GNU bug report logs - #41239
GTK builds crashing in XTread_socket after deleting a frame

Previous Next

Full log

View this message in rfc822 format

From: Noam Postavsky <npostavs <at> gmail.com>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: rudalics <at> gmx.at, 41239 <at> debbugs.gnu.org
Subject: bug#41239: GTK builds crashing in XTread_socket after deleting a frame
Date: Thu, 21 May 2020 21:23:49 -0400

Eli Zaretskii <eliz <at> gnu.org> writes:

> Can someone spot where we pass some wrong parameters to GTK/GIO
> functions in xg_prepare_tooltip?  Or something we do wrong in
> xg_free_frame_widgets?

The patch below seems to fix it.

--- i/src/gtkutil.c
+++ w/src/gtkutil.c
@@ -1404,10 +1404,15 @@ xg_free_frame_widgets (struct frame *f)
       FRAME_X_WINDOW (f) = 0; /* Set to avoid XDestroyWindow in xterm.c */
       FRAME_X_RAW_DRAWABLE (f) = 0;
       FRAME_GTK_OUTER_WIDGET (f) = 0;
+      if (x->ttip_widget)
+        {
+          /* Remove ttip_lbl from ttip_widget's custom slot before
+             destroying it, to avoid double-free (Bug#41239).  */
+          gtk_tooltip_set_custom (x->ttip_widget, NULL);
+          g_object_unref (G_OBJECT (x->ttip_widget));
+        }
       if (x->ttip_lbl)
         gtk_widget_destroy (x->ttip_lbl);
-      if (x->ttip_widget)
-        g_object_unref (G_OBJECT (x->ttip_widget));
     }
 }

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.