Remove a surplus GDK_THREADS_LEAVE() and avoid a potential use after free

2007-07-04  Chris Wilson  <chris@chris-wilson.co.uk>

    * gtk/gtkrecentchoosermenu.c (idle_populate_func),
    (idle_populate_clean_up), (gtk_recent_chooser_menu_populate):
    Remove a surplus GDK_THREADS_LEAVE() and avoid a potential use after
    free in the source destroy notify. (#453033)

svn path=/trunk/; revision=18375

diff --git a/ChangeLog b/ChangeLog
index 5c6d5935f9ee07a1f8ea370e3e137f0ad976501c..e0a7d456176a74e790f3bda3cfb1599ed59e3be4 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2007-07-04  Chris Wilson  <chris@chris-wilson.co.uk>
+
+       * gtk/gtkrecentchoosermenu.c (idle_populate_func),
+       (idle_populate_clean_up), (gtk_recent_chooser_menu_populate):
+       Remove a surplus GDK_THREADS_LEAVE() and avoid a potential use after
+       free in the source destroy notify. (#453033)
+
 2007-07-04  Johan Dahlin  <jdahlin@async.com.br>
 
        * gtk/gtkcelllayout.c (_gtk_cell_layout_buildable_add_child): 

diff --git a/gtk/gtkrecentchoosermenu.c b/gtk/gtkrecentchoosermenu.c
index cff079c071e2d8e47ac12b2ffdc893360dc4b561..8720bcd82b84c96d7267686f7a03d5d5d4162c88 100644 (file)
--- a/gtk/gtkrecentchoosermenu.c
+++ b/gtk/gtkrecentchoosermenu.c
@@ -921,6 +921,7 @@ typedef struct
   gint loaded_items;
   gint displayed_items;
   GtkRecentChooserMenu *menu;
+  GtkWidget *placeholder;
 } MenuPopulateData;
 
 static gboolean
@@ -943,11 +944,9 @@ idle_populate_func (gpointer data)
       if (!pdata->items)
         {
           /* show the placeholder here */
-          gtk_widget_show (priv->placeholder);
+          gtk_widget_show (pdata->placeholder);
           pdata->displayed_items = 1;
 
-          GDK_THREADS_LEAVE ();
-
          return FALSE;
        }
       
@@ -1001,13 +1000,13 @@ static void
 idle_populate_clean_up (gpointer data)
 {
   MenuPopulateData *pdata = data;
-  GtkRecentChooserMenuPrivate *priv = pdata->menu->priv;
 
   /* show the placeholder in case no item survived
    * the filtering process in the idle loop
    */
   if (!pdata->displayed_items)
-    gtk_widget_show (priv->placeholder);
+    gtk_widget_show (pdata->placeholder);
+  g_object_unref (pdata->placeholder);
 
   g_slice_free (MenuPopulateData, data);
 }
@@ -1027,6 +1026,7 @@ gtk_recent_chooser_menu_populate (GtkRecentChooserMenu *menu)
   pdata->loaded_items = 0;
   pdata->displayed_items = 0;
   pdata->menu = menu;
+  pdata->placeholder = g_object_ref (priv->placeholder);
 
   priv->icon_size = get_icon_size_for_widget (GTK_WIDGET (menu));