main: Avoid a crash with crossing event handling

We are reusing the GtkCrossingData struct for multiple
calls here, so we need to make sure that the targets
stay alive from beginning to end.

Fixes: #3090

diff --git a/gtk/gtkmain.c b/gtk/gtkmain.c
index a517a0e6e7e21aa4ed754d0e795482292e224372..23c61cd270a7a58faebb3a160d5fb69f4809f5bf 100644 (file)
--- a/gtk/gtkmain.c
+++ b/gtk/gtkmain.c
@@ -1335,9 +1335,9 @@ gtk_synthesize_crossing_events (GtkRoot         *toplevel,
 
   crossing.type = crossing_type;
   crossing.mode = mode;
-  crossing.old_target = old_target;
+  crossing.old_target = old_target ? g_object_ref (old_target) : NULL;
   crossing.old_descendent = NULL;
-  crossing.new_target = new_target;
+  crossing.new_target = new_target ? g_object_ref (new_target) : NULL;
   crossing.new_descendent = NULL;
   crossing.drop = drop;
 
@@ -1417,6 +1417,9 @@ gtk_synthesize_crossing_events (GtkRoot         *toplevel,
         gtk_widget_set_state_flags (widget, GTK_STATE_FLAG_PRELIGHT, FALSE);
     }
 
+  g_clear_object (&crossing.old_target);
+  g_clear_object (&crossing.new_target);
+
   gtk_widget_stack_clear (&target_array);
 }