From: Noam Postavsky <npostavs@gmail.com>
Date: Mon, 25 May 2020 00:14:48 +0000 (-0400)
Subject: Fix segfault on closing frame with tooltip (Bug#41239)
X-Git-Tag: emacs-28.0.90~7286
X-Git-Url: http://git.eshelyaron.com/gitweb/?a=commitdiff_plain;h=3b65fb7658c2717457c033c6704cf3b007804226;p=emacs.git

Fix segfault on closing frame with tooltip (Bug#41239)

* src/gtkutil.c (xg_free_frame_widgets): Empty and unreference the
tooltip widget before destroying its label.
---

diff --git a/src/gtkutil.c b/src/gtkutil.c
index 681f86f51ba..5d1ce6de97c 100644
--- a/src/gtkutil.c
+++ b/src/gtkutil.c
@@ -1404,10 +1404,15 @@ xg_free_frame_widgets (struct frame *f)
       FRAME_X_WINDOW (f) = 0; /* Set to avoid XDestroyWindow in xterm.c */
       FRAME_X_RAW_DRAWABLE (f) = 0;
       FRAME_GTK_OUTER_WIDGET (f) = 0;
+      if (x->ttip_widget)
+        {
+          /* Remove ttip_lbl from ttip_widget's custom slot before
+             destroying it, to avoid double-free (Bug#41239).  */
+          gtk_tooltip_set_custom (x->ttip_widget, NULL);
+          g_object_unref (G_OBJECT (x->ttip_widget));
+        }
       if (x->ttip_lbl)
         gtk_widget_destroy (x->ttip_lbl);
-      if (x->ttip_widget)
-        g_object_unref (G_OBJECT (x->ttip_widget));
     }
 }