Fix crash when closing master with children and grandchildren

In some cases, it is possible that the BufferPositionMap has
dangling pointers. We thus check whether the Buffer is loaded
before accessing it.

Fixes: #10766
(cherry picked from commit 4f50cbcfe4)

src/Buffer.cpp

@@ -3583,8 +3583,12 @@ void Buffer::listMacroNames(MacroNameSet & macros) const
 	// loop over children
 	Impl::BufferPositionMap::iterator it = d->children_positions.begin();
 	Impl::BufferPositionMap::iterator end = d->children_positions.end();
-	for (; it != end; ++it)
-		it->first->listMacroNames(macros);
+	for (; it != end; ++it) {
+		Buffer * child = const_cast<Buffer *>(it->first);
+		// The buffer might have been closed (see #10766).
+		if (theBufferList().isLoaded(child))
+			child->listMacroNames(macros);
+	}
 
 	// call parent
 	Buffer const * const pbuf = d->parent();

status.22x

@@ -78,6 +78,9 @@ What's new
 - Fix crash when closing master document with dirty child while Document
   Settings dialog is open (bug 9979).
 
+- Fix crash when closing master with children and grandchildren
+  (bug 10766).
+
 - Fix random crash when dissolving inset (bug 10667).
 
 - Fix potential crash when cursor enters an inset (bug 10691).