d69c06
From c212cb8f32c02cf2fe691372b753d334f6e25d69 Mon Sep 17 00:00:00 2001
d69c06
From: Marek Kasik <mkasik@redhat.com>
d69c06
Date: Mon, 16 Dec 2013 18:04:14 +0100
d69c06
Subject: [PATCH 1/2] gdkwindow: Handle references in "update_windows" list
d69c06
 correctly
d69c06
d69c06
Since update_windows list is a static variable in GdkWindow.c which
d69c06
contains pointers to windows which needs to be updated, it can happen
d69c06
that it contains a pointer to a window even after quit from a gtk_main().
d69c06
If another gtk_main() is called in the same process it tries to process
d69c06
windows in the list which leads to a crash.
d69c06
Correct reference count handling of added windows prevents such applications
d69c06
from crash.
d69c06
d69c06
https://bugzilla.gnome.org/show_bug.cgi?id=711552
d69c06
---
d69c06
 gdk/gdkwindow.c | 19 ++++++++++++-------
d69c06
 1 file changed, 12 insertions(+), 7 deletions(-)
d69c06
d69c06
diff --git a/gdk/gdkwindow.c b/gdk/gdkwindow.c
d69c06
index f5f0339..0f33fb0 100644
d69c06
--- a/gdk/gdkwindow.c
d69c06
+++ b/gdk/gdkwindow.c
d69c06
@@ -5267,7 +5267,7 @@ gdk_window_add_update_window (GdkWindow *window)
d69c06
 	      prev = tmp;
d69c06
 	    }
d69c06
 	  /* here, tmp got advanced past all lower stacked siblings */
d69c06
-	  tmp = g_slist_prepend (tmp, window);
d69c06
+	  tmp = g_slist_prepend (tmp, g_object_ref (window));
d69c06
 	  if (prev)
d69c06
 	    prev->next = tmp;
d69c06
 	  else
d69c06
@@ -5280,7 +5280,7 @@ gdk_window_add_update_window (GdkWindow *window)
d69c06
        */
d69c06
       if (has_ancestor_in_list && gdk_window_is_ancestor (tmp->data, window))
d69c06
 	{
d69c06
-	  tmp = g_slist_prepend (tmp, window);
d69c06
+	  tmp = g_slist_prepend (tmp, g_object_ref (window));
d69c06
 
d69c06
 	  if (prev)
d69c06
 	    prev->next = tmp;
d69c06
@@ -5294,7 +5294,7 @@ gdk_window_add_update_window (GdkWindow *window)
d69c06
        */
d69c06
       if (! tmp->next && has_ancestor_in_list)
d69c06
 	{
d69c06
-	  tmp = g_slist_append (tmp, window);
d69c06
+	  tmp = g_slist_append (tmp, g_object_ref (window));
d69c06
 	  return;
d69c06
 	}
d69c06
 
d69c06
@@ -5305,13 +5305,20 @@ gdk_window_add_update_window (GdkWindow *window)
d69c06
    *  hierarchy than what is already in the list) or the list is
d69c06
    *  empty, prepend
d69c06
    */
d69c06
-  update_windows = g_slist_prepend (update_windows, window);
d69c06
+  update_windows = g_slist_prepend (update_windows, g_object_ref (window));
d69c06
 }
d69c06
 
d69c06
 static void
d69c06
 gdk_window_remove_update_window (GdkWindow *window)
d69c06
 {
d69c06
-  update_windows = g_slist_remove (update_windows, window);
d69c06
+  GSList *link;
d69c06
+
d69c06
+  link = g_slist_find (update_windows, window);
d69c06
+  if (link != NULL)
d69c06
+    {
d69c06
+      update_windows = g_slist_delete_link (update_windows, link);
d69c06
+      g_object_unref (window);
d69c06
+    }
d69c06
 }
d69c06
 
d69c06
 static gboolean
d69c06
@@ -5687,8 +5694,6 @@ gdk_window_process_all_updates (void)
d69c06
 
d69c06
   _gdk_windowing_before_process_all_updates ();
d69c06
 
d69c06
-  g_slist_foreach (old_update_windows, (GFunc)g_object_ref, NULL);
d69c06
-
d69c06
   while (tmp_list)
d69c06
     {
d69c06
       GdkWindowObject *private = (GdkWindowObject *)tmp_list->data;
d69c06
-- 
d69c06
1.8.4.2
d69c06