From 06d0e78b0008b80a2b458552fc670d0c2892f4e0 Mon Sep 17 00:00:00 2001
From: John Preston <johnprestonmail@gmail.com>
Date: Mon, 3 Jun 2024 22:59:14 +0400
Subject: [PATCH] Fix a crash in forwarded sender avatars.

---
 .../SourceFiles/history/history_item_components.cpp | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/Telegram/SourceFiles/history/history_item_components.cpp b/Telegram/SourceFiles/history/history_item_components.cpp
index 69b514f537..60c29e7ee4 100644
--- a/Telegram/SourceFiles/history/history_item_components.cpp
+++ b/Telegram/SourceFiles/history/history_item_components.cpp
@@ -196,14 +196,19 @@ void HistoryMessageForwarded::create(
 			? originalSender->name()
 			: originalHiddenSenderInfo->name)
 	};
-	if (originalSender) {
-		context.session = &originalSender->owner().session();
+	if (const auto copy = originalSender) {
+		context.session = &copy->owner().session();
 		context.customEmojiRepaint = [=] {
-			originalSender->owner().requestItemRepaint(item);
+			// It is important to capture here originalSender by value,
+			// not capture the HistoryMessageForwarded* and read the
+			// originalSender field, because the components themselves
+			// get moved from place to place and the captured `this`
+			// pointer may become invalid, resulting in a crash.
+			copy->owner().requestItemRepaint(item);
 		};
 		phrase = Ui::Text::SingleCustomEmoji(
 			context.session->data().customEmojiManager().peerUserpicEmojiData(
-				originalSender,
+				copy,
 				st::fwdTextUserpicPadding));
 	}
 	if (!originalPostAuthor.isEmpty()) {