rbtree: Fix a crash in insertion fixup

This got broken in commit a33ff4c6ab3a196b3c71da48e4e650da85d1691c.

Testcase included.

diff --git a/gtk/gtkrbtree.c b/gtk/gtkrbtree.c
index ebc03504c5f3edd2e8c68aff225664895ee93e4a..219222b1e8aedd3ea702c8b0f1a1f3ae9237bbdd 100644 (file)
--- a/gtk/gtkrbtree.c
+++ b/gtk/gtkrbtree.c
@@ -382,9 +382,9 @@ gtk_rb_tree_insert_fixup (GtkRbTree *tree,
                {
                  /* make node a left child */
                  node = p;
+                 gtk_rb_node_rotate_left (tree, node);
                   p = parent (node);
                   pp = parent (p);
-                 gtk_rb_node_rotate_left (tree, node);
                }
              /* recolor and rotate */
               set_black (p);
@@ -411,9 +411,9 @@ gtk_rb_tree_insert_fixup (GtkRbTree *tree,
              if (node == p->left)
                {
                  node = p;
+                 gtk_rb_node_rotate_right (tree, node);
                   p = parent (node);
                   pp = parent (p);
-                 gtk_rb_node_rotate_right (tree, node);
                }
              set_black (p);
              set_red (pp);

diff --git a/testsuite/gtk/rbtree-crash.c b/testsuite/gtk/rbtree-crash.c
index a4b641fea6f15fa2ec3abf52c0c7b75372305fd5..7abc6c2d7fbc29d30977bc1e375f83c282784698 100644 (file)
--- a/testsuite/gtk/rbtree-crash.c
+++ b/testsuite/gtk/rbtree-crash.c
@@ -273,6 +273,20 @@ test_crash (void)
   gtk_rb_tree_unref (tree);
 }
 
+static void
+test_crash2 (void)
+{
+  GtkRbTree *tree;
+
+  tree = gtk_rb_tree_new (Node, Aug, augment, NULL, NULL);
+
+  add (tree, 0);
+  add (tree, 0);
+  add (tree, 1);
+
+  gtk_rb_tree_unref (tree);
+}
+
 int
 main (int argc, char *argv[])
 {
@@ -280,7 +294,8 @@ main (int argc, char *argv[])
   setlocale (LC_ALL, "C");
   g_test_bug_base ("http://bugzilla.gnome.org/show_bug.cgi?id=%s");
 
-  g_test_add_func ("/csrbtree/crash", test_crash);
+  g_test_add_func ("/rbtree/crash", test_crash);
+  g_test_add_func ("/rbtree/crash2", test_crash2);
 
   return g_test_run ();
 }