diff --git a/SOURCES/gtk-3.22.20-avoid-cellarea-crash.patch b/SOURCES/gtk-3.22.20-avoid-cellarea-crash.patch
new file mode 100644
index 0000000..64dd141
--- /dev/null
+++ b/SOURCES/gtk-3.22.20-avoid-cellarea-crash.patch
@@ -0,0 +1,40 @@
+From 4ba89f25b8a88616afc1915bdb4fb87d13efae6f Mon Sep 17 00:00:00 2001
+From: Benjamin Otte <otte@redhat.com>
+Date: Tue, 15 Jun 2021 19:34:37 +0200
+Subject: [PATCH] cellarea: Don't shrink area too much
+
+Do not compute rectangles with negative width/height. This avoids
+assertion failures further down when those rectangles were actually
+checked.
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1962215
+---
+ gtk/gtkcellarea.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/gtk/gtkcellarea.c b/gtk/gtkcellarea.c
+index 575e1c7fde..d1b3b1a279 100644
+--- a/gtk/gtkcellarea.c
++++ b/gtk/gtkcellarea.c
+@@ -3563,8 +3563,18 @@ gtk_cell_area_inner_cell_area (GtkCellArea *area,
+
+ *inner_area = *cell_area;
+
++ if (border.left + border.right > cell_area->width)
++ {
++ border.left = cell_area->width / 2;
++ border.right = (cell_area->width + 1) / 2;
++ }
+ inner_area->x += border.left;
+ inner_area->width -= border.left + border.right;
++ if (border.top + border.bottom > cell_area->height)
++ {
++ border.top = cell_area->height / 2;
++ border.bottom = (cell_area->height + 1) / 2;
++ }
+ inner_area->y += border.top;
+ inner_area->height -= border.top + border.bottom;
+ }
+--
+GitLab
+
diff --git a/SOURCES/gtk-3.22.20-fix-treeview-refcount.patch b/SOURCES/gtk-3.22.20-fix-treeview-refcount.patch
new file mode 100644
index 0000000..f7637d4
--- /dev/null
+++ b/SOURCES/gtk-3.22.20-fix-treeview-refcount.patch
@@ -0,0 +1,91 @@
+From d4f62b44d47e3dddfb57add4f1f76cab0297584d Mon Sep 17 00:00:00 2001
+From: Matthias Clasen <mclasen@redhat.com>
+Date: Fri, 11 Jun 2021 08:53:46 -0400
+Subject: [PATCH 1/2] a11y: Fix ref counting in tree views
+
+GtkContainerCellAccessible wasn't unsetting accessible
+parents. Fix that.
+
+By itself, this doesn't help for freeing a memory leak,
+since AtkObject keeps a ref on its parent, so we never
+free the GtkContainerCellAccessible as long as it has children.
+---
+ gtk/a11y/gtkcontainercellaccessible.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/gtk/a11y/gtkcontainercellaccessible.c b/gtk/a11y/gtkcontainercellaccessible.c
+index a756e3cadf..a40446fb47 100644
+--- a/gtk/a11y/gtkcontainercellaccessible.c
++++ b/gtk/a11y/gtkcontainercellaccessible.c
+@@ -30,12 +30,19 @@ struct _GtkContainerCellAccessiblePrivate
+ G_DEFINE_TYPE_WITH_PRIVATE (GtkContainerCellAccessible, gtk_container_cell_accessible, GTK_TYPE_CELL_ACCESSIBLE)
+
+
++static void
++unset_child (gpointer child)
++{
++ atk_object_set_parent (ATK_OBJECT (child), NULL);
++ g_object_unref (child);
++}
++
+ static void
+ gtk_container_cell_accessible_finalize (GObject *obj)
+ {
+ GtkContainerCellAccessible *container = GTK_CONTAINER_CELL_ACCESSIBLE (obj);
+
+- g_list_free_full (container->priv->children, g_object_unref);
++ g_list_free_full (container->priv->children, unset_child);
+
+ G_OBJECT_CLASS (gtk_container_cell_accessible_parent_class)->finalize (obj);
+ }
+@@ -157,6 +164,7 @@ gtk_container_cell_accessible_remove_child (GtkContainerCellAccessible *containe
+ g_return_if_fail (GTK_IS_CELL_ACCESSIBLE (child));
+ g_return_if_fail (container->priv->n_children > 0);
+
++ atk_object_set_parent (ATK_OBJECT (child), NULL);
+ container->priv->children = g_list_remove (container->priv->children, child);
+ container->priv->n_children--;
+
+--
+GitLab
+
+
+From 21f8098261486417db371b202bc0494c12017468 Mon Sep 17 00:00:00 2001
+From: Matthias Clasen <mclasen@redhat.com>
+Date: Fri, 11 Jun 2021 08:55:48 -0400
+Subject: [PATCH 2/2] a11y: Plug a memory leak with treeviews
+
+We need to explicitly remove the children from
+a GtkContainerCellAccessible, since they otherwise
+keep the parent alive.
+
+Fixes: #3981
+---
+ gtk/a11y/gtktreeviewaccessible.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/gtk/a11y/gtktreeviewaccessible.c b/gtk/a11y/gtktreeviewaccessible.c
+index adad462064..c1a2097a1e 100644
+--- a/gtk/a11y/gtktreeviewaccessible.c
++++ b/gtk/a11y/gtktreeviewaccessible.c
+@@ -104,6 +104,17 @@ static void
+ cell_info_free (GtkTreeViewAccessibleCellInfo *cell_info)
+ {
+ gtk_accessible_set_widget (GTK_ACCESSIBLE (cell_info->cell), NULL);
++ if (GTK_IS_CONTAINER_CELL_ACCESSIBLE (cell_info->cell))
++ {
++ GList *children;
++
++ while ((children = gtk_container_cell_accessible_get_children (GTK_CONTAINER_CELL_ACCESSIBLE (cell_info->cell))) != NULL)
++ {
++ GtkCellAccessible *child = children->data;
++ gtk_container_cell_accessible_remove_child (GTK_CONTAINER_CELL_ACCESSIBLE (cell_info->cell), child);
++ }
++ }
++
+ g_object_unref (cell_info->cell);
+
+ g_free (cell_info);
+--
+GitLab
+
diff --git a/SOURCES/gtk-3.22.20-fix-treeview-refcount2.patch b/SOURCES/gtk-3.22.20-fix-treeview-refcount2.patch
new file mode 100644
index 0000000..f2dc206
--- /dev/null
+++ b/SOURCES/gtk-3.22.20-fix-treeview-refcount2.patch
@@ -0,0 +1,27 @@
+From cc977be580b9a7c2683810fe36fe485ee8583ec0 Mon Sep 17 00:00:00 2001
+From: Matthias Clasen <mclasen@redhat.com>
+Date: Fri, 11 Feb 2022 18:39:55 -0500
+Subject: [PATCH] Fix a leak of cell accessibles
+
+gtk_container_cell_accessible_add_child is transfer none,
+so we need to drop the reference we hold, otherwise it
+leaks.
+---
+ gtk/a11y/gtktreeviewaccessible.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/gtk/a11y/gtktreeviewaccessible.c b/gtk/a11y/gtktreeviewaccessible.c
+index c1a2097a1e..c2b7e8add0 100644
+--- a/gtk/a11y/gtktreeviewaccessible.c
++++ b/gtk/a11y/gtktreeviewaccessible.c
+@@ -413,6 +413,7 @@ create_cell_accessible (GtkTreeView *treeview,
+ {
+ cell = create_cell_accessible_for_renderer (l->data, GTK_WIDGET (treeview), ATK_OBJECT (container));
+ gtk_container_cell_accessible_add_child (container, cell);
++ g_object_unref (cell);
+ }
+
+ cell = GTK_CELL_ACCESSIBLE (container);
+--
+GitLab
+
diff --git a/SPECS/gtk3.spec b/SPECS/gtk3.spec
index d8e2241..806947a 100644
--- a/SPECS/gtk3.spec
+++ b/SPECS/gtk3.spec
@@ -21,7 +21,7 @@
Name: gtk3
Version: 3.22.30
-Release: 6%{?dist}
+Release: 8%{?dist}
Summary: GTK+ graphical user interface library
License: LGPLv2+
@@ -48,6 +48,11 @@ Patch22: 0001-gtk-icon-theme-Handle-lack-of-SVG-loader-gracefully.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=1717000
Patch23: 0001-gdkseatdefault-Unref-removed-slave-devices.patch
Patch24: 0002-gdk-x11-Properly-unref-removed-device-in-XI2-device-.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1965195
+Patch25: gtk-3.22.20-fix-treeview-refcount.patch
+Patch26: gtk-3.22.20-fix-treeview-refcount2.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1962215
+Patch27: gtk-3.22.20-avoid-cellarea-crash.patch
BuildRequires: pkgconfig(atk) >= %{atk_version}
BuildRequires: pkgconfig(atk-bridge-2.0)
@@ -187,6 +192,9 @@ the functionality of the installed %{name} package.
%patch22 -p1
%patch23 -p1
%patch24 -p1
+%patch25 -p1
+%patch26 -p1
+%patch27 -p1
cp %{SOURCE1} po/
@@ -377,6 +385,13 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
%{_datadir}/installed-tests
%changelog
+* Tue Feb 15 2022 David King <dking@redhat.com> - 3.22.30-8
+- Further treeview a11y refcount fix (#1965195)
+
+* Mon Jan 17 2022 David King <dking@redhat.com> - 3.22.30-7
+- Fix treeview a11y refcounting (#1965195)
+- Avoid cellarea resize crash (#1962215)
+
* Fri Oct 09 2020 Ray Strode <rstrode@redhat.com> - 3.22.30-6
- Fix leak on VT switch
Resolves: #1882574