From: Andrea Azzarone <azzaronea@gmail.com>
Date: Fri, 16 Nov 2018 18:31:56 +0000 (+0000)
Subject: dash: destroy items's child before tooltip
X-Git-Tag: archive/raspbian/50.5-1+rpi1~1^2~897^2~1^2~32
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=ff2fbf5ae40561b403b721e932d1bc5492532156;p=gnome-shell.git

dash: destroy items's child before tooltip

Destroy the DashItemContainer's child from the same handler as the tooltip. This
will prevent invalid reads when the item is destroyed while its quicklist is
still open.

Fixes: https://gitlab.gnome.org/GNOME/gnome-shell/issues/781
---

diff --git a/js/ui/dash.js b/js/ui/dash.js
index 60d030941..ce970a610 100644
--- a/js/ui/dash.js
+++ b/js/ui/dash.js
@@ -55,6 +55,8 @@ var DashItemContainer = new Lang.Class({
         this.animatingOut = false;
 
         this.connect('destroy', () => {
+            if (this.child != null)
+                this.child.destroy();
             this.label.destroy();
         });
     },