bvh)
 	MEM_freeN(bvh);
 }
 
+void BKE_pbvh_free_layer_disp(PBVH *bvh)
+{
+	int i;
+	for (i = 0; i < bvh->totnode; ++i)
+		BKE_pbvh_node_layer_disp_free(&bvh->nodes[i]);
+}
+
 static void pbvh_iter_begin(PBVHIter *iter, PBVH *bvh, BKE_pbvh_SearchCallback scb, void *search_data)
 {
 	iter->bvh = bvh;

source/blender/editors/sculpt_paint/sculpt.c

@@ -3960,6 +3960,12 @@ static void sculpt_update_cache_invariants(bContext *C, Sculpt *sd, SculptSessio
 				}
 			}
 		}
+
+		if (ss->bm) {
+			/* Free any remaining layer displacements from nodes. If not and topology changes
+			 * from using another tool, then next layer toolstroke can access past disp array bounds */
+			BKE_pbvh_free_layer_disp(ss->pbvh);
+		}
 	}
 
 	/* Make copies of the mesh vertex locations and normals for some tools */