After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 704278 - Possible crash when destroying a tick callback
Possible crash when destroying a tick callback
Status: RESOLVED FIXED
Product: gtk+
Classification: Platform
Component: Widget: Other
3.9.x
Other Linux
: Normal normal
: ---
Assigned To: gtk-bugs
gtk-bugs
Depends on:
Blocks:
 
 
Reported: 2013-07-15 17:41 UTC by Mike Gorse
Modified: 2013-08-30 15:27 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
Proposed patch. (814 bytes, patch)
2013-07-15 17:47 UTC, Mike Gorse 		committed Details | Review

Description Mike Gorse 2013-07-15 17:41:48 UTC 
I'm noticing this when running make check in pygobject with G_SLICE=always-malloc.

gtk_widget_remove_tick_callbacks loops through the list of callbacks and calls destroy_tick_callback_info, which ultimately calls g_list_delete_link on the list that is being iterated over, so it is not safe to use the pointer to the original list after this in order to fetch the next item.
Comment 1 Mike Gorse 2013-07-15 17:47:29 UTC 
Created attachment 249231 [details] [review]
Proposed patch.

I'm assuming that it isn't possible to have multiple callbacks in the list with the same id. Otherwise it would be better to fetch l->next before destroying the callback and continue iterating.
Comment 2 Mike Gorse 2013-08-30 15:27:17 UTC 
Comment on attachment 249231 [details] [review]
Proposed patch.

Commit d7e07a.