From 3b65fb7658c2717457c033c6704cf3b007804226 Mon Sep 17 00:00:00 2001 From: Noam Postavsky Date: Sun, 24 May 2020 20:14:48 -0400 Subject: [PATCH] Fix segfault on closing frame with tooltip (Bug#41239) * src/gtkutil.c (xg_free_frame_widgets): Empty and unreference the tooltip widget before destroying its label. --- src/gtkutil.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/gtkutil.c b/src/gtkutil.c index 681f86f51ba..5d1ce6de97c 100644 --- a/src/gtkutil.c +++ b/src/gtkutil.c @@ -1404,10 +1404,15 @@ xg_free_frame_widgets (struct frame *f) FRAME_X_WINDOW (f) = 0; /* Set to avoid XDestroyWindow in xterm.c */ FRAME_X_RAW_DRAWABLE (f) = 0; FRAME_GTK_OUTER_WIDGET (f) = 0; + if (x->ttip_widget) + { + /* Remove ttip_lbl from ttip_widget's custom slot before + destroying it, to avoid double-free (Bug#41239). */ + gtk_tooltip_set_custom (x->ttip_widget, NULL); + g_object_unref (G_OBJECT (x->ttip_widget)); + } if (x->ttip_lbl) gtk_widget_destroy (x->ttip_lbl); - if (x->ttip_widget) - g_object_unref (G_OBJECT (x->ttip_widget)); } } -- 2.39.5